From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from mx2.suse.de ([195.135.220.15]:38503 "EHLO mx2.suse.de"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1753054AbcGDIIU (ORCPT <rfc822;stable@vger.kernel.org>);
	Mon, 4 Jul 2016 04:08:20 -0400
Message-ID: <1467619450.9978.3.camel@suse.com>
Subject: Re: [PATCH v2] cdc-wdm: fix "out-of-sync" due to missing
 notifications
From: Oliver Neukum <oneukum@suse.com>
To: =?ISO-8859-1?Q?Bj=F8rn?= Mork <bjorn@mork.no>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-usb@vger.kernel.org, stable@vger.kernel.org
Date: Mon, 04 Jul 2016 10:04:10 +0200
In-Reply-To: <1467575977-26693-1-git-send-email-bjorn@mork.no>
References: <1467575977-26693-1-git-send-email-bjorn@mork.no>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Sun, 2016-07-03 at 21:59 +0200, Bjørn Mork wrote:
> 		default:
> @@ -200,10 +200,29 @@ static void wdm_in_callback(struct urb *urb)
>  			desc->reslength = length;
>  		}
>  	}
> +
> +	/*
> +	 * If desc->resp_count is unset, then the urb was submitted
> +	 * without a prior notification.  If the device returned any
> +	 * data, then this implies that it had messages queued without
> +	 * notifying us.  Continue reading until that queue is flushed.
> +	 */
> +	if (!desc->resp_count) {
> +		if (!length) {
> +			/* do not propagate the expected -EPIPE */
> +			desc->rerr = 0;
> +			goto unlock;
> +		}
> +		dev_dbg(&desc->intf->dev, "got %d bytes without notification\n", length);
> +		set_bit(WDM_RESPONDING, &desc->flags);
> +		usb_submit_urb(desc->response, GFP_ATOMIC);

You must check for being in an overflow condition.

> +	}
> +
>  skip_error:
>  	wake_up(&desc->wait);
>  
>  	set_bit(WDM_READ, &desc->flags);
> +unlock:
>  	spin_unlock(&desc->iuspin);
>  }
>  
> @@ -647,6 +666,16 @@ static int wdm_open(struct inode *inode, struct file *file)

If you go for that approack you also need to do it
in resume()

	Regards
		Oliver