Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
To:     "Zengtao (B)" <prime.zeng@hisilicon.com>,
        "johnyoun@synopsys.com" <John.Youn@synopsys.com>
CC:     "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: Possible usb_request leak in the function
 dwc2_gadget_complete_isoc_request_ddma
Thread-Topic: Possible usb_request leak in the function
 dwc2_gadget_complete_isoc_request_ddma
Thread-Index: AQHTsH6zU1BbgxUqlUykEmiFUhyGow==
Date:   Wed, 28 Feb 2018 10:27:14 +0000
Message-ID: <410670D7E743164D87FA6160E7907A560113A9C13B@am04wembxb.internal.synopsys.com>
References: <678F3D1BB717D949B966B68EAEB446ED0C861F47@DGGEMM506-MBX.china.huawei.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi,

On 2/28/2018 1:00 PM, Zengtao (B) wrote:
> Hi johnyoun:
> 
> I found a suspected bug, and I am writing to confirm with you.
> 
> In the function dwc2_gadget_complete_isoc_request_ddma(drivers/usb/dwc2/gadget.c).
> Only the first request from the eq queue is processed while maybe there are more than one descriptors done by the HW.
> 
> 1. Each usb request is associated with a DMA descriptor, but this is not reflect in the driver, so when one DMA descriptor is done,
> we don't know which usb request is done, but I think if only one DMA descriptor is done, we can know that the first USB request in
> eq queue is done, because the HW DMA descriptor and SW usb request are both in sequence.
> 
> 2. In the function dwc2_gadget_complete_isoc_request_ddma, we may complete more than one DMA descriptor but only the first
> Usb request is processed, but in fact, we should all the usb requests associated with all the done DMA descriptors.
> 
> 3. I noticed that each DMA descriptor is configured to report an interrupt, and if each DMA descriptor generate an interrupt, the above
> Flow should be ok, but the interrupts can merge and we have used the depdma to figure out the largest finished DMA descriptor index.
> 

Why you suspect that subsequent interrupts can be merged? Did you see 
this case? Can you provide a log?
Even in case of minimal interval=1, time between 2 subsequent interrupts 
should be about 125us. It's fully enough to process target descriptor, 
complete request, enqueue new request and prepare new descriptor.

Thanks,
Minas

> Looking forward your reply.
> 
> Thank you.
> 
> Regards
> Zengtao
> --
> To unsubscribe from this list: send the line "unsubscribe linux-usb" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  https://urldefense.proofpoint.com/v2/url?u=http-3A__vger.kernel.org_majordomo-2Dinfo.html&d=DwIDAg&c=DPL6_X_6JkXFx7AXWqB0tg&r=6z9Al9FrHR_ZqbbtSAsD16pvOL2S3XHxQnSzq8kusyI&m=vbKt9jwY5FRUysFlZg1CB6HKRyFACygkwZBO0mvSQDc&s=7rLKr3g3UyOZT22GAer-w5wDtv-Bb5awlncAJQ1OICM&e=
>