linux/drivers/usb/gadget/function
Krishna Kurapati 76c5114682 usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
It is observed sometimes when tethering is used over NCM with Windows 11
as host, at some instances, the gadget_giveback has one byte appended at
the end of a proper NTB. When the NTB is parsed, unwrap call looks for
any leftover bytes in SKB provided by u_ether and if there are any pending
bytes, it treats them as a separate NTB and parses it. But in case the
second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that
were parsed properly in the first NTB and saved in rx_list are dropped.

Adding a few custom traces showed the following:
[002] d..1  7828.532866: dwc3_gadget_giveback: ep1out:
req 000000003868811a length 1025/16384 zsI ==> 0
[002] d..1  7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025
[002] d..1  7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67
[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400
[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10
[002] d..1  7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames

In this case, the giveback is of 1025 bytes and block length is 1024.
The rest 1 byte (which is 0x00) won't be parsed resulting in drop of
all datagrams in rx_list.

Same is case with packets of size 2048:
[002] d..1  7828.557948: dwc3_gadget_giveback: ep1out:
req 0000000011dfd96e length 2049/16384 zsI ==> 0
[002] d..1  7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1  7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800

Lecroy shows one byte coming in extra confirming that the byte is coming
in from PC:

 Transfer 2959 - Bytes Transferred(1025)  Timestamp((18.524 843 590)
 - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)
 --- Packet 4063861
       Data(1024 bytes)
       Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)
 --- Packet 4063863
       Data(1 byte)
       Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)

According to Windows driver, no ZLP is needed if wBlockLength is non-zero,
because the non-zero wBlockLength has already told the function side the
size of transfer to be expected. However, there are in-market NCM devices
that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.
To deal with such devices, it pads an extra 0 at end so the transfer is no
longer multiple of wMaxPacketSize.

Cc: <stable@vger.kernel.org>
Fixes: 9f6ce4240a ("usb: gadget: f_ncm.c added")
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20240205074650.200304-1-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-02-19 09:33:27 +01:00
..
f_acm.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_ecm.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_eem.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_fs.c USB / Thunderbolt changes for 6.8-rc1 2024-01-18 11:43:55 -08:00
f_hid.c usb: gadget: f_hid: fix report descriptor allocation 2023-12-07 10:12:05 +09:00
f_loopback.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_mass_storage.c usb: f_mass_storage: forbid async queue when shutdown happen 2024-01-27 16:40:07 -08:00
f_mass_storage.h
f_midi2.c usb: gadget: unconditionally allocate hs/ss descriptor in bind operation 2023-08-22 14:48:33 +02:00
f_midi.c usb: gadget: f_midi: Replace strlcpy() with strscpy() 2023-11-22 12:02:53 +00:00
f_ncm.c usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs 2024-02-19 09:33:27 +01:00
f_obex.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_phonet.c
f_printer.c
f_rndis.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_serial.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_sourcesink.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_subset.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_tcm.c usb: gadget: f_tcm: Remove snprintf() from sysfs call-backs and replace with sysfs_emit() 2023-12-04 22:25:17 +09:00
f_uac1_legacy.c
f_uac1.c usb: gadget: f_uac1: Replace snprintf() with the safer scnprintf() variant 2023-12-15 13:55:29 +01:00
f_uac2.c usb: gadget: f_uac2: Replace snprintf() with the safer scnprintf() variant 2023-12-15 13:55:29 +01:00
f_uvc.c Revert "usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind()" 2024-01-04 16:01:45 +01:00
f_uvc.h usb: gadget: uvc: prevent use of disabled endpoint 2023-11-23 12:32:44 +00:00
g_zero.h
Makefile
ndis.h
rndis.c
rndis.h
storage_common.c
storage_common.h
tcm.h
u_audio.c
u_audio.h
u_ecm.h
u_eem.h
u_ether_configfs.h
u_ether.c usb: gadget: u_ether: Re-attach netif device to mirror detachment 2024-01-04 16:04:28 +01:00
u_ether.h usb: gadget: add a inline function gether_bitrate() 2023-08-22 14:48:33 +02:00
u_fs.h
u_gether.h
u_hid.h
u_midi2.h
u_midi.h
u_ncm.h usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs 2024-01-04 16:01:14 +01:00
u_phonet.h
u_printer.h
u_rndis.h
u_serial.c
u_serial.h
u_tcm.h
u_uac1_legacy.c
u_uac1_legacy.h
u_uac1.h
u_uac2.h usb: gadget: f_uac2: allow changing terminal types through configfs 2023-10-05 09:35:43 +02:00
u_uvc.h usb: gadget: webcam: Make g_webcam loadable again 2023-12-15 18:27:38 +01:00
uac_common.h
uvc_configfs.c usb: gadget: uvc: Replace snprintf() with the safer scnprintf() variant 2023-12-15 13:55:29 +01:00
uvc_configfs.h
uvc_queue.c
uvc_queue.h
uvc_v4l2.c usb: gadget: uvc: Fix use-after-free for inflight usb_requests 2023-11-23 12:32:44 +00:00
uvc_v4l2.h
uvc_video.c usb: gadget: uvc: Remove nested locking 2024-01-05 10:35:57 +01:00
uvc_video.h usb: gadget: uvc: move video disable logic to its own function 2023-11-23 12:32:44 +00:00
uvc.h usb:gadget:uvc Do not use worker thread to pump isoc usb requests 2023-11-23 12:32:44 +00:00