Re: list_del corruption (NULL pointer dereference) on xhci-pci unbind

["Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>]

[-- Attachment #1: Type: text/plain, Size: 1166 bytes --]

On Fri, Oct 14, 2022 at 07:02:13PM +0300, Mathias Nyman wrote:
> This whole software bandwidth issue should only be visible in Intel
> Panther Point PCH xHC (Ivy bridge)

It is indeed Ivy Bridge platform.

> Endpoints should be deleted from bw_table list, and xhci_virt_devices
> should be freed already before xhci_mem_cleanup() is called if all goes well.
> 
> Normally endpoints are deleted from bw_table list during usb_disconnect()
> 
> usb_disconnect()
>   ...
>   usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
>     hcd->driver->drop_endpoint()  // flags endpoint to be dropped
>     hcd->driver->check_bandwidth()
>     ->xhci_check_bandwidth()
>       xhci_configure_endpoint()
>         xhci_reserve_bandwidth()  // only for Panther Point
>           xhci_drop_ep_from_interval_table()
> 
> But to avoid queuing new commands to a host in XHCI_STATE_DYING or
> XHCI_STATE_REMOVING state we return early, not calling xhci_reserve_bandwidth().

Indeed when I remove that early return in xhci_check_bandwidth(), the
crash is gone. What's the proper solution?

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]