Re: [PATCH] usb: gadget: dummy_hcd: fix data corruption with queued requests

[Alan Stern]

On Sun, Mar 15, 2026 at 03:55:03PM +0000, Sebastian Urban wrote:
> On 3/15/26 16:28, Alan Stern wrote:
> > Oh, I see now what you mean.  The whole thing uses
> > loop_for_each_entry(), so it always proceeds to the next request in the
> > queue even if the current request isn't finished.  Instead of doing
> > that, it should always handle the first request in the queue.
> > 
> > The loop should be rewritten; it should be more like
> > 
> > 	while (!list_empty(&ep->queue)) {
> > 		req = list_first_entry(&ep->queue);
> > 		...
> > 
> > Then it would behave as expected.
> > 
> I agree that the loop should only ever process the first matching entry. 
> The break I added at the end of the loop body achieves exactly that. 
>   
>   
> 
> 
> I kept list_for_each_entry rather than rewriting to while + 
> list_first_entry because the stream ID filtering at line 1421 uses 
> continue to skip non-matching requests:
> 
>        if (dummy_ep_stream_en(dum_hcd, urb)) {
>            if ((urb->stream_id != req->req.stream_id))
>                continue;
>        }

Ah, that's right.  I had forgotten about that case.

> This wouldn't work with list_first_entry. A structural rewrite would 
> need a separate scan to find the first matching request, which seems 
> risky for a bug fix. If you'd prefer that approach I'm happy to do it as 
> a follow-up patch.

All right, you've convinced me.

Alan Stern