From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/usb/gadget/function/f_tcm.c:1308 usbg_cmd_work() error: we previously assumed 'active_cmd' could be null (see line 1265)
Date: Fri, 12 Dec 2025 20:34:27 +0800 [thread overview]
Message-ID: <202512122052.sqLLCkzI-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 187d0801404f415f22c0b31531982c7ea97fa341
commit: 29ed170538729c3c59cb8176ebb62673bbf6c799 usb: gadget: f_tcm: Check overlapped command
date: 12 months ago
:::::: branch date: 2 hours ago
:::::: commit date: 12 months ago
config: x86_64-randconfig-161-20251212 (https://download.01.org/0day-ci/archive/20251212/202512122052.sqLLCkzI-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.4.0-5) 12.4.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202512122052.sqLLCkzI-lkp@intel.com/
smatch warnings:
drivers/usb/gadget/function/f_tcm.c:1308 usbg_cmd_work() error: we previously assumed 'active_cmd' could be null (see line 1265)
vim +/active_cmd +1308 drivers/usb/gadget/function/f_tcm.c
08a1cb0f65fde6f Andrzej Pietrasiewicz 2015-12-11 1226
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1227 static void usbg_cmd_work(struct work_struct *work)
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1228 {
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1229 struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1230
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1231 /*
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1232 * Failure is detected by f_tcm here. Skip submitting the command to the
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1233 * target core if we already know the failing response and send the usb
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1234 * response to the host directly.
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1235 */
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1236 if (cmd->tmr_rsp != RC_RESPONSE_UNKNOWN)
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1237 goto skip;
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1238
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1239 if (cmd->tmr_func)
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1240 usbg_submit_tmr(cmd);
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1241 else
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1242 usbg_submit_cmd(cmd);
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1243
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1244 return;
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1245
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1246 skip:
29ed170538729c3 Thinh Nguyen 2024-12-11 1247 if (cmd->tmr_rsp == RC_OVERLAPPED_TAG) {
29ed170538729c3 Thinh Nguyen 2024-12-11 1248 struct f_uas *fu = cmd->fu;
29ed170538729c3 Thinh Nguyen 2024-12-11 1249 struct se_session *se_sess;
29ed170538729c3 Thinh Nguyen 2024-12-11 1250 struct uas_stream *stream = NULL;
29ed170538729c3 Thinh Nguyen 2024-12-11 1251 struct hlist_node *tmp;
29ed170538729c3 Thinh Nguyen 2024-12-11 1252 struct usbg_cmd *active_cmd = NULL;
29ed170538729c3 Thinh Nguyen 2024-12-11 1253
29ed170538729c3 Thinh Nguyen 2024-12-11 1254 se_sess = cmd->fu->tpg->tpg_nexus->tvn_se_sess;
29ed170538729c3 Thinh Nguyen 2024-12-11 1255
29ed170538729c3 Thinh Nguyen 2024-12-11 1256 hash_for_each_possible_safe(fu->stream_hash, stream, tmp, node, cmd->tag) {
29ed170538729c3 Thinh Nguyen 2024-12-11 1257 int i = stream - &fu->stream[0];
29ed170538729c3 Thinh Nguyen 2024-12-11 1258
29ed170538729c3 Thinh Nguyen 2024-12-11 1259 active_cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[i];
29ed170538729c3 Thinh Nguyen 2024-12-11 1260 if (active_cmd->tag == cmd->tag)
29ed170538729c3 Thinh Nguyen 2024-12-11 1261 break;
29ed170538729c3 Thinh Nguyen 2024-12-11 1262 }
29ed170538729c3 Thinh Nguyen 2024-12-11 1263
29ed170538729c3 Thinh Nguyen 2024-12-11 1264 /* Sanity check */
29ed170538729c3 Thinh Nguyen 2024-12-11 @1265 if (!stream || (active_cmd && active_cmd->tag != cmd->tag)) {
29ed170538729c3 Thinh Nguyen 2024-12-11 1266 usbg_submit_command(cmd->fu, cmd->req);
29ed170538729c3 Thinh Nguyen 2024-12-11 1267 return;
29ed170538729c3 Thinh Nguyen 2024-12-11 1268 }
29ed170538729c3 Thinh Nguyen 2024-12-11 1269
29ed170538729c3 Thinh Nguyen 2024-12-11 1270 reinit_completion(&stream->cmd_completion);
29ed170538729c3 Thinh Nguyen 2024-12-11 1271
29ed170538729c3 Thinh Nguyen 2024-12-11 1272 /*
29ed170538729c3 Thinh Nguyen 2024-12-11 1273 * A UASP command consists of the command, data, and status
29ed170538729c3 Thinh Nguyen 2024-12-11 1274 * stages, each operating sequentially from different endpoints.
