From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f67.google.com ([74.125.82.67]:32829 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751273AbcGLFuj (ORCPT ); Tue, 12 Jul 2016 01:50:39 -0400 Received: by mail-wm0-f67.google.com with SMTP id o80so959447wme.0 for ; Mon, 11 Jul 2016 22:50:38 -0700 (PDT) Received: from sauron (acdb144.neoplus.adsl.tpnet.pl. [83.9.151.144]) by smtp.gmail.com with ESMTPSA id e16sm3644675wma.12.2016.07.11.22.50.36 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 11 Jul 2016 22:50:37 -0700 (PDT) Date: Tue, 12 Jul 2016 07:50:34 +0200 From: =?UTF-8?B?TWljaGHFgg==?= Pecio To: stable@vger.kernel.org Subject: [PATCH] USB: OHCI: Don't mark EDs as ED_OPER if scheduling fails Message-ID: <20160712075034.3bdf91e2@sauron> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: commit c66f59ee5050447b3da92d36f5385a847990a894 upstream. Since ed_schedule begins with marking the ED as "operational", the ED may be left in such state even if scheduling actually fails. This allows future submission attempts to smuggle this ED to the hardware behind the scheduler's back and without linking it to the ohci->eds_in_use list. The former causes bandwidth saturation and data loss on isoc endpoints, the latter crashes the kernel when attempt is made to unlink such ED from this list. Fix ed_schedule to update ED state only on successful return. Signed-off-by: Michal Pecio --- Hi, This commit had been submitted to 4.7 without cc:stable because it wasn't decided at the time whether we want this fix in stable. It turned out we want it in 3.18 and later so I'm sending it here. Regards, MP drivers/usb/host/ohci-q.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c index d029bbe..641fed6 100644 --- a/drivers/usb/host/ohci-q.c +++ b/drivers/usb/host/ohci-q.c @@ -183,7 +183,6 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed) { int branch; - ed->state = ED_OPER; ed->ed_prev = NULL; ed->ed_next = NULL; ed->hwNextED = 0; @@ -259,6 +258,8 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed) /* the HC may not see the schedule updates yet, but if it does * then they'll be properly ordered. */ + + ed->state = ED_OPER; return 0; } -- 2.8.3