NetBSD Problem Report #26547

Received: (qmail 26554 invoked by uid 605); 4 Aug 2004 15:46:29 -0000
Message-Id: <20040804132220.A4AEC11153@narn.netbsd.org>
Date: Wed,  4 Aug 2004 13:22:20 +0000 (UTC)
From: dellis@conexant.com
Sender: gnats-bugs-owner@NetBSD.org
Reply-To: dellis@conexant.com
To: gnats-bugs@gnats.NetBSD.org
Subject: ohci can cancel timeouts before transfer have finished
X-Send-Pr-Version: www-1.0

>Number:         26547
>Category:       kern
>Synopsis:       ohci can free soft tds incorrectly during abort
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    skrll
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Aug 04 15:47:00 +0000 2004
>Closed-Date:    Sat Apr 23 13:30:24 +0000 2016
>Last-Modified:  Sat Apr 23 13:30:24 +0000 2016
>Originator:     Dan Ellis
>Release:        
>Organization:
Conexant Systems Inc.
>Environment:
>Description:
In usb/ohci.c, some devices fail to abort cleanly - transfers can be removed from the done queue resulting in a kernel panic.
>How-To-Repeat:
Plugging in mass storage devices such as a Canon 750Z Camera.
>Fix:
Transfers should only be removed if they haven't already completed (in usb/ohci.c):

@@ -2229,7 +2244,9 @@
 	for (; p->xfer == xfer; p = n) {
 		hit |= headp == p->physaddr;
 		n = p->nexttd;
-		ohci_free_std(sc, p);
+		if (OHCI_TD_GET_CC(le32toh(p->td.td_flags)) ==
+                    OHCI_CC_NOT_ACCESSED)
+                    ohci_free_std(sc, p);
 	}
 	/* Zap headp register if hardware pointed inside the xfer. */
 	if (hit) {

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: misc-bug-people->kern-bug-people
Responsible-Changed-By: jmc@netbsd.org
Responsible-Changed-When: Thu, 20 Jan 2005 07:49:26 +0000
Responsible-Changed-Why:
kernel issue


Responsible-Changed-From-To: kern-bug-people->skrll
Responsible-Changed-By: skrll@NetBSD.org
Responsible-Changed-When: Sun, 25 Aug 2013 07:13:53 +0000
Responsible-Changed-Why:
Take


State-Changed-From-To: open->feedback
State-Changed-By: skrll@NetBSD.org
State-Changed-When: Sat, 23 Apr 2016 13:26:29 +0000
State-Changed-Why:
Should be fixed in 7.99.28 (nick-nhusb merge). OK to close?


State-Changed-From-To: feedback->closed
State-Changed-By: skrll@NetBSD.org
State-Changed-When: Sat, 23 Apr 2016 13:30:24 +0000
State-Changed-Why:
email bounced


>Unformatted:

Home	PR Database Search