linux-kernel - Re: xhci: WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ade0d77a-651a-4b03-bf21-00369fdc22f8@rowland.harvard.edu>
Date: Sat, 5 Apr 2025 22:40:51 -0400
From: Alan Stern <stern@...land.harvard.edu>
To: Michał Pecio <michal.pecio@...il.com>
Cc: Paul Menzel <pmenzel@...gen.mpg.de>,
	Mathias Nyman <mathias.nyman@...ux.intel.com>,
	Mathias Nyman <mathias.nyman@...el.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-usb@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>
Subject: Re: xhci: WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep
 state.

On Sun, Apr 06, 2025 at 12:23:11AM +0200, Michał Pecio wrote:
> Looks like some URB stalled and usb_storage reset the device without
> usb_clear_halt(). Then the core didn't usb_hcd_reset_endpoint() either.
> And apparently EP_STALLED is still set in xhci_hcd after all that time.
> 
> Then usb_storage submits one URB which never executes because the EP
> is in Running-Idle state and the doorbell is inhibited by EP_STALLED.
> 30s later it times out, unlinks the URB and resets again. Set TR Deq
> fails because the endpoint is Running.

> Not sure if it's a USB core bug or something that xHCI should take
> care of on its own. For now, reverting those two "stall" patches ought
> to clean up the noise.

The core believes that resetting a device should erase the endpoint 
information in the HCD.  There is a callback in hub_port_reset() to that 
effect:

		if (hcd->driver->reset_device)
			hcd->driver->reset_device(hcd, udev);

So after this the EP should not be in the Running-Idle state; in fact it 
should not exist at all (unless it is ep0, but in this case I think it 
isn't).

Is the implementation of the reset_device callback in xhci-hcd missing 
something?

Alan Stern