usb: gadget: f_tcm: Stall on invalid CBW

If the BOT command CBW is invalid, make sure to respond by setting
status endpoint STALL until the next proper CBW or reset.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/96022e2d5225f01a20263a4ba9c2e2c8a63328b8.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 0c7a41568f400a3423183262cc797aaad89fe222..7ea48845f8c3c54926bba9f55c883a21eb3db01c 100644 (file)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -287,8 +287,17 @@ static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
                return;
 
        ret = bot_submit_command(fu, req->buf, req->actual);
-       if (ret)
+       if (ret) {
                pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
+               if (!(fu->flags & USBG_BOT_WEDGED))
+                       usb_ep_set_wedge(fu->ep_in);
+
+               fu->flags |= USBG_BOT_WEDGED;
+               bot_enqueue_cmd_cbw(fu);
+       } else if (fu->flags & USBG_BOT_WEDGED) {
+               fu->flags &= ~USBG_BOT_WEDGED;
+               usb_ep_clear_halt(fu->ep_in);
+       }
 }
 
 static int bot_prepare_reqs(struct f_uas *fu)
@@ -442,6 +451,11 @@ static int usbg_bot_setup(struct usb_function *f,
 
        case US_BULK_RESET_REQUEST:
                /* XXX maybe we should remove previous requests for IN + OUT */
+               if (fu->flags & USBG_BOT_WEDGED) {
+                       fu->flags &= ~USBG_BOT_WEDGED;
+                       usb_ep_clear_halt(fu->ep_in);
+               }
+
                bot_enqueue_cmd_cbw(fu);
                return 0;
        }

diff --git a/drivers/usb/gadget/function/tcm.h b/drivers/usb/gadget/function/tcm.h
index f6d6c86d10b3f6d2e1ed00df1aa3efcb7cd2142a..009974d81d66bb6a436d2ce56da3c37d1098dc41 100644 (file)
--- a/drivers/usb/gadget/function/tcm.h
+++ b/drivers/usb/gadget/function/tcm.h
@@ -130,6 +130,7 @@ struct f_uas {
 #define USBG_USE_STREAMS       (1 << 2)
 #define USBG_IS_BOT            (1 << 3)
 #define USBG_BOT_CMD_PEND      (1 << 4)
+#define USBG_BOT_WEDGED                (1 << 5)
 
        struct usbg_cdb         cmd[USBG_NUM_CMDS];
        struct usb_ep           *ep_in;