From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Elric Fu <elricfu1@gmail.com>,
Sarah Sharp <sarah.a.sharp@linux.intel.com>,
Miroslav Sabljic <miroslav.sabljic@avl.com>
Subject: [ 33/58] xHCI: cancel command after command timeout
Date: Thu, 4 Oct 2012 14:19:40 -0700 [thread overview]
Message-ID: <20121004210639.593175634@linuxfoundation.org> (raw)
In-Reply-To: <20121004210635.449598766@linuxfoundation.org>
3.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elric Fu <elricfu1@gmail.com>
commit 6e4468b9a0793dfb53eb80d9fe52c739b13b27fd upstream.
The patch is used to cancel command when the command isn't
acknowledged and a timeout occurs.
This patch should be backported to kernels as old as 3.0, that contain
the commit 7ed603ecf8b68ab81f4c83097d3063d43ec73bb8 "xhci: Add an
assertion to check for virt_dev=0 bug." That commit papers over a NULL
pointer dereference, and this patch fixes the underlying issue that
caused the NULL pointer dereference.
Signed-off-by: Elric Fu <elricfu1@gmail.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: Miroslav Sabljic <miroslav.sabljic@avl.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 26 +++++++++++++++++++-------
drivers/usb/host/xhci.h | 3 +++
2 files changed, 22 insertions(+), 7 deletions(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2525,6 +2525,7 @@ static int xhci_configure_endpoint(struc
struct completion *cmd_completion;
u32 *cmd_status;
struct xhci_virt_device *virt_dev;
+ union xhci_trb *cmd_trb;
spin_lock_irqsave(&xhci->lock, flags);
virt_dev = xhci->devs[udev->slot_id];
@@ -2570,6 +2571,7 @@ static int xhci_configure_endpoint(struc
}
init_completion(cmd_completion);
+ cmd_trb = xhci->cmd_ring->dequeue;
if (!ctx_change)
ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
udev->slot_id, must_succeed);
@@ -2591,14 +2593,17 @@ static int xhci_configure_endpoint(struc
/* Wait for the configure endpoint command to complete */
timeleft = wait_for_completion_interruptible_timeout(
cmd_completion,
- USB_CTRL_SET_TIMEOUT);
+ XHCI_CMD_DEFAULT_TIMEOUT);
if (timeleft <= 0) {
xhci_warn(xhci, "%s while waiting for %s command\n",
timeleft == 0 ? "Timeout" : "Signal",
ctx_change == 0 ?
"configure endpoint" :
"evaluate context");
- /* FIXME cancel the configure endpoint command */
+ /* cancel the configure endpoint command */
+ ret = xhci_cancel_cmd(xhci, command, cmd_trb);
+ if (ret < 0)
+ return ret;
return -ETIME;
}
@@ -3547,8 +3552,10 @@ int xhci_alloc_dev(struct usb_hcd *hcd,
unsigned long flags;
int timeleft;
int ret;
+ union xhci_trb *cmd_trb;
spin_lock_irqsave(&xhci->lock, flags);
+ cmd_trb = xhci->cmd_ring->dequeue;
ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);
if (ret) {
spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3560,12 +3567,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd,
/* XXX: how much time for xHC slot assignment? */
timeleft = wait_for_completion_interruptible_timeout(&xhci->addr_dev,
- USB_CTRL_SET_TIMEOUT);
+ XHCI_CMD_DEFAULT_TIMEOUT);
if (timeleft <= 0) {
xhci_warn(xhci, "%s while waiting for a slot\n",
timeleft == 0 ? "Timeout" : "Signal");
- /* FIXME cancel the enable slot request */
- return 0;
+ /* cancel the enable slot request */
+ return xhci_cancel_cmd(xhci, NULL, cmd_trb);
}
if (!xhci->slot_id) {
@@ -3626,6 +3633,7 @@ int xhci_address_device(struct usb_hcd *
struct xhci_slot_ctx *slot_ctx;
struct xhci_input_control_ctx *ctrl_ctx;
u64 temp_64;
+ union xhci_trb *cmd_trb;
if (!udev->slot_id) {
xhci_dbg(xhci, "Bad Slot ID %d\n", udev->slot_id);
@@ -3664,6 +3672,7 @@ int xhci_address_device(struct usb_hcd *
xhci_dbg_ctx(xhci, virt_dev->in_ctx, 2);
spin_lock_irqsave(&xhci->lock, flags);
+ cmd_trb = xhci->cmd_ring->dequeue;
ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
udev->slot_id);
if (ret) {
@@ -3676,7 +3685,7 @@ int xhci_address_device(struct usb_hcd *
/* ctrl tx can take up to 5 sec; XXX: need more time for xHC? */
timeleft = wait_for_completion_interruptible_timeout(&xhci->addr_dev,
- USB_CTRL_SET_TIMEOUT);
+ XHCI_CMD_DEFAULT_TIMEOUT);
/* FIXME: From section 4.3.4: "Software shall be responsible for timing
* the SetAddress() "recovery interval" required by USB and aborting the
* command on a timeout.
