https://github.com/torvalds/linux
Revision c48400baa02155a5ddad63e8554602e48782278c authored by Bin Liu on 04 January 2017, 00:13:47 UTC, committed by Greg Kroah-Hartman on 05 January 2017, 18:18:05 UTC
During dma teardown for dequque urb, if musb load is high, musb might
generate bogus rx ep interrupt even when the rx fifo is flushed. In such
case any of the follow log messages could happen.

    musb_host_rx 1853: BOGUS RX2 ready, csr 0000, count 0

    musb_host_rx 1936: RX3 dma busy, csr 2020

As mentioned in the current inline comment, clearing ep interrupt in the
teardown path avoids the bogus interrupt, so implement clear_ep_rxintr()
callback.

This bug seems to be existing since the initial driver for musb support,
but I only validated the fix back to v4.1, so only cc stable for v4.1+.

cc: stable@vger.kernel.org # 4.1+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 6def85a
Raw File
Tip revision: c48400baa02155a5ddad63e8554602e48782278c authored by Bin Liu on 04 January 2017, 00:13:47 UTC
usb: musb: dsps: implement clear_ep_rxintr() callback
Tip revision: c48400b
list_debug.c
/*
 * Copyright 2006, Red Hat, Inc., Dave Jones
 * Released under the General Public License (GPL).
 *
 * This file contains the linked list validation for DEBUG_LIST.
 */

#include <linux/export.h>
#include <linux/list.h>
#include <linux/bug.h>
#include <linux/kernel.h>
#include <linux/rculist.h>

/*
 * Check that the data structures for the list manipulations are reasonably
 * valid. Failures here indicate memory corruption (and possibly an exploit
 * attempt).
 */

bool __list_add_valid(struct list_head *new, struct list_head *prev,
		      struct list_head *next)
{
	CHECK_DATA_CORRUPTION(next->prev != prev,
		"list_add corruption. next->prev should be prev (%p), but was %p. (next=%p).\n",
		prev, next->prev, next);
	CHECK_DATA_CORRUPTION(prev->next != next,
		"list_add corruption. prev->next should be next (%p), but was %p. (prev=%p).\n",
		next, prev->next, prev);
	CHECK_DATA_CORRUPTION(new == prev || new == next,
		"list_add double add: new=%p, prev=%p, next=%p.\n",
		new, prev, next);

	return true;
}
EXPORT_SYMBOL(__list_add_valid);

bool __list_del_entry_valid(struct list_head *entry)
{
	struct list_head *prev, *next;

	prev = entry->prev;
	next = entry->next;

	CHECK_DATA_CORRUPTION(next == LIST_POISON1,
		"list_del corruption, %p->next is LIST_POISON1 (%p)\n",
		entry, LIST_POISON1);
	CHECK_DATA_CORRUPTION(prev == LIST_POISON2,
		"list_del corruption, %p->prev is LIST_POISON2 (%p)\n",
		entry, LIST_POISON2);
	CHECK_DATA_CORRUPTION(prev->next != entry,
		"list_del corruption. prev->next should be %p, but was %p\n",
		entry, prev->next);
	CHECK_DATA_CORRUPTION(next->prev != entry,
		"list_del corruption. next->prev should be %p, but was %p\n",
		entry, next->prev);
	return true;

}
EXPORT_SYMBOL(__list_del_entry_valid);
back to top