lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 20 Dec 2016 13:59:51 +0800 From: Baolin Wang <baolin.wang@...aro.org> To: mathias.nyman@...el.com, gregkh@...uxfoundation.org Cc: baolu.lu@...ux.intel.com, linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, broonie@...nel.org, baolin.wang@...aro.org, linaro-kernel@...ts.linaro.org Subject: [PATCH v2 2/2] usb: host: xhci: Handle the right timeout command If a command event is found on the event ring during an interrupt, we need to stop the command timer with del_timer(). Since del_timer() can fail if the timer is running and waiting on the xHCI lock, then it maybe get the wrong timeout command in xhci_handle_command_timeout() if host fetched a new command and updated the xhci->current_cmd in handle_cmd_completion(). For this situation, we need a way to signal to the command timer that everything is fine and it should exit. We should check if the command timer is pending in xhci_handle_command_timeout() function, if the command timer is pending, which means current timeout command has been handled by host and host has fetched new command and re-added the command timer, then just return and wait for new current command. If not, it means current command is timeout and need to be handled. Signed-off-by: Baolin Wang <baolin.wang@...aro.org> --- Changes since v1: - Remove the counter and just check if the command timer is pending. --- drivers/usb/host/xhci-ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 9965a4c..3947344 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1269,7 +1269,7 @@ void xhci_handle_command_timeout(unsigned long data) xhci = (struct xhci_hcd *) data; spin_lock_irqsave(&xhci->lock, flags); - if (!xhci->current_cmd) { + if (!xhci->current_cmd || timer_pending(&xhci->cmd_timer)) { spin_unlock_irqrestore(&xhci->lock, flags); return; } -- 1.7.9.5
Powered by blists - more mailing lists