Messages in this thread Patch in this message | | | Date | Mon, 22 Nov 2004 23:26:18 -0800 | From | Pete Zaitcev <> | Subject | USB: ohci fix by Jes&Pete for Jessie |
| |
In usb-ohci of 2.4.28 it is possibe for del_urb called from a timer to access a thread stack under a stack pointer, when trying to wake the thread. On ia64 this causes an exception, which causes Jessie's Altix to collapse on reboot if a USB keyboard is not connected. It is obviously a bug everywhere, but for some reason it always worked dandy on i386.
In my opinion, the root cause is a misguided attempt to save memory by allocating pointers to waitqueue heads intstead of waitqueue heads themselves, so I solve the problem by allocating waitqueue heads.
This problem was analyzed and fixed by Jes Sorensen in a different way which wasn't radical enough for me, so this is a counter patch.
diff -urp -X dontdiff linux-2.4.28-bk3-ohci/drivers/usb/host/usb-ohci.c linux-2.4.28-rc1-usb/drivers/usb/host/usb-ohci.c --- linux-2.4.28-bk3-ohci/drivers/usb/host/usb-ohci.c 2004-04-14 17:33:16.000000000 -0700 +++ linux-2.4.28-rc1-usb/drivers/usb/host/usb-ohci.c 2004-11-16 15:15:44.000000000 -0800 @@ -677,7 +677,8 @@ static int sohci_submit_urb (struct urb return -ENOMEM; } memset (urb_priv, 0, sizeof (urb_priv_t) + size * sizeof (td_t *)); - + init_waitqueue_head (&urb_priv->wait); + /* fill the private part of the URB */ urb_priv->length = size; urb_priv->ed = ed; @@ -823,12 +824,10 @@ static int sohci_unlink_urb (struct urb urb_priv->ed->state |= ED_URB_DEL; if (!(urb->transfer_flags & USB_ASYNC_UNLINK)) { - DECLARE_WAIT_QUEUE_HEAD (unlink_wakeup); DECLARE_WAITQUEUE (wait, current); int timeout = OHCI_UNLINK_TIMEOUT; - add_wait_queue (&unlink_wakeup, &wait); - urb_priv->wait = &unlink_wakeup; + add_wait_queue(&urb_priv->wait, &wait); spin_unlock_irqrestore(&ohci->ohci_lock, flags); /* wait until all TDs are deleted */ @@ -838,7 +837,16 @@ static int sohci_unlink_urb (struct urb set_current_state(TASK_UNINTERRUPTIBLE); } set_current_state(TASK_RUNNING); - remove_wait_queue (&unlink_wakeup, &wait); + + /* + * A waitqueue head is self-locked, but we try + * to interlock with the dl_del_urb() which may + * be doing wake_up() right now, least + * urb->complete poisons over the urb->wait. + */ + spin_lock_irqsave(&ohci->ohci_lock, flags); + remove_wait_queue(&urb_priv->wait, &wait); + spin_unlock_irqrestore(&ohci->ohci_lock, flags); if (urb->status == USB_ST_URB_PENDING) { err ("unlink URB timeout"); return -ETIMEDOUT; @@ -943,18 +951,16 @@ static int sohci_free_dev (struct usb_de warn ("TD leak, %d", cnt); } else if (!in_interrupt ()) { - DECLARE_WAIT_QUEUE_HEAD (freedev_wakeup); DECLARE_WAITQUEUE (wait, current); int timeout = OHCI_UNLINK_TIMEOUT; /* SF interrupt handler calls dl_del_list */ - add_wait_queue (&freedev_wakeup, &wait); - dev->wait = &freedev_wakeup; + add_wait_queue (&dev->wait, &wait); set_current_state(TASK_UNINTERRUPTIBLE); while (timeout && dev->ed_cnt) timeout = schedule_timeout (timeout); set_current_state(TASK_RUNNING); - remove_wait_queue (&freedev_wakeup, &wait); + remove_wait_queue (&dev->wait, &wait); if (dev->ed_cnt) { err ("free device %d timeout", usb_dev->devnum); return -ETIMEDOUT; @@ -1560,7 +1566,7 @@ static void dl_transfer_length(td_t * td static void dl_del_urb (ohci_t *ohci, struct urb * urb) { - wait_queue_head_t * wait_head = ((urb_priv_t *)(urb->hcpriv))->wait; + urb_priv_t * urb_priv = urb->hcpriv; urb_rm_priv_locked (urb); @@ -1571,8 +1577,7 @@ static void dl_del_urb (ohci_t *ohci, st urb->status = -ENOENT; /* unblock sohci_unlink_urb */ - if (wait_head) - wake_up (wait_head); + wake_up(&urb_priv->wait); } } @@ -1664,13 +1669,8 @@ static void dl_del_list (ohci_t * ohci, ed->state = ED_NEW; hash_free_ed(ohci, ed); /* if all eds are removed wake up sohci_free_dev */ - if (!--dev->ed_cnt) { - wait_queue_head_t *wait_head = dev->wait; - - dev->wait = 0; - if (wait_head) - wake_up (wait_head); - } + if (!--dev->ed_cnt) + wake_up(&dev->wait); } else { ed->state &= ~ED_URB_DEL; tdHeadP = dma_to_td (ohci, le32_to_cpup (&ed->hwHeadP) & 0xfffffff0); diff -urp -X dontdiff linux-2.4.28-bk3-ohci/drivers/usb/host/usb-ohci.h linux-2.4.28-rc1-usb/drivers/usb/host/usb-ohci.h --- linux-2.4.28-bk3-ohci/drivers/usb/host/usb-ohci.h 2004-05-16 00:16:52.000000000 -0700 +++ linux-2.4.28-rc1-usb/drivers/usb/host/usb-ohci.h 2004-10-28 00:41:54.000000000 -0700 @@ -336,7 +336,7 @@ typedef struct __u16 length; // number of tds associated with this request __u16 td_cnt; // number of tds already serviced int state; - wait_queue_head_t * wait; + wait_queue_head_t wait; td_t * td[0]; // list pointer to all corresponding TDs associated with this request } urb_priv_t; @@ -417,7 +417,7 @@ struct ohci_device { ed_t ed[NUM_EDS]; dma_addr_t dma; int ed_cnt; - wait_queue_head_t * wait; + wait_queue_head_t wait; }; // #define ohci_to_usb(ohci) ((ohci)->usb) @@ -626,6 +626,7 @@ dev_alloc (struct ohci *hc, int mem_flag dev = pci_pool_alloc (hc->dev_cache, mem_flags, &dma); if (dev) { memset (dev, 0, sizeof (*dev)); + init_waitqueue_head (&dev->wait); dev->dma = dma; offset = ((char *)&dev->ed) - ((char *)dev); for (i = 0; i < NUM_EDS; i++, offset += sizeof dev->ed [0]) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |