linux-kernel - Re: [PATCH] usb: xhci-ring: USB SSD may fail to unmount if disconnect during data transferring.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a23f3eb7f63290968af3c42bbe5935da@codeaurora.org>
Date:   Fri, 13 Aug 2021 10:03:41 +0800
From:   wat@...eaurora.org
To:     Mathias Nyman <mathias.nyman@...el.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: xhci-ring: USB SSD may fail to unmount if disconnect
 during data transferring.

sorry， This email is invalid because some reason, I will submit another 
email for it.


On 2021-08-13 09:44, wat@...eaurora.org wrote:
> Hi usb teams,
> 
> I have a patch about xhci-ring, can you help me to check?
> 
> you can contact me if you have any question.
> 
> 
> On 2021-08-12 20:02, Tao Wang wrote:
>> From: Tao Wang <quic_wat@...cinc.com>
>> 
>> it stuck in usb_kill_urb() due to urb use_count will not become zero,
>> this means urb giveback is not happen.
>> in xhci_handle_cmd_set_deq() will giveback urb if td's cancel_status
>> equal to TD_CLEARING_CACHE,
>> but in xhci_invalidate_cancelled_tds(), only last canceled td's
>> cancel_status change to TD_CLEARING_CACHE,
>> thus giveback only happen to last urb.
>> 
>> this change set all cancelled_td's cancel_status to TD_CLEARING_CACHE
>> rather than the last one, so all urb can giveback.
>> 
>> Signed-off-by: Tao Wang <quic_wat@...cinc.com>
>> ---
>>  drivers/usb/host/xhci-ring.c | 24 ++++++++++++------------
>>  1 file changed, 12 insertions(+), 12 deletions(-)
>> 
>> diff --git a/drivers/usb/host/xhci-ring.c 
>> b/drivers/usb/host/xhci-ring.c
>> index 8fea44b..c7dd7c0 100644
>> --- a/drivers/usb/host/xhci-ring.c
>> +++ b/drivers/usb/host/xhci-ring.c
>> @@ -960,19 +960,19 @@ static int xhci_invalidate_cancelled_tds(struct
>> xhci_virt_ep *ep)
>>  			td_to_noop(xhci, ring, td, false);
>>  			td->cancel_status = TD_CLEARED;
>>  		}
>> -	}
>> -	if (cached_td) {
>> -		cached_td->cancel_status = TD_CLEARING_CACHE;
>> -
>> -		err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index,
>> -						cached_td->urb->stream_id,
>> -						cached_td);
>> -		/* Failed to move past cached td, try just setting it noop */
>> -		if (err) {
>> -			td_to_noop(xhci, ring, cached_td, false);
>> -			cached_td->cancel_status = TD_CLEARED;
>> +		if (cached_td) {
>> +			cached_td->cancel_status = TD_CLEARING_CACHE;
>> +
>> +			err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index,
>> +							cached_td->urb->stream_id,
>> +							cached_td);
>> +			/* Failed to move past cached td, try just setting it noop */
>> +			if (err) {
>> +				td_to_noop(xhci, ring, cached_td, false);
>> +				cached_td->cancel_status = TD_CLEARED;
>> +			}
>> +			cached_td = NULL;
>>  		}
>> -		cached_td = NULL;
>>  	}
>>  	return 0;
>>  }