Re: list_del corruption (NULL pointer dereference) on xhci-pci unbind

Marek Marczykowski-Górecki
2022-10-14T20:30:16Z

[-- Attachment #1: Type: text/plain, Size: 1166 bytes --]

On Fri, Oct 14, 2022 at 07:02:13PM +0300, Mathias Nyman wrote:
> This whole software bandwidth issue should only be visible in Intel
> Panther Point PCH xHC (Ivy bridge)

It is indeed Ivy Bridge platform.

> Endpoints should be deleted from bw_table list, and xhci_virt_devices
> should be freed already before xhci_mem_cleanup() is called if all goes well.
>
> Normally endpoints are deleted from bw_table list during usb_disconnect()
>
> usb_disconnect()
> ...
> usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
> hcd->driver->drop_endpoint() // flags endpoint to be dropped
> hcd->driver->check_bandwidth()
> ->xhci_check_bandwidth()
> xhci_configure_endpoint()
> xhci_reserve_bandwidth() // only for Panther Point
> xhci_drop_ep_from_interval_table()
>
> But to avoid queuing new commands to a host in XHCI_STATE_DYING or
> XHCI_STATE_REMOVING state we return early, not calling xhci_reserve_bandwidth().

Indeed when I remove that early return in xhci_check_bandwidth(), the
crash is gone. What's the proper solution?