Re: list_del corruption (NULL pointer dereference) on xhci-pci unbind

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Oct 14, 2022 at 07:02:13PM +0300, Mathias Nyman wrote:
> This whole software bandwidth issue should only be visible in Intel
> Panther Point PCH xHC (Ivy bridge)

It is indeed Ivy Bridge platform.

> Endpoints should be deleted from bw_table list, and xhci_virt_devices
> should be freed already before xhci_mem_cleanup() is called if all goes well.
> 
> Normally endpoints are deleted from bw_table list during usb_disconnect()
> 
> usb_disconnect()
>   ...
>   usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
>     hcd->driver->drop_endpoint()  // flags endpoint to be dropped
>     hcd->driver->check_bandwidth()
>     ->xhci_check_bandwidth()
>       xhci_configure_endpoint()
>         xhci_reserve_bandwidth()  // only for Panther Point
>           xhci_drop_ep_from_interval_table()
> 
> But to avoid queuing new commands to a host in XHCI_STATE_DYING or
> XHCI_STATE_REMOVING state we return early, not calling xhci_reserve_bandwidth().

Indeed when I remove that early return in xhci_check_bandwidth(), the
crash is gone. What's the proper solution?

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux