Linux USB
 help / color / mirror / Atom feed
From: Ingo Rohloff <ingo.rohloff@lauterbach.com>
To: gregkh@linuxfoundation.org
Cc: viro@zeniv.linux.org.uk, nkapron@google.com, me@samcday.com,
	nuno.sa@analog.com, michael.bommarito@gmail.com,
	prostitisgabriel@gmail.com, kees@kernel.org,
	linux-usb@vger.kernel.org,
	Ingo Rohloff <ingo.rohloff@lauterbach.com>
Subject: [PATCH] usb: gadget: f_fs: Fix synchronous read() behavior
Date: Thu,  3 Sep 2026 17:37:37 +0200	[thread overview]
Message-ID: <20260903153737.58087-1-ingo.rohloff@lauterbach.com> (raw)

To provide consistent read() behavior, USB requests submitted to the UDC
for OUT endpoints must always have a length that is a multiple of the OUT
endpoint's max_packet_size.

Consider a UDC where usb_ep_align_maybe() aligns the request length.

If a request completes with more data than was requested by the read()
call, the excess data is buffered and is returned by the next read() call
via __ffs_epfile_read_buffered().

The buffered excess data has at most "max_packet_size-1" bytes.  This
happens if read() requests "n*max_packet_size+1" bytes and the USB host
sends "(n+1)*max_packet_size" bytes.

However, if usb_ep_align_maybe() does not align the request length to a
multiple of max_packet_size, the behavior is different.  For example, with a
max_packet_size of 512 bytes (USB HighSpeed), a read() request for 512+128
bytes may be completed by an OUT transfer containing 512+256 bytes.  The
kernel returns 512+128 bytes to userspace, while the remaining 128 bytes are
discarded by the UDC instead of being buffered.  The next read() call then
blocks until the USB host submits another OUT transfer.

The former behavior is the expected one.  Enforce it by using
usb_ep_align() instead of usb_ep_align_maybe().

Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com>
---
 drivers/usb/gadget/function/f_fs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 43962e05eacf..d31a6330d6a0 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1078,11 +1078,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 		}
 		data_len = iov_iter_count(&io_data->data);
 		/*
-		 * Controller may require buffer size to be aligned to
-		 * maxpacketsize of an out endpoint.
+		 * To expose a stream like interface for read(), make sure
+		 * the enqueued read request is a multiple of the maxpacketsize
+		 * of an out endpoint.
 		 */
 		if (io_data->read)
-			data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
+			data_len = usb_ep_align(ep->ep, data_len);
 
 		io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE;
 		spin_unlock_irq(&epfile->ffs->eps_lock);
-- 
2.55.0


                 reply	other threads:[~2026-09-03 15:37 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260903153737.58087-1-ingo.rohloff@lauterbach.com \
    --to=ingo.rohloff@lauterbach.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=kees@kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=me@samcday.com \
    --cc=michael.bommarito@gmail.com \
    --cc=nkapron@google.com \
    --cc=nuno.sa@analog.com \
    --cc=prostitisgabriel@gmail.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox