linux-kernel - [PATCH] musb_host: fix lockup on rxcsr_h

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1461653144-9450-1-git-send-email-muvarov@gmail.com>
Date:	Tue, 26 Apr 2016 09:45:44 +0300
From:	Max Uvarov <muvarov@...il.com>
To:	linux-kernel@...r.kernel.org
Cc:	linux-usb@...r.kernel.org, gregkh@...uxfoundation.org,
	balbi@...com, Max Uvarov <muvarov@...il.com>
Subject: [PATCH] musb_host: fix lockup on rxcsr_h_error

Fix soft lockup when resetting remote device attached
to usb host. Configuration:
pppd -> musb hub -> usb-serial -> gms modem
When gsm modem resets, musb rolls in incoming rx interrupts
which does not give any time to other application as result
it totally lock ups. Solution is to keep original logic for RXCSR_H_ERROR
and merge RXCSR_DATAERROR and RXCSR_H_ERROR branches to call same code
for setting rx stall with MUSB_RXCSR_H_WZC_BITS.

Signed-off-by: Max Uvarov <muvarov@...il.com>
---
 drivers/usb/musb/musb_host.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index c3d5fc9..f82d0ae 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1592,14 +1592,13 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 
 		/* stall; record URB status */
 		status = -EPIPE;
+	} else if (rx_csr & MUSB_RXCSR_DATAERROR ||
+		   rx_csr & MUSB_RXCSR_H_ERROR) {
 
-	} else if (rx_csr & MUSB_RXCSR_H_ERROR) {
-		dev_dbg(musb->controller, "end %d RX proto error\n", epnum);
-
-		status = -EPROTO;
-		musb_writeb(epio, MUSB_RXINTERVAL, 0);
-
-	} else if (rx_csr & MUSB_RXCSR_DATAERROR) {
+		if (rx_csr & MUSB_RXCSR_H_ERROR) {
+			status = -EPROTO;
+			musb_writeb(epio, MUSB_RXINTERVAL, 0);
+		}
 
 		if (USB_ENDPOINT_XFER_ISOC != qh->type) {
 			dev_dbg(musb->controller, "RX end %d NAK timeout\n", epnum);
-- 
1.9.1