@@ -3684,7 +3693,10 @@ int xhci_address_device(struct usb_hcd *
if (timeleft <= 0) {
xhci_warn(xhci, "%s while waiting for address device command\n",
timeleft == 0 ? "Timeout" : "Signal");
- /* FIXME cancel the address device command */
+ /* cancel the address device command */
+ ret = xhci_cancel_cmd(xhci, NULL, cmd_trb);
+ if (ret < 0)
+ return ret;
return -ETIME;
}
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1256,6 +1256,9 @@ struct xhci_td {
union xhci_trb *last_trb;
};
+/* xHCI command default timeout value */
+#define XHCI_CMD_DEFAULT_TIMEOUT (5 * HZ)
+
/* command descriptor */
struct xhci_cd {
struct list_head cancel_cmd_list;
next prev parent reply other threads:[~2012-10-04 21:21 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-04 21:19 [ 00/58] 3.5.6-stable review Greg Kroah-Hartman
2012-10-04 21:19 ` [ 01/58] vfs: dcache: fix deadlock in tree traversal Greg Kroah-Hartman
2012-10-04 21:19 ` [ 02/58] dm mpath: only retry ioctl when no paths if queue_if_no_path set Greg Kroah-Hartman
2012-10-04 21:19 ` [ 03/58] dm: handle requests beyond end of device instead of using BUG_ON Greg Kroah-Hartman
2012-10-04 21:19 ` [ 04/58] dm table: clear add_random unless all devices have it set Greg Kroah-Hartman
2012-10-04 21:19 ` [ 05/58] dm verity: fix overflow check Greg Kroah-Hartman
2012-10-04 21:19 ` [ 06/58] usb: gadget: make g_printer enumerate again Greg Kroah-Hartman
2012-10-04 21:19 ` [ 07/58] usb: gadget: initialize the strings in tcm_usb_gadget properly Greg Kroah-Hartman
2012-10-04 21:19 ` [ 08/58] USB: option: blacklist QMI interface on ZTE MF683 Greg Kroah-Hartman
2012-10-04 21:19 ` [ 09/58] USB: ftdi_sio: add TIAO USB Multi-Protocol Adapter (TUMPA) support Greg Kroah-Hartman
2012-10-04 21:19 ` [ 10/58] USB: qcaux: add Pantech vendor class match Greg Kroah-Hartman
2012-10-04 21:19 ` [ 11/58] usb: host: xhci: Fix Null pointer dereferencing with 71c731a for non-x86 systems Greg Kroah-Hartman
2012-10-04 21:19 ` [ 12/58] USB: serial: fix up bug with missing {} Greg Kroah-Hartman
2012-10-04 21:19 ` [ 13/58] staging: speakup_soft: Fix reading of init string Greg Kroah-Hartman
2012-10-04 21:19 ` [ 14/58] tty: keyboard.c: Remove locking from vt_get_leds Greg Kroah-Hartman
2012-10-04 21:19 ` [ 15/58] staging: r8712u: Do not queue cloned skb Greg Kroah-Hartman
2012-10-04 21:19 ` [ 16/58] staging: comedi: s626: dont dereference insn->data Greg Kroah-Hartman
2012-10-04 21:19 ` [ 17/58] staging: comedi: jr3_pci: fix iomem dereference Greg Kroah-Hartman
2012-10-04 21:19 ` [ 18/58] staging: comedi: dont dereference user memory for INSN_INTTRIG Greg Kroah-Hartman
2012-10-04 21:19 ` [ 19/58] staging: comedi: fix memory leak for saved channel list Greg Kroah-Hartman
2012-10-04 21:19 ` [ 20/58] Remove BUG_ON from n_tty_read() Greg Kroah-Hartman
2012-10-04 21:19 ` [ 21/58] TTY: ttyprintk, dont touch behind tty->write_buf Greg Kroah-Hartman
2012-10-04 21:19 ` [ 22/58] serial: omap: fix software flow control Greg Kroah-Hartman
2012-10-04 21:19 ` [ 23/58] serial: pl011: handle corruption at high clock speeds Greg Kroah-Hartman
2012-10-04 21:19 ` [ 24/58] serial: set correct baud_base for EXSYS EX-41092 Dual 16950 Greg Kroah-Hartman
2012-10-04 21:19 ` [ 25/58] tools/hv: Fix file handle leak Greg Kroah-Hartman
2012-10-04 21:19 ` [ 26/58] tools/hv: Fix exit() error code Greg Kroah-Hartman
