Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp503449pxb; Wed, 3 Mar 2021 08:24:42 -0800 (PST) X-Google-Smtp-Source: ABdhPJwx/RGIy73dTVhJKgXou06lwtkimBmmCFMpVGMyCINVM+xKXdnAhjPhN+7qwqos/siocn9O X-Received: by 2002:a17:906:f85:: with SMTP id q5mr25997115ejj.108.1614788682147; Wed, 03 Mar 2021 08:24:42 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1614788682; cv=none; d=google.com; s=arc-20160816; b=RBB07tJrEwGWZJEX8FJ7uthXpDrX1a+7n4ILlICLzgvpvKZCAiOvode661FUxcN/eb fDqvo+Tc9H0q2OHoEmkUvE9gQdI6yt4rOACIO44MJlFS20mKltPYB99+INyIvzVQjlvM 3WYwKZDAcuryJL+JlfuCj8kMXmL7vV9czp78zKVsRnEZXv8+2HvKldMwNSq9TT4TjpTh 37bDyxRYACG56L8L3wXcuClzNK3/hw3K7VxaykafnBIf/I3Iwz81r4H9OlXDlG3InmxQ f3CuMAODq1t2HNd5/kCB6DKOqYuWYy60rjdchV9wjn9ItzGT7YzQ+eWpVuy31/Hlsmbj z74Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Dsrb+pfPwTBwKMY8Xb0avAuEsGLlzspKBAwVw6gb7vo=; b=mwzmVgLdAeomL5vOJwHMyOUeychiU2ZjsYFpbcad5VIBLJVq7Ldw8IQJhVe78uJ9z9 unUbDd+ZdgBkCyAiY1PUjTFrNb+pxvm7nu74IyJg335VPTqGPb55GKmbZlunlxBUamlp KmvCRnV10J8C5dalLfc/BYHkby5K8q/W1H/+vKgb6t3wXPu1xcW0PJ2JM39uXsfLLMCE Fxw2qeSTWa0tjVZol6u4qkZ15st0MpLzYY3D0MoVrBbB+aPK0c84t2sgtceXmFyebAvO U/lPHkbpf/4PGYmGUrBLPgjUHT7RH7b2WQNsasKB4klK4+OgCaOKCeNweV1HIuXkDFMK PokQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=j3XGSFnA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id a21si575273edn.317.2021.03.03.08.23.23; Wed, 03 Mar 2021 08:24:42 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=j3XGSFnA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346766AbhCAXuU (ORCPT + 99 others); Mon, 1 Mar 2021 18:50:20 -0500 Received: from mail.kernel.org ([198.145.29.99]:34308 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239195AbhCASMF (ORCPT ); Mon, 1 Mar 2021 13:12:05 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 636FE6516A; Mon, 1 Mar 2021 17:07:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1614618422; bh=dbmBbJIQd5Su2jJKkyvUXkfSRniCgdQy9uxz8YeJee8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j3XGSFnAOJeOXxSlMtN/hJsaykq0vSze0d1yluhJCcleQ4EEwUDVHbHUuIT+MmLTT l+IRGEDPQKvDtgpuJ8I4f7ETXeZ6LDWEI9HCWAoTl+gZmRA9+jLlUqZhCqrCe9nQHC A5MoMRBuETzg1/xfN1J6df47Mw+lZxxAfKrdXrmc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Boris ARZUR , Douglas Anderson , Nicolas Saenz Julienne , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 064/663] usb: dwc2: Abort transaction after errors with unknown reason Date: Mon, 1 Mar 2021 17:05:12 +0100 Message-Id: <20210301161144.903821310@linuxfoundation.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210301161141.760350206@linuxfoundation.org> References: <20210301161141.760350206@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Guenter Roeck [ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ] In some situations, the following error messages are reported. dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021 This is sometimes followed by: dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length and then: WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913 dwc2_assign_and_init_hc+0x98c/0x990 The warning suggests that an odd buffer address is to be used for DMA. After an error is observed, the receive buffer may be full (urb->actual_length >= urb->length). However, the urb is still left in the queue unless three errors were observed in a row. When it is queued again, the dwc2 hcd code translates this into a 1-block transfer. If urb->actual_length (ie the total expected receive length) is not DMA-aligned, the buffer pointer programmed into the chip will be unaligned. This results in the observed warning. To solve the problem, abort input transactions after an error with unknown cause if the entire packet was already received. This may be a bit drastic, but we don't really know why the transfer was aborted even though the entire packet was received. Aborting the transfer in this situation is less risky than accepting a potentially corrupted packet. With this patch in place, the 'ChHltd set' and 'trimming xfer length' messages are still observed, but there are no more transfer attempts with odd buffer addresses. Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better") Cc: Boris ARZUR Cc: Douglas Anderson Tested-by: Nicolas Saenz Julienne Reviewed-by: Douglas Anderson Signed-off-by: Guenter Roeck Signed-off-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c index a052d39b4375e..12819e019e13c 100644 --- a/drivers/usb/dwc2/hcd_intr.c +++ b/drivers/usb/dwc2/hcd_intr.c @@ -1977,6 +1977,18 @@ error: qtd->error_count++; dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb, qtd, DWC2_HC_XFER_XACT_ERR); + /* + * We can get here after a completed transaction + * (urb->actual_length >= urb->length) which was not reported + * as completed. If that is the case, and we do not abort + * the transfer, a transfer of size 0 will be enqueued + * subsequently. If urb->actual_length is not DMA-aligned, + * the buffer will then point to an unaligned address, and + * the resulting behavior is undefined. Bail out in that + * situation. + */ + if (qtd->urb->actual_length >= qtd->urb->length) + qtd->error_count = 3; dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd); dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR); } -- 2.27.0