Re: Possible usb_request leak in the function dwc2_gadget_complete_isoc_request_ddma

[Minas Harutyunyan]

Hi,

On 2/28/2018 1:00 PM, Zengtao (B) wrote:
> Hi johnyoun:
> 
> I found a suspected bug, and I am writing to confirm with you.
> 
> In the function dwc2_gadget_complete_isoc_request_ddma(drivers/usb/dwc2/gadget.c).
> Only the first request from the eq queue is processed while maybe there are more than one descriptors done by the HW.
> 
> 1. Each usb request is associated with a DMA descriptor, but this is not reflect in the driver, so when one DMA descriptor is done,
> we don't know which usb request is done, but I think if only one DMA descriptor is done, we can know that the first USB request in
> eq queue is done, because the HW DMA descriptor and SW usb request are both in sequence.
> 
> 2. In the function dwc2_gadget_complete_isoc_request_ddma, we may complete more than one DMA descriptor but only the first
> Usb request is processed, but in fact, we should all the usb requests associated with all the done DMA descriptors.
> 
> 3. I noticed that each DMA descriptor is configured to report an interrupt, and if each DMA descriptor generate an interrupt, the above
> Flow should be ok, but the interrupts can merge and we have used the depdma to figure out the largest finished DMA descriptor index.
> 

Why you suspect that subsequent interrupts can be merged? Did you see 
this case? Can you provide a log?
Even in case of minimal interval=1, time between 2 subsequent interrupts 
should be about 125us. It's fully enough to process target descriptor, 
complete request, enqueue new request and prepare new descriptor.

Thanks,
Minas

> Looking forward your reply.
> 
> Thank you.
> 
> Regards
> Zengtao
> --
> To unsubscribe from this list: send the line "unsubscribe linux-usb" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  https://urldefense.proofpoint.com/v2/url?u=http-3A__vger.kernel.org_majordomo-2Dinfo.html&d=DwIDAg&c=DPL6_X_6JkXFx7AXWqB0tg&r=6z9Al9FrHR_ZqbbtSAsD16pvOL2S3XHxQnSzq8kusyI&m=vbKt9jwY5FRUysFlZg1CB6HKRyFACygkwZBO0mvSQDc&s=7rLKr3g3UyOZT22GAer-w5wDtv-Bb5awlncAJQ1OICM&e=
>