linux-kernel - Re: [PATCH] USB: Fix xhci ERDP update issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Mar 2022 09:56:57 +0800
From:   Peter Chen <hzpeterchen@...il.com>
To:     "WeitaoWang-oc@...oxin.com" <WeitaoWang-oc@...oxin.com>
Cc:     mathias.nyman@...el.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Alan Stern <stern@...land.harvard.edu>,
        USB list <linux-usb@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>, CobeChen@...oxin.com,
        TimGuo@...oxin.com, tonywwang@...oxin.com, weitaowang@...oxin.com
Subject: Re: [PATCH] USB: Fix xhci ERDP update issue

On Thu, Mar 17, 2022 at 1:30 AM WeitaoWang-oc@...oxin.com
<WeitaoWang-oc@...oxin.com> wrote:
>
> On some situations, software handles TRB events slower than adding TRBs,
> xhci_irq will not exit until all events are handled. If xhci_irq just
> handles 256 TRBs and exit, the temp variable(event_ring_deq) driver
> records in xhci irq is equal to driver current dequeue pointer. It will
> cause driver not update ERDP and software dequeue pointer lost sync with
> ERDP. On the next xhci_irq, the event ring is full but driver will not
> update ERDP as software dequeue pointer is equal to ERDP.
>
> [  536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37
> [  566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7
> inflight: CMD OUT
> [  566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78
> 00 00 08 00
> [  572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host
> not responding to stop endpoint command.
> [  572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110
> [  572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not
> responding, assume dead
> [  572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6
> inflight: CMD
> [  572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8
> 00 00 08 00
> [  572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5
> inflight: CMD
>
> Fixed this issue by update software record temp variable when handles
> 128 TRB events.
>
> Signed-off-by: Weitao Wang <WeitaoWang-oc@...oxin.com>

Reviewed-by: Peter Chen <peter.chen@...nel.org>

> ---
>   drivers/usb/host/xhci-ring.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> index d0b6806..f970799 100644
> --- a/drivers/usb/host/xhci-ring.c
> +++ b/drivers/usb/host/xhci-ring.c
> @@ -3141,6 +3141,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
>                  if (event_loop++ < TRBS_PER_SEGMENT / 2)
>                          continue;
>                  xhci_update_erst_dequeue(xhci, event_ring_deq);
> +               event_ring_deq = xhci->event_ring->dequeue;
>
>                  /* ring is half-full, force isoc trbs to interrupt more
> often */
>                  if (xhci->isoc_bei_interval > AVOID_BEI_INTERVAL_MIN)
> --
> 2.7.4