29ed170538729c3 Thinh Nguyen 2024-12-11 1275 *
29ed170538729c3 Thinh Nguyen 2024-12-11 1276 * Each USB endpoint operates independently, and depending on
29ed170538729c3 Thinh Nguyen 2024-12-11 1277 * hardware implementation, a completion callback for a transfer
29ed170538729c3 Thinh Nguyen 2024-12-11 1278 * from one endpoint may not reflect the order of completion on
29ed170538729c3 Thinh Nguyen 2024-12-11 1279 * the wire. This is particularly true for devices with
29ed170538729c3 Thinh Nguyen 2024-12-11 1280 * endpoints that have independent interrupts and event buffers.
29ed170538729c3 Thinh Nguyen 2024-12-11 1281 *
29ed170538729c3 Thinh Nguyen 2024-12-11 1282 * The driver must still detect misbehaving hosts and respond
29ed170538729c3 Thinh Nguyen 2024-12-11 1283 * with an overlap status. To reduce false overlap failures,
29ed170538729c3 Thinh Nguyen 2024-12-11 1284 * allow the active and matching stream ID a brief 1ms to
29ed170538729c3 Thinh Nguyen 2024-12-11 1285 * complete before responding with an overlap command failure.
29ed170538729c3 Thinh Nguyen 2024-12-11 1286 * Overlap failure should be rare.
29ed170538729c3 Thinh Nguyen 2024-12-11 1287 */
29ed170538729c3 Thinh Nguyen 2024-12-11 1288 wait_for_completion_timeout(&stream->cmd_completion, msecs_to_jiffies(1));
29ed170538729c3 Thinh Nguyen 2024-12-11 1289
29ed170538729c3 Thinh Nguyen 2024-12-11 1290 /* If the previous stream is completed, retry the command. */
29ed170538729c3 Thinh Nguyen 2024-12-11 1291 if (!hash_hashed(&stream->node)) {
29ed170538729c3 Thinh Nguyen 2024-12-11 1292 usbg_submit_command(cmd->fu, cmd->req);
29ed170538729c3 Thinh Nguyen 2024-12-11 1293 return;
29ed170538729c3 Thinh Nguyen 2024-12-11 1294 }
29ed170538729c3 Thinh Nguyen 2024-12-11 1295
29ed170538729c3 Thinh Nguyen 2024-12-11 1296 /*
29ed170538729c3 Thinh Nguyen 2024-12-11 1297 * The command isn't submitted to the target core, so we're safe
29ed170538729c3 Thinh Nguyen 2024-12-11 1298 * to remove the bitmap index from the session tag pool.
29ed170538729c3 Thinh Nguyen 2024-12-11 1299 */
29ed170538729c3 Thinh Nguyen 2024-12-11 1300 sbitmap_queue_clear(&se_sess->sess_tag_pool,
29ed170538729c3 Thinh Nguyen 2024-12-11 1301 cmd->se_cmd.map_tag,
29ed170538729c3 Thinh Nguyen 2024-12-11 1302 cmd->se_cmd.map_cpu);
29ed170538729c3 Thinh Nguyen 2024-12-11 1303
29ed170538729c3 Thinh Nguyen 2024-12-11 1304 /*
29ed170538729c3 Thinh Nguyen 2024-12-11 1305 * Overlap command tag detected. Cancel any pending transfer of
29ed170538729c3 Thinh Nguyen 2024-12-11 1306 * the command submitted to target core.
29ed170538729c3 Thinh Nguyen 2024-12-11 1307 */
29ed170538729c3 Thinh Nguyen 2024-12-11 @1308 active_cmd->tmr_rsp = RC_OVERLAPPED_TAG;
29ed170538729c3 Thinh Nguyen 2024-12-11 1309 usbg_aborted_task(&active_cmd->se_cmd);
29ed170538729c3 Thinh Nguyen 2024-12-11 1310
29ed170538729c3 Thinh Nguyen 2024-12-11 1311 /* Send the response after the transfer is aborted. */
29ed170538729c3 Thinh Nguyen 2024-12-11 1312 return;
29ed170538729c3 Thinh Nguyen 2024-12-11 1313 }
29ed170538729c3 Thinh Nguyen 2024-12-11 1314
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1315 uasp_send_tm_response(cmd);
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1316 }
20e9ab60e6a6638 Thinh Nguyen 2024-12-11 1317
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2025-12-12 12:34 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-12 12:34 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-12-12 22:29 drivers/usb/gadget/function/f_tcm.c:1308 usbg_cmd_work() error: we previously assumed 'active_cmd' could be null (see line 1265) kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202512122052.sqLLCkzI-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.