The branch stable/15 has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=f35cb87a56b0fb21dc19546135bd68315ce17714
commit f35cb87a56b0fb21dc19546135bd68315ce17714 Author: Baptiste Daroussin <[email protected]> AuthorDate: 2026-02-15 18:07:07 +0000 Commit: Baptiste Daroussin <[email protected]> CommitDate: 2026-03-02 12:49:22 +0000 libusb: dequeue next transfer on completion to prevent stalls The transfer proxy callbacks (bulk/interrupt, control, isochronous) only called libusb10_submit_transfer_sub() in the START path to pipeline the second kernel transfer slot. On completion or error, no attempt was made to dequeue the next pending transfer from tr_head onto the now-free slot. When more than two async transfers were submitted on the same endpoint, the third (and subsequent) transfers would remain stuck on tr_head indefinitely, since no completion ever triggered their submission. This caused a protocol-level deadlock in applications like adb that submit header + payload + zero-length terminator as three separate bulk transfers in sequence. Fix by calling libusb10_submit_transfer_sub() after every libusb10_complete_transfer() in all three proxy callbacks. MFC After: 2 weeks Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D55289 (cherry picked from commit 38c18332642500fdfe075a82f88e033f6673a53f) --- lib/libusb/libusb10.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/lib/libusb/libusb10.c b/lib/libusb/libusb10.c index e226def0b7b6..b3af017ab980 100644 --- a/lib/libusb/libusb10.c +++ b/lib/libusb/libusb10.c @@ -1259,6 +1259,9 @@ libusb10_isoc_proxy(struct libusb20_transfer *pxfer) libusb20_tr_get_length(pxfer, i); } libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED); + + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; case LIBUSB20_TRANSFER_START: /* setup length(s) */ @@ -1281,6 +1284,9 @@ libusb10_isoc_proxy(struct libusb20_transfer *pxfer) break; default: libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status)); + + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } } @@ -1322,11 +1328,15 @@ libusb10_bulk_intr_proxy(struct libusb20_transfer *pxfer) } else { libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED); } + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } /* check for end of data */ if (sxfer->rem_len == 0) { libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED); + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } /* FALLTHROUGH */ @@ -1353,6 +1363,8 @@ libusb10_bulk_intr_proxy(struct libusb20_transfer *pxfer) default: libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status)); + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } } @@ -1397,11 +1409,15 @@ libusb10_ctrl_proxy(struct libusb20_transfer *pxfer) } else { libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED); } + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } /* check for end of data */ if (sxfer->rem_len == 0) { libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED); + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } /* FALLTHROUGH */ @@ -1442,6 +1458,8 @@ libusb10_ctrl_proxy(struct libusb20_transfer *pxfer) default: libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status)); + /* start next queued transfer, if any */ + libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint); break; } }
