From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F04419E992 for ; Fri, 17 Jul 2026 02:48:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784256488; cv=none; b=a1ubpHRN7p0BTwM6vJxbetgi+yk7lIkuzEIztF+sIRzy0jlwFf1kZdGT9xCErS63WsPbyAMPevI+O1nnj+eIFk2wZ5cGNNEcdbk1qp+gvDdK40VQtwnFo9QNnNwOUKGiH23EXjJsLm1Spr3DTWYr3ToANJYUjsikmQVlTKvonCo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784256488; c=relaxed/simple; bh=8bqTUKjuttzn17QkNnTKXMAPLtx7G5+VdMTgk/QC/vo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=rPuZsZYl8O5c4RwRqoEbVr2GvtzdBue/8Z04WZI+PDmgDgMuTNlzqeVgqhvFK/4mvZExaN3NW34UcKcsUXofvWyeXyEO852T02fjn6UaKcgWxWlDO8uNaVD0U8O3c/wQRedAvFDB8WS0ZjNjHvD7guKb3J6KiDs6KvoUNYTnpFs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dk+PIrkZ; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dk+PIrkZ" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38e071ed6aeso3968694a91.0 for ; Thu, 16 Jul 2026 19:48:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784256486; x=1784861286; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=30fhBagBzn4vtwaoRNpF/L3n1Myt6V2L2ZrYJGpcEAQ=; b=dk+PIrkZFEjuFOhZOy1j8mV2SfknmN1V3a9hsj5mgusqOCzVXPtyBX381LwtPJHCQU AisSfEsJRoAx//MLxubfAY8hLw2HkFtxbYIwj57ouhJ2zpeBMV7ze5L4SMMHAW3DRduK HpP7ucgKNv+8wCg2COJvIc1QUw4ms0cyJypiS1VJnUqeSSzLFYXa3h/km0H36pqUaw9Y VXv24jY7niUiPLblSXDcekOJw2kQOxTIAVu5h5yBPuWCOCkeld6zGUcGMxAiZ7F7OfeZ m0dayG2is9Spxll57L20WZZRtoRWS32LYQ2Fxy99XWWRTPpzO/a3TFXyefJzFqPCOX+4 AW8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784256486; x=1784861286; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=30fhBagBzn4vtwaoRNpF/L3n1Myt6V2L2ZrYJGpcEAQ=; b=Oa36o/FVZTvoyqgVi+Rptp1Xqa48mMhFcqlNti3rGDWEmO3ncBpNqnX9BZ9rSR6+zs I9EzQqoHlwuRSXhcpHujTOWFhS3RcdnGk0nUSt3sTk/50fmSKaHMPalB7qRqTY0ADqqx sjtUVYwqhbGcVFpkR6E1b/pES6aRURRD1Ov9yWHoDNHjfrJCXUuq4QdyG2D9GSrK74J6 NeyajaNteEQs2/lV5P9C8Vt8WnxFP/Uo+rCFo9yVN7kqnbgckCa2NZ7kKzgX9fR6nQd9 oe/Tp2FEOrX35QeQ0wn7GEoeGpTIsMyj1m6HAm93uZAC+QkcJ+X40EqO16g2e5LOGwG7 ac+Q== X-Forwarded-Encrypted: i=1; AHgh+RotricMD5j+wpl85OMDWka3JTvPOqtBYixASgVQZBb5wp8513otHmdTcuB78qKcSA75A8A/x3FXB5BuAyU=@vger.kernel.org X-Gm-Message-State: AOJu0YxK4WnYRp6zqbnPraB9tcpVia63DXh92rxmBwZlPj9DO4ebZZK4 sfploBigXVpu3ZIVFICdwF342PTe2fDr/9tTVxzahbQHFGUDSjx9iiQv X-Gm-Gg: AfdE7cmrVS9zWdG7rPVr8MMmpoQnh2v9iF+itq8ALDKln4u0lAoL4ba32o5lIozDPo9 hgZx3glSUObzcHyER3T1GHONVtCV4EzzTwnVD6e/trm4DddGxlE4BWzIaVkjgG8vrGvxVVIpTwM O2ZqnLRkzUWXtvJ4HSqK/5R0KsWEXclb5KwRYW4VP8Bh128YDr66V/wZbCz3bN4YCmhm8b+244+ L71njTWTaa2OqRP1Pf4+nyhsrGfgehddCwJZ8RPqj3cl/B6PXfk+XdjQd5xFJ4PH2HgrjcSNxEx yk9SfV7vRzPm67VbxeFy1va/WOcMZavK4tinOvUtxzY9Nnti3QLX/OavSETiUY4Ma8InpRoI7M7 7B2cykzd1K1Nx26KPuWWbiQLEpJ/h8ZIJvPdNEsCiiMI27GoE6O2K+pCSbxHYGZDOgaTC4T8N4b 49Cmc7Og== X-Received: by 2002:a17:90a:e7c1:b0:37f:db06:2299 with SMTP id 98e67ed59e1d1-38e4b53444amr628615a91.21.1784256486422; Thu, 16 Jul 2026 19:48:06 -0700 (PDT) Received: from [198.18.0.1] ([144.24.58.22]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3142a20cfe3sm1223274eec.30.2026.07.16.19.48.03 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 16 Jul 2026 19:48:06 -0700 (PDT) Message-ID: Date: Thu, 16 Jul 2026 22:47:59 -0400 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback To: Alan Stern Cc: gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, bigeasy@linutronix.de, eeodqql09@gmail.com, kees@kernel.org, surban@surban.net, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, stable@vger.kernel.org References: <20260714064829.172098-1-wangjinchao600@gmail.com> <15e5b802-b43a-44c5-97b6-a599f28bdee4@gmail.com> Content-Language: en-US From: Jinchao Wang In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 7/16/2026 10:40 PM, Alan Stern wrote: > On Wed, Jul 15, 2026 at 01:34:13AM -0400, Jinchao Wang wrote: >>> Wow! I'm impressed. How did you figure this out? >> >> With a hardware watchpoint: I armed one on the victim field >> (req->complete, at arg2+56 of usb_gadget_giveback_request) only while >> usb_gadget_giveback_request() was running, and it caught the writing >> memcpy with a full stack - usb_ep_queue <- raw_process_ep_io <- >> raw_ioctl - on the same request that crashed an instant later. >> >> The watchpoint setup came from a small tool I am working on; I posted >> it as an RFC in case it is useful to others: >> >> https://lore.kernel.org/all/20260714182243.10687-1-wangjinchao600@gmail.com/ > > That tool looks really nice. I'm glad to see hardware breakpoints > becoming easier to use, because I wrote a large part of the initial > implementation -- see for example commit 0067f1297241 ("hw-breakpoints: > x86 architecture implementation of Hardware Breakpoint interfaces"). > > Alan Stern Thank you! KWatch builds directly on that work - the perf hw_breakpoint layer does all the heavy lifting, and KWatch only adds a small "reinstall" operation on top, plus the windowing logic around it. I am preparing a v2 of the RFC based on the review so far; if you don't mind, I will Cc you on it. Thanks, Jinchao