linux-kernel - Re: [PATCH] USB: Fix xhci ERDP update issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 18 Mar 2022 08:45:19 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     "WeitaoWang-oc@...oxin.com" <WeitaoWang-oc@...oxin.com>
Cc:     mathias.nyman@...el.com, hzpeterchen@...il.com,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        TonyWWang-oc@...oxin.com, weitaowang@...oxin.com,
        CobeChen@...oxin.com, TimGuo@...oxin.com
Subject: Re: [PATCH] USB: Fix xhci ERDP update issue

On Fri, Mar 18, 2022 at 03:32:14PM +0800, WeitaoWang-oc@...oxin.com wrote:
> On some situations, software handles TRB events slower than adding TRBs.
> If the number of TRB events to be processed in a given interrupt is 256.
> The local variable "event_ring_deq" that records in interrupt handler
> is equal to software_dequeue. It will cause driver not update ERDP,then
> software dequeue pointer is out of sync with ERDP on interrupt exit.
> On the next interrupt, the event ring may full but driver will not
> update ERDP as software_dequeue is equal to ERDP.
> 
> [  536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37
> [  566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7
> inflight: CMD OUT
> [  566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78 00
> 00 08 00
> [  572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host not
> responding to stop endpoint command.
> [  572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110
> [  572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not responding,
> assume dead
> [  572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6
> inflight: CMD
> [  572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8 00
> 00 08 00
> [  572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5
> inflight: CMD
> 
> Fixed this issue by update software record local variable when handles 128
> TRB events.
> 
> Signed-off-by: Weitao Wang <WeitaoWang-oc@...oxin.com>
> ---
>  drivers/usb/host/xhci-ring.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> index d0b6806..f970799 100644
> --- a/drivers/usb/host/xhci-ring.c
> +++ b/drivers/usb/host/xhci-ring.c
> @@ -3141,6 +3141,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
>  		if (event_loop++ < TRBS_PER_SEGMENT / 2)
>  			continue;
>  		xhci_update_erst_dequeue(xhci, event_ring_deq);
> +		event_ring_deq = xhci->event_ring->dequeue;
> 
>  		/* ring is half-full, force isoc trbs to interrupt more often */
>  		if (xhci->isoc_bei_interval > AVOID_BEI_INTERVAL_MIN)
> -- 
> 2.7.4

What commit id does this change fix?

thanks,

greg k-h