The function xhci_cmd_to_noop does two things: it turns a canceled
command into a no-op command, and it calls the command's completion
structure.
However, if buggy code leads us to not find the command in the command
ring, we can leave a canceled command waiting on a completion. This is
unlikely to happen, but be defensive and make sure the command gets
completed before it is removed from the cancellation list.
This patch should be backported to kernels as old as 3.0, that contain
the commit b63f4053cc8aa22a98e3f9a97845afe6c15d0a0d "xHCI: handle
command after aborting the command ring"
Signed-off-by: Sarah Sharp <sarah.a.sharp@xxxxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
drivers/usb/host/xhci-ring.c | 12 ++++--------
1 files changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 306f1cc..79ec0be 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1263,14 +1263,6 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
continue;
if (cur_cd->cmd_trb == cmd_trb) {
-
- /* If the command in device's command list, we should
- * finish it and free the command structure.
- */
- if (cur_cd->command)
- xhci_complete_cmd_in_cmd_wait_list(xhci,
- cur_cd->command, COMP_CMD_STOP);
-
/* get cycle state from the origin command trb */
cycle_state = le32_to_cpu(cmd_trb->generic.field[3])
& TRB_CYCLE;
@@ -1296,6 +1288,10 @@ static void xhci_cancel_cmd_in_cd_list(struct xhci_hcd *xhci)
list_for_each_entry_safe(cur_cd, next_cd,
&xhci->cancel_cmd_list, cancel_cmd_list) {
xhci_cmd_to_noop(xhci, cur_cd);
+ if (cur_cd->command)
+ xhci_complete_cmd_in_cmd_wait_list(xhci,
+ cur_cd->command, COMP_CMD_STOP);
+
list_del(&cur_cd->cancel_cmd_list);
kfree(cur_cd);
}
--
1.7.9
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
