android_kernel_oneplus_msm8998/drivers
AMAN DEEP 04dcdd0ed4 usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()
commit 46408ea558df13b110e0866b99624384a33bdeba upstream.

There is a race condition between finish_unlinks->finish_urb() function
and usb_kill_urb() in ohci controller case. The finish_urb calls
spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call,
then if during this time, usb_kill_urb is called for another endpoint,
then new ed will be added to ed_rm_list at beginning for unlink, and
ed_rm_list will point to newly added.

When finish_urb() is completed in finish_unlinks() and ed->td_list
becomes empty as in below code (in finish_unlinks() function):

        if (list_empty(&ed->td_list)) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
        } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
                ed_schedule(ohci, ed);
        }

The *last = ed->ed_next will make ed_rm_list to point to ed->ed_next
and previously added ed by usb_kill_urb will be left unreferenced by
ed_rm_list. This causes usb_kill_urb() hang forever waiting for
finish_unlink to remove added ed from ed_rm_list.

The main reason for hang in this race condtion is addition and removal
of ed from ed_rm_list in the beginning during usb_kill_urb and later
last* is modified in finish_unlinks().

As suggested by Alan Stern, the solution for proper handling of
ohci->ed_rm_list is to remove ed from the ed_rm_list before finishing
any URBs. Then at the end, we can add ed back to the list if necessary.

This properly handle the updated ohci->ed_rm_list in usb_kill_urb().

