linux-kernel - [PATCHv2] musb_host: fix lockup on rxcsr_h

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Apr 2016 09:51:58 +0300
From:	Max Uvarov <muvarov@...il.com>
To:	linux-kernel@...r.kernel.org
Cc:	linux-usb@...r.kernel.org, gregkh@...uxfoundation.org,
	sergei.shtylyov@...entembedded.com, Max Uvarov <muvarov@...il.com>
Subject: [PATCHv2] musb_host: fix lockup on rxcsr_h_error

Fix soft lockup when resetting remote device attached
to usb host. Configuration:
pppd -> musb hub -> usb-serial -> gsm modem
When gsm modem resets, musb rolls in incoming rx interrupts
which does not give any time to other application as result
it totally lock ups. Solution is to keep original logic for RXCSR_H_ERROR
and merge RXCSR_DATAERROR and RXCSR_H_ERROR branches to call same code
for setting rx stall with MUSB_RXCSR_H_WZC_BITS.

Signed-off-by: Max Uvarov <muvarov@...il.com>
---
 v2: use bitwise or for error flags before logical and. (Sergei Shtylyov).

 drivers/usb/musb/musb_host.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index c3d5fc9..2d9aa78 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1592,14 +1592,12 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 
 		/* stall; record URB status */
 		status = -EPIPE;
+	} else if (rx_csr & (MUSB_RXCSR_DATAERROR | MUSB_RXCSR_H_ERROR)) {
 
-	} else if (rx_csr & MUSB_RXCSR_H_ERROR) {
-		dev_dbg(musb->controller, "end %d RX proto error\n", epnum);
-
-		status = -EPROTO;
-		musb_writeb(epio, MUSB_RXINTERVAL, 0);
-
-	} else if (rx_csr & MUSB_RXCSR_DATAERROR) {
+		if (rx_csr & MUSB_RXCSR_H_ERROR) {
+			status = -EPROTO;
+			musb_writeb(epio, MUSB_RXINTERVAL, 0);
+		}
 
 		if (USB_ENDPOINT_XFER_ISOC != qh->type) {
 			dev_dbg(musb->controller, "RX end %d NAK timeout\n", epnum);
-- 
1.9.1