Re: xHCI corruption after double URB submit

Alan Stern
2015-07-29T14:15:14Z

On Tue, 28 Jul 2015, Laura Abbott wrote:

> Hi,
>
> While debugging an issue with another driver, I've hit some corruption in xHCI.
> I'm not sure if the corruption is directly caused by the first warning or if
> the warning is exposing an issue with the driver. The issue I was actually
> trying to debug was a URB double submit:
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 3563 at drivers/usb/core/urb.c:339 usb_submit_urb+0x2ad/0x5a0()
> URB ffff8804078ac240 submitted while active

...

> I've found several issues where a double submit can happen so I mostly have
> a handle on that. Shortly after the double submit though, I see corruption:
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 0 at lib/list_debug.c:36 __list_add+0xb4/0xc0()
> list_add double add: new=ffff8804078ac260, prev=ffff8804078ac260, next=ffff88040456c358.

> which will repeat itself until the kernel GPFs or crashes somewhere
> else. The test case for reproducing this is sending commands to the
> USB driver very rapidly so the double submit is happening fairly
> frequently. Is this a case where the driver is very questionable so
> all bets are off or is this an issue in the xHCI layer? I've never
> seen any other double submit reports indicating this type of corruption.

It's fair to say that once a double-submit error occurs, all bets are
off.

Alan Stern