Re: [PATCH] xhci: Fix command ring pointer corruption while aborting a command

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 1.10.2021 10.22, Pavankumar Kondeti wrote:
> The command ring pointer is located at [6:63] bits of the command
> ring control register (CRCR). All the control bits like command stop,
> abort are located at [0:3] bits. While aborting a command, we read the
> CRCR and set the abort bit and write to the CRCR. The read will always
> give command ring pointer as all zeros. So we essentially write only
> the control bits. Since we split the 64 bit write into two 32 bit writes,
> there is a possibility of xHC command ring stopped before the upper
> dword (all zeros) is written. If that happens, xHC updates the upper
> dword of its internal command ring pointer with all zeros. Next time,
> when the command ring is restarted, we see xHC memory access failures.
> Fix this issue by only writing to the lower dword of CRCR where all
> control bits are located.
> 
> Signed-off-by: Pavankumar Kondeti <pkondeti@xxxxxxxxxxxxxx>


Thanks, nice catch.

Adding to queue

-Mathias




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux