[PATCH 3.13.y-ckt 18/60] USB: OHCI: Fix race between ED unlink and URB submission

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 18/60] USB: OHCI: Fix race between ED unlink and URB submission
Date	2015-09-02 03:20 +0200
Message-ID	<q44Su-6P9-13@gated-at.bofh.it> (permalink)
References	<q44z8-6cH-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt26 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 7d8021c967648accd1b78e5e1ddaad655cd2c61f upstream.

This patch fixes a bug introduced by commit 977dcfdc6031 ("USB: OHCI:
don't lose track of EDs when a controller dies").  The commit changed
ed_state from ED_UNLINK to ED_IDLE too early, before finish_urb() had
been called.  The user-visible consequence is that the driver
occasionally crashes or locks up when an URB is submitted while
another URB for the same endpoint is being unlinked.

This patch moves the ED state change later, to the right place.  The
drawback is that now we may unnecessarily execute some instructions
multiple times when a controller dies.  Since controllers dying is an
exceptional occurrence, a little wasted time won't matter.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Heiko Przybyl <lil_tux@web.de>
Tested-by: Heiko Przybyl <lil_tux@web.de>
Fixes: 977dcfdc60311e7aa571cabf6f39c36dde13339e
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/host/ohci-q.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index 4e9f6a4..810bfb1 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -929,10 +929,6 @@ rescan_all:
 		int			completed, modified;
 		__hc32			*prev;
 
-		/* Is this ED already invisible to the hardware? */
-		if (ed->state == ED_IDLE)
-			goto ed_idle;
-
 		/* only take off EDs that the HC isn't using, accounting for
 		 * frame counter wraps and EDs with partially retired TDs
 		 */
@@ -963,14 +959,12 @@ skip_ed:
 		}
 
 		/* ED's now officially unlinked, hc doesn't see */
-		ed->state = ED_IDLE;
 		if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
 			ohci->eds_scheduled--;
 		ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
 		ed->hwNextED = 0;
 		wmb();
 		ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
-ed_idle:
 
 		/* reentrancy:  if we drop the schedule lock, someone might
 		 * have modified this list.  normally it's just prepending
@@ -1041,6 +1035,7 @@ rescan_this:
 		if (list_empty(&ed->td_list)) {
 			*last = ed->ed_next;
 			ed->ed_next = NULL;
+			ed->state = ED_IDLE;
 		} else if (ohci->rh_state == OHCI_RH_RUNNING) {
 			*last = ed->ed_next;
 			ed->ed_next = NULL;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt26 stable review Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:00 +0200
  [PATCH 3.13.y-ckt 46/60] ipr: Fix locking for unit attention handling Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:00 +0200
  [PATCH 3.13.y-ckt 32/60] usb: gadget: mv_udc_core: fix phy_regs I/O memory leak Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:00 +0200
  [PATCH 3.13.y-ckt 57/60] ALSA: hda - fix cs4210_spdif_automute() Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 22/60] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 30/60] net: Clone skb before setting peeked flag Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 43/60] ALSA: usb-audio: add dB range mapping for some devices Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 50/60] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 20/60] blkcg: fix gendisk reference leak in blkg_conf_prep() Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 34/60] bonding: fix destruction of bond with devices different from arphrd_ether Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 58/60] niu: don't count tx error twice in case of headroom realloc fails Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 23/60] md/raid1: fix test for 'was read error from last working device'. Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 49/60] ALSA: hda - Fix MacBook Pro 5,2 quirk Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 55/60] netfilter: nf_conntrack: Support expectations in different zones Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 38/60] iscsi-target: Fix iscsit_start_kthreads failure OOPs Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 53/60] ipvs: fix crash with sync protocol v0 and FTP Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 26/60] mmc: sdhci-pxav3: fix platform_data is not initialized Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 27/60] mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 44/60] drm/radeon/combios: add some validation of lvds values Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 24/60] mmc: omap_hsmmc: Fix DTO and DCRC handling Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 39/60] iscsi-target: Fix iser explicit logout TX kthread leak Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 37/60] iscsi-target: Fix use-after-free during TPG session shutdown Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 40/60] ALSA: hda - Apply fixup for another Toshiba Satellite S50D Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 33/60] inet: frags: fix defragmented packet's IP header for af_packet Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 42/60] xfs: remote attributes need to be considered data Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 52/60] bridge: mdb: fix delmdb state in the notification Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 29/60] bonding: correctly handle bonding type change on enslave failure Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 47/60] ipr: Fix incorrect trace indexing Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 51/60] netfilter: ctnetlink: put back references to master ct and expect objects Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 45/60] x86/efi: Use all 64 bit of efi_memmap in setup_e820() Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 31/60] bridge: mdb: fix double add notification Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 35/60] ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 48/60] ipr: Fix invalid array indexing for HRRQ Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 41/60] vhost: actually track log eventfd file Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 36/60] ASoC: pcm1681: Fix setting de-emphasis sampling rate selection Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:10 +0200
  [PATCH 3.13.y-ckt 03/60] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 17/60] xhci: do not report PLC when link is in internal resume state Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 18/60] USB: OHCI: Fix race between ED unlink and URB submission Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 08/60] mac80211: clear subdir_stations when removing debugfs Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 10/60] md/raid10: always set reshape_safe when initializing reshape_position. Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
    Re: [PATCH 3.13.y-ckt 10/60] md/raid10: always set reshape_safe  when initializing reshape_position. Kamal Mostafa <kamal@canonical.com> - 2015-09-04 21:40 +0200
  [PATCH 3.13.y-ckt 05/60] libata: force disable trim for SuperSSpeed S238 Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 13/60] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 06/60] libata: increase the timeout when setting transfer mode Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 11/60] drm: Stop resetting connector state to unknown Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 09/60] ALSA: hda - Add new GPU codec ID 0x10de007d to snd-hda Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 16/60] xhci: prevent bus_suspend if SS port resuming in phase 1 Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 25/60] isdn/gigaset: reset tty->receive_room when attaching ser_gigaset Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 19/60] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 02/60] ata: pmp: add quirk for Marvell 4140 SATA PMP Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 04/60] libata: add ATA_HORKAGE_NOTRIM Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 15/60] xhci: report U3 when link is in resume state Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 21/60] tile: use free_bootmem_late() for initrd Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 12/60] usb: dwc3: Reset the transfer resource index on SET_INTERFACE Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200
  [PATCH 3.13.y-ckt 07/60] libata: Do not blacklist M510DC Kamal Mostafa <kamal@canonical.com> - 2015-09-02 03:20 +0200

csiph-web