Re: [v6] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

2018-03-27 Thread Alan Stern
On Mon, 26 Mar 2018, Jonathan Liu wrote: > > I am experiencing a USB function call hang from userspace with OCHI > > (full speed USB device) after updating from Linux 4.14.15 to 4.14.24 > > and noticed this commit. > > > > Here is the Linux 4.14.24 kernel stack trace (extracted from SysRq+w > > an

Re: [v6] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

2018-03-25 Thread Jonathan Liu
Hi, On 25 March 2018 at 12:21, Jonathan Liu wrote: > On 8 February 2018 at 14:55, Jeffy Chen wrote: >> From: AMAN DEEP >> >> There is a race condition between finish_unlinks->finish_urb() function >> and usb_kill_urb() in ohci controller case. The finish_urb calls >> spin_unlock(&ohci->lock) be

Re: [v6] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

2018-03-24 Thread Jonathan Liu
Hi, On 25 March 2018 at 12:21, Jonathan Liu wrote: > Hi, > > On 8 February 2018 at 14:55, Jeffy Chen wrote: >> From: AMAN DEEP >> >> There is a race condition between finish_unlinks->finish_urb() function >> and usb_kill_urb() in ohci controller case. The finish_urb calls >> spin_unlock(&ohci->

Re: [v6] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

2018-03-24 Thread Jonathan Liu
Hi, On 8 February 2018 at 14:55, Jeffy Chen wrote: > From: AMAN DEEP > > There is a race condition between finish_unlinks->finish_urb() function > and usb_kill_urb() in ohci controller case. The finish_urb calls > spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call, > then if du

[PATCH v6] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

2018-02-07 Thread Jeffy Chen
From: AMAN DEEP There is a race condition between finish_unlinks->finish_urb() function and usb_kill_urb() in ohci controller case. The finish_urb calls spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call, then if during this time, usb_kill_urb is called for another endpoint, the