[PATCH] USB: serial: oti6858: restart polling after TX allocation failure

[PATCH] USB: serial: oti6858: restart polling after TX allocation failure

[Haowen Tu]

The status interrupt callback stops polling when it schedules send_data().
The work function then sets write_urb_in_use before allocating a one-byte
buffer for the transmit-buffer query. If that allocation fails, it returns
without clearing the flag or resubmitting the status interrupt URB. With
no write URB submitted either, nothing restarts polling and queued data
can no longer make progress.

Use usb_control_msg_recv() to manage the DMA-safe query buffer. Allocation
failures then follow the existing control-transfer error path, which
leaves the FIFO untouched, clears write_urb_in_use and restarts polling.
Adjust the return-value check for the helper's zero-on-success convention.

Fixes: d2126326bd71 ("USB: oti6858: fix DMA buffer on stack")
Signed-off-by: Haowen Tu <tuhaowen@uniontech.com>
---
 drivers/usb/serial/oti6858.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index c6364e8ff71f..917bc68c0f3a 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -261,7 +261,7 @@ static void send_data(struct work_struct *work)
 	struct usb_serial_port *port = priv->port;
 	int count = 0, result;
 	unsigned long flags;
-	u8 *allow;
+	u8 allow;
 
 	spin_lock_irqsave(&priv->lock, flags);
 	if (priv->flags.write_urb_in_use) {
@@ -281,18 +281,13 @@ static void send_data(struct work_struct *work)
 		count = port->bulk_out_size;
 
 	if (count != 0) {
-		allow = kmalloc(1, GFP_KERNEL);
-		if (!allow)
-			return;
-
-		result = usb_control_msg(port->serial->dev,
-				usb_rcvctrlpipe(port->serial->dev, 0),
-				OTI6858_REQ_T_CHECK_TXBUFF,
-				OTI6858_REQ_CHECK_TXBUFF,
-				count, 0, allow, 1, 100);
-		if (result != 1 || *allow != 0)
+		result = usb_control_msg_recv(port->serial->dev, 0,
+					      OTI6858_REQ_T_CHECK_TXBUFF,
+					      OTI6858_REQ_CHECK_TXBUFF,
+					      count, 0, &allow, sizeof(allow), 100,
+					      GFP_KERNEL);
+		if (result || allow != 0)
 			count = 0;
-		kfree(allow);
 	}
 
 	if (count == 0) {
-- 
2.50.1

Re: [PATCH] USB: serial: oti6858: restart polling after TX allocation failure

[sashiko-bot]

> The status interrupt callback stops polling when it schedules send_data().
> The work function then sets write_urb_in_use before allocating a one-byte
> buffer for the transmit-buffer query. If that allocation fails, it returns
> without clearing the flag or resubmitting the status interrupt URB. With
> no write URB submitted either, nothing restarts polling and queued data
> can no longer make progress.
> 
> Use usb_control_msg_recv() to manage the DMA-safe query buffer. Allocation
> failures then follow the existing control-transfer error path, which
> leaves the FIFO untouched, clears write_urb_in_use and restarts polling.
> Adjust the return-value check for the helper's zero-on-success convention.
> 
> Fixes: d2126326bd71 ("USB: oti6858: fix DMA buffer on stack")
> Signed-off-by: Haowen Tu <tuhaowen@uniontech.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/2274A9F7B5D45D06+20261113052738.1479779-1-tuhaowen@uniontech.com?part=1