Re: [PATCH 3.11-stable] xhci: Fix race between ep halt and URB cancellation

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I did not mark it for stable because it was not an urgent fix.  It
doesn't fix an oops, and this code has been in the driver for years
before this bug was reported.  Florian did not mention which userspace
driver was impacted by this issue, so I have no idea how much impact
this bug fix will have.

Greg's been picker about what code goes into stable, so I've been picker
as well.

Sarah Sharp

On Mon, Sep 30, 2013 at 02:02:21PM +0900, Jonghwan Choi wrote:
> This patch looks like it should be in the 3.11-stable tree, should we apply
> it?
> 
> ------------------
> 
> From: "Florian Wolter <wolly84@xxxxxx>"
> 
> commit 526867c3ca0caa2e3e846cb993b0f961c33c2abb upstream
> 
> The halted state of a endpoint cannot be cleared over CLEAR_HALT from a
> user process, because the stopped_td variable was overwritten in the
> handle_stopped_endpoint() function. So the xhci_endpoint_reset() function
> will
> refuse the reset and communication with device can not run over this
> endpoint.
> https://bugzilla.kernel.org/show_bug.cgi?id=60699
> 
> Signed-off-by: Florian Wolter <wolly84@xxxxxx>
> Signed-off-by: Sarah Sharp <sarah.a.sharp@xxxxxxxxxxxxxxx>
> Signed-off-by: Jonghwan Choi <jhbird.choi@xxxxxxxxxxx>
> ---
>  drivers/usb/host/xhci-ring.c |    8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> index 5b08cd8..c2daaf7 100644
> --- a/drivers/usb/host/xhci-ring.c
> +++ b/drivers/usb/host/xhci-ring.c
> @@ -847,8 +847,12 @@ remove_finished_td:
>  		/* Otherwise ring the doorbell(s) to restart queued
> transfers */
>  		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
>  	}
> -	ep->stopped_td = NULL;
> -	ep->stopped_trb = NULL;
> +
> +	/* Clear stopped_td and stopped_trb if endpoint is not halted */
> +	if (!(ep->ep_state & EP_HALTED)) {
> +		ep->stopped_td = NULL;
> +		ep->stopped_trb = NULL;
> +	}
>  
>  	/*
>  	 * Drop the lock and complete the URBs in the cancelled TD list.
> -- 
> 1.7.9.5
> 
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]