2012-10-04 21:19 ` [ 27/58] tools/hv: Check for read/write errors Greg Kroah-Hartman
2012-10-04 21:19 ` [ 28/58] b43legacy: Fix crash on unload when firmware not available Greg Kroah-Hartman
2012-10-04 21:19 ` [ 29/58] firmware: Add missing attributes to EFI variable attribute print out from sysfs Greg Kroah-Hartman
2012-10-04 21:19 ` [ 30/58] xhci: Intel Panther Point BEI quirk Greg Kroah-Hartman
2012-10-04 21:19 ` [ 31/58] xHCI: add cmd_ring_state Greg Kroah-Hartman
2012-10-04 21:19 ` [ 32/58] xHCI: add aborting command ring function Greg Kroah-Hartman
2012-10-04 21:19 ` Greg Kroah-Hartman [this message]
2012-10-04 21:19 ` [ 34/58] xHCI: handle command after aborting the command ring Greg Kroah-Hartman
2012-10-04 21:19 ` [ 35/58] Increase XHCI suspend timeout to 16ms Greg Kroah-Hartman
2012-10-04 21:19 ` [ 36/58] HID: keep dev_rdesc unmodified and use it for comparisons Greg Kroah-Hartman
2012-10-04 21:19 ` [ 37/58] ath9k: Disable ASPM only for AR9285 Greg Kroah-Hartman
2012-10-04 21:19 ` [ 38/58] xen/pciback: Restore the PCI config space after an FLR Greg Kroah-Hartman
2012-10-04 21:19 ` [ 39/58] coredump: prevent double-free on an error path in core dumper Greg Kroah-Hartman
2012-10-04 21:19 ` [ 40/58] n_gsm.c: Implement 3GPP27.010 DLC start-up procedure in MUX Greg Kroah-Hartman
2012-10-04 21:19 ` [ 41/58] n_gsm: uplink SKBs accumulate on list Greg Kroah-Hartman
2012-10-04 21:19 ` [ 42/58] n_gsm: added interlocking for gsm_data_lock for certain code paths Greg Kroah-Hartman
2012-10-04 21:19 ` [ 43/58] n_gsm: memory leak in uplink error path Greg Kroah-Hartman
2012-10-04 21:19 ` [ 44/58] UBI: fix autoresize handling in R/O mode Greg Kroah-Hartman
2012-10-04 21:19 ` [ 45/58] UBI: erase free PEB with bitflip in EC header Greg Kroah-Hartman
2012-10-04 21:19 ` [ 46/58] Yama: handle 32-bit userspace prctl Greg Kroah-Hartman
2012-10-04 21:19 ` [ 47/58] SCSI: ibmvscsi: Fix host config length field overflow Greg Kroah-Hartman
2012-10-04 21:19 ` [ 48/58] SCSI: hpsa: Use LUN reset instead of target reset Greg Kroah-Hartman
2012-10-04 21:19 ` [ 49/58] can: mscan-mpc5xxx: fix return value check in mpc512x_can_get_clock() Greg Kroah-Hartman
2012-10-04 21:19 ` [ 50/58] remoteproc: select VIRTIO to avoid build breakage Greg Kroah-Hartman
2012-10-04 21:19 ` [ 51/58] remoteproc: fix a potential NULL-dereference on cleanup Greg Kroah-Hartman
2012-10-04 21:19 ` [ 52/58] IPoIB: Fix use-after-free of multicast object Greg Kroah-Hartman
2012-10-04 21:20 ` [ 53/58] IB/srp: Fix use-after-free in srp_reset_req() Greg Kroah-Hartman
2012-10-04 21:20 ` [ 54/58] IB/srp: Avoid having aborted requests hang Greg Kroah-Hartman
2012-10-04 21:20 ` [ 55/58] isci: fix isci_pci_probe() generates warning on efi failure path Greg Kroah-Hartman
2012-10-04 21:20 ` [ 56/58] x86/alternatives: Fix p6 nops on non-modular kernels Greg Kroah-Hartman
2012-10-04 21:20 ` [ 57/58] SCSI: scsi_remove_target: fix softlockup regression on hot remove Greg Kroah-Hartman
2012-10-04 21:20 ` [ 58/58] SCSI: scsi_dh_alua: Enable STPG for unavailable ports Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121004210639.593175634@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=elricfu1@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=miroslav.sabljic@avl.com \
--cc=sarah.a.sharp@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).