lkml.org 
[lkml]   [2017]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 197/250] USB: OHCI: Fix race between ED unlink and URB submission
    Date
    From: Alan Stern <stern@rowland.harvard.edu>

    commit 7d8021c967648accd1b78e5e1ddaad655cd2c61f upstream.

    This patch fixes a bug introduced by commit 977dcfdc6031 ("USB: OHCI:
    don't lose track of EDs when a controller dies"). The commit changed
    ed_state from ED_UNLINK to ED_IDLE too early, before finish_urb() had
    been called. The user-visible consequence is that the driver
    occasionally crashes or locks up when an URB is submitted while
    another URB for the same endpoint is being unlinked.

    This patch moves the ED state change later, to the right place. The
    drawback is that now we may unnecessarily execute some instructions
    multiple times when a controller dies. Since controllers dying is an
    exceptional occurrence, a little wasted time won't matter.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Heiko Przybyl <lil_tux@web.de>
    Tested-by: Heiko Przybyl <lil_tux@web.de>
    Fixes: 977dcfdc60311e7aa571cabf6f39c36dde13339e
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    drivers/usb/host/ohci-q.c | 7 +------
    1 file changed, 1 insertion(+), 6 deletions(-)

    diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
    index 1e1563d..7f93dc2 100644
    --- a/drivers/usb/host/ohci-q.c
    +++ b/drivers/usb/host/ohci-q.c
    @@ -927,10 +927,6 @@ rescan_all:
    int completed, modified;
    __hc32 *prev;

    - /* Is this ED already invisible to the hardware? */
    - if (ed->state == ED_IDLE)
    - goto ed_idle;
    -
    /* only take off EDs that the HC isn't using, accounting for
    * frame counter wraps and EDs with partially retired TDs
    */
    @@ -961,14 +957,12 @@ skip_ed:
    }

    /* ED's now officially unlinked, hc doesn't see */
    - ed->state = ED_IDLE;
    if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
    ohci->eds_scheduled--;
    ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
    ed->hwNextED = 0;
    wmb();
    ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
    -ed_idle:

    /* reentrancy: if we drop the schedule lock, someone might
    * have modified this list. normally it's just prepending
    @@ -1039,6 +1033,7 @@ rescan_this:
    if (list_empty(&ed->td_list)) {
    *last = ed->ed_next;
    ed->ed_next = NULL;
    + ed->state = ED_IDLE;
    } else if (ohci->rh_state == OHCI_RH_RUNNING) {
    *last = ed->ed_next;
    ed->ed_next = NULL;
    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2017-06-12 01:15    [W:7.084 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site