Module Name: src
Committed By: riastradh
Date: Wed Feb 12 16:02:01 UTC 2020
Modified Files:
src/sys/arch/mips/adm5120/dev: ahci.c
src/sys/dev/usb: ehci.c ohci.c uhci.c vhci.c xhci.c
src/sys/external/bsd/dwc2: dwc2.c
Log Message:
Fix steady state of root intr xfers.
Why?
- Avoid completing a root intr xfer multiple times in races.
- Avoid potential use-after-free in poll_hub callouts (uhci, ahci).
How?
- Use sc->sc_intr_xfer or equivalent to store only a pending xfer
that has not yet completed -- whether successfully, by timeout, or
by synchronous abort. When any of those happens, set it to null
under the lock, so the xfer is completed only once.
- For hci drivers that use a callout to poll the root hub (uhci, ahci):
. Pass the softc pointer, not the xfer, to the callout, so the
callout is not even tempted to use xfer after free -- if the
callout fires, but the xfer is synchronously aborted before the
callout can do anything, the xfer might be freed by the time the
callout starts to examine it.
. Teach the callout to do nothing if it is callout_pending after it
has fired. This way:
1. completion or synchronous abort can just callout_stop
2. start can just callout_schedule
If the callout had already fired before (1), and doesn't acquire
the bus lock until after (2), it may be tempted to abort the new
root intr xfer just after submission, which would be wrong -- so
instead we just have the callout do nothing if it notices it has
been rescheduled, since it will fire again after the appropriate
time has elapsed.
To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 src/sys/arch/mips/adm5120/dev/ahci.c
cvs rdiff -u -r1.271 -r1.272 src/sys/dev/usb/ehci.c
cvs rdiff -u -r1.293 -r1.294 src/sys/dev/usb/ohci.c
cvs rdiff -u -r1.289 -r1.290 src/sys/dev/usb/uhci.c
cvs rdiff -u -r1.4 -r1.5 src/sys/dev/usb/vhci.c
cvs rdiff -u -r1.116 -r1.117 src/sys/dev/usb/xhci.c
cvs rdiff -u -r1.67 -r1.68 src/sys/external/bsd/dwc2/dwc2.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
