android_kernel_oneplus_msm8998/drivers/usb
AMAN DEEP 04dcdd0ed4 usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()
commit 46408ea558df13b110e0866b99624384a33bdeba upstream.

There is a race condition between finish_unlinks->finish_urb() function
and usb_kill_urb() in ohci controller case. The finish_urb calls
spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call,
then if during this time, usb_kill_urb is called for another endpoint,
then new ed will be added to ed_rm_list at beginning for unlink, and
ed_rm_list will point to newly added.

When finish_urb() is completed in finish_unlinks() and ed->td_list
becomes empty as in below code (in finish_unlinks() function):

        if (list_empty(&ed->td_list)) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
        } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
                ed_schedule(ohci, ed);
        }

The *last = ed->ed_next will make ed_rm_list to point to ed->ed_next
and previously added ed by usb_kill_urb will be left unreferenced by
ed_rm_list. This causes usb_kill_urb() hang forever waiting for
finish_unlink to remove added ed from ed_rm_list.

The main reason for hang in this race condtion is addition and removal
of ed from ed_rm_list in the beginning during usb_kill_urb and later
last* is modified in finish_unlinks().

As suggested by Alan Stern, the solution for proper handling of
ohci->ed_rm_list is to remove ed from the ed_rm_list before finishing
any URBs. Then at the end, we can add ed back to the list if necessary.

This properly handle the updated ohci->ed_rm_list in usb_kill_urb().

Fixes: 977dcfdc60 ("USB: OHCI: don't lose track of EDs when a controller dies")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Aman Deep <aman.deep@samsung.com>
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
..
atm
c67x00
chipidea usb: chipidea: vbus event may exist before starting gadget 2017-10-08 10:14:18 +02:00
class CDC-ACM: apply quirk for card reader 2018-02-03 17:04:30 +01:00
common usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices 2016-09-07 08:32:39 +02:00
core USB: Fix off by one in type-specific length check of BOS SSP capability 2018-01-02 20:33:27 +01:00
dwc2 usb: dwc2: fix regression on big-endian PowerPC/ARM systems 2016-07-27 09:47:28 -07:00
dwc3 usb: dwc3: replace %p with %pK 2017-07-15 11:57:45 +02:00
early
gadget usb: gadget: uvc: Missing files for configfs interface 2018-02-16 20:09:40 +01:00
host usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() 2018-02-28 10:17:22 +01:00
image
isp1760
misc usb: misc: usb3503: make sure reset is low for at least 100us 2018-01-17 09:35:31 +01:00
mon USB: fix usbmon BUG trigger 2018-01-17 09:35:31 +01:00
musb usb: musb/ux500: remove duplicate check for dma_is_compatible 2018-02-25 11:03:45 +01:00
phy usb: phy: msm add regulator dependency 2018-02-25 11:03:51 +01:00
renesas_usbhs usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet 2017-10-18 09:20:41 +02:00
serial USB: serial: simple: add Motorola Tetra driver 2018-02-03 17:04:30 +01:00
storage usb: uas: unconditionally bring back host after reset 2018-02-03 17:04:30 +01:00
usbip usbip: keep usbip_device sockfd state in sync with tcp_socket 2018-02-25 11:03:38 +01:00
wusbcore USB: wusbcore: fix NULL-deref at probe 2017-03-30 09:35:17 +02:00
Kconfig
Makefile usb-host: Remove fusbh200 driver 2015-10-16 23:44:33 -07:00
README
usb-skeleton.c

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.