Fixes: 977dcfdc60 ("USB: OHCI: don't lose track of EDs when a controller dies")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Aman Deep <aman.deep@samsung.com>
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
..
accessibility
acpi ACPI: sbshc: remove raw pointer from printk() message 2018-02-16 20:09:47 +01:00
amba
android binder: check for binder_thread allocation failure in binder_poll() 2018-02-25 11:03:38 +01:00
ata ahci: Add Intel Cannon Lake PCH-H PCI ID 2018-02-16 20:09:42 +01:00
atm atm: horizon: Fix irq release error 2017-12-16 10:33:55 +01:00
auxdisplay
base drivers: base: cacheinfo: fix boot error message when acpi is enabled 2018-01-31 12:06:08 +01:00
bcma
block pktcdvd: Fix pkt_setup_dev() error path 2018-02-16 20:09:47 +01:00
bluetooth Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version 2018-02-16 20:09:46 +01:00
bus sunxi-rsb: Include OF based modalias in device uevent 2018-01-10 09:27:09 +01:00
cdrom
char hwrng: exynos - use __maybe_unused to hide pm functions 2018-02-25 11:03:47 +01:00
clk clk: tegra: Fix cclk_lp divisor register 2017-12-20 10:04:59 +01:00
clocksource clockevents/drivers/cs5535: Improve resilience to spurious interrupts 2017-10-27 10:23:17 +02:00
connector
cpufreq cpufreq: Add Loongson machine dependencies 2018-02-03 17:04:27 +01:00
cpuidle cpuidle: fix broadcast control when broadcast can not be entered 2017-12-25 14:22:15 +01:00
crypto crypto: s5p-sss - Fix kernel Oops in AES-ECB mode 2018-02-25 11:03:55 +01:00
dca
devfreq PM / devfreq: Propagate error from devfreq_add_device() 2018-02-22 15:44:58 +01:00
dio
dma dmaengine: zx: fix build warning 2018-02-25 11:03:50 +01:00
dma-buf
edac EDAC, octeon: Fix an uninitialized variable warning 2018-02-16 20:09:47 +01:00
eisa
extcon extcon: palmas: Check the parent instance to prevent the NULL 2017-11-21 09:21:18 +01:00
firewire
firmware efi/esrt: Cleanup bad memory map log messages 2017-12-20 10:04:56 +01:00
fmc
fpga
gpio gpio: xgene: mark PM functions as __maybe_unused 2018-02-25 11:03:50 +01:00
gpu drm/gma500: remove helper function 2018-02-25 11:03:52 +01:00
hid HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working 2018-02-16 20:09:46 +01:00
hsi
hv Drivers: hv: vmbus: fix build warning 2018-02-25 11:03:46 +01:00
hwmon hwmon: (pmbus) Use 64bit math for DIRECT format values 2018-02-03 17:04:28 +01:00
hwspinlock
hwtracing intel_th: pci: Add Gemini Lake support 2017-12-20 10:04:54 +01:00
i2c i2c: remove __init from i2c_register_board_info() 2018-02-25 11:03:48 +01:00
ide
idle idle: i7300: add PCI dependency 2018-02-25 11:03:51 +01:00
iio iio: adis_lib: Initialize trigger before requesting interrupt 2018-02-28 10:17:22 +01:00
infiniband infiniband: cxgb4: use %pR format string for printing resources 2018-02-25 11:03:48 +01:00
input Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning 2018-02-25 11:03:49 +01:00
iommu iommu/arm-smmu-v3: Don't free page table ops twice 2018-01-17 09:35:25 +01:00
ipack
irqchip irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() 2018-02-28 10:17:22 +01:00
isdn isdn: sc: work around type mismatch warning 2018-02-25 11:03:51 +01:00
leds leds: ktd2692: avoid harmless maybe-uninitialized warning 2017-05-14 13:32:55 +02:00
lguest
lightnvm
macintosh
mailbox mailbox: handle empty message in tx_tick 2017-08-06 19:19:41 -07:00
mcb
md md: avoid warning for 32-bit sector_t 2018-02-25 11:03:44 +01:00
media v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER 2018-02-25 11:03:50 +01:00
memory ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure 2017-12-16 10:33:51 +01:00
memstick
message mptfusion: hide unused seq_mpt_print_ioc_summary function 2018-02-25 11:03:45 +01:00
mfd mfd: twl6040: Fix child-node lookup 2018-01-02 20:33:20 +01:00
misc cxl: Check if vphb exists before iterating over AFU devices 2017-12-25 14:22:08 +01:00
mmc mmc: sdhci-of-esdhc: add/remove some quirks according to vendor version 2018-01-31 12:06:09 +01:00
mtd mtd: cfi: enforce valid geometry configuration 2018-02-25 11:03:46 +01:00
net net: hp100: remove unnecessary #ifdefs 2018-02-25 11:03:50 +01:00
nfc nfc: fdp: fix NULL pointer dereference 2017-08-06 19:19:40 -07:00
ntb ntb_transport: fix bug calculating num_qps_mw 2017-08-30 10:19:29 +02:00
nubus
nvdimm libnvdimm, namespace: make 'resource' attribute only readable by root 2017-11-30 08:37:23 +00:00
nvme nvme: Fix managing degraded controllers 2018-02-16 20:09:47 +01:00
nvmem nvmem: imx-ocotp: Fix wrong register size 2017-08-06 19:19:46 -07:00
of of: device: Export of_device_{get_modalias, uvent_modalias} to modules 2017-07-27 15:06:09 -07:00
oprofile
parisc parisc: Hide Diva-built-in serial aux and graphics card 2018-01-02 20:33:20 +01:00
parport parisc, parport_gsc: Fixes for printk continuation lines 2017-06-17 06:39:37 +02:00
pci PCI: keystone: Fix interrupt-controller-node lookup 2018-02-28 10:17:21 +01:00
pcmcia
perf
phy phy: work around 'phys' references to usb-nop-xceiv devices 2018-01-23 19:50:16 +01:00
pinctrl pinctrl: sunxi: Fix A80 interrupt pin bank 2018-02-25 11:03:39 +01:00
platform dell-wmi, dell-laptop: depends DMI 2018-02-25 11:03:51 +01:00
pnp
power power: bq27xxx_battery: mark some symbols __maybe_unused 2018-02-25 11:03:50 +01:00
powercap
pps
ps3
ptp
pwm
rapidio
ras
regulator regulator: fan53555: fix I2C device ids 2017-11-02 09:40:50 +01:00
remoteproc
reset
rpmsg
rtc rtc-opal: Fix handling of firmware error codes, prevent busy loops 2018-02-22 15:44:59 +01:00
s390 s390/dasd: prevent prefix I/O error 2018-02-25 11:03:40 +01:00
sbus
scsi scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info 2018-02-28 10:17:22 +01:00
sfi
sh
sn
soc
spi spi: sun4i: disable clocks in the remove function 2018-02-25 11:03:41 +01:00
spmi spmi: Include OF based modalias in device uevent 2017-07-27 15:06:10 -07:00
ssb ssb: mark ssb_bus_register as __maybe_unused 2018-02-25 11:03:44 +01:00
staging staging: unisys: visorinput depends on INPUT 2018-02-25 11:03:48 +01:00
target target/user: Fix cast from pointer to phys_addr_t 2018-02-25 11:03:46 +01:00
tc
thermal thermal: spear: use __maybe_unused for PM functions 2018-02-25 11:03:44 +01:00
thunderbolt
tty serial: 8250_mid: fix broken DMA dependency 2018-02-25 11:03:49 +01:00
uio
usb usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() 2018-02-28 10:17:22 +01:00
uwb uwb: ensure that endpoint is interrupt 2017-10-12 11:27:35 +02:00
vfio vfio-pci: Handle error from pci_iomap 2017-08-06 19:19:46 -07:00
vhost vhost_net: stop device during reset owner 2018-02-16 20:09:38 +01:00
video fbdev: sm712fb: avoid unused function warnings 2018-02-25 11:03:47 +01:00
virt
virtio virtio_balloon: prevent uninitialized variable use 2018-02-25 11:03:42 +01:00
vlynq
vme
w1
watchdog watchdog: imx2_wdt: restore previous timeout after suspend+resume 2018-02-16 20:09:45 +01:00
xen xen: XEN_ACPI_PROCESSOR is Dom0-only 2018-02-25 11:03:41 +01:00
zorro
Kconfig
Makefile usb: build drivers/usb/common/ when USB_SUPPORT is set 2018-02-25 11:03:38 +01:00