From owner-cvs-all@FreeBSD.ORG Sat Mar 19 19:08:46 2005 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8749616A4CE; Sat, 19 Mar 2005 19:08:46 +0000 (GMT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 552B443D48; Sat, 19 Mar 2005 19:08:46 +0000 (GMT) (envelope-from iedowse@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id j2JJ8kDg032099; Sat, 19 Mar 2005 19:08:46 GMT (envelope-from iedowse@repoman.freebsd.org) Received: (from iedowse@localhost) by repoman.freebsd.org (8.13.1/8.13.1/Submit) id j2JJ8kA6032098; Sat, 19 Mar 2005 19:08:46 GMT (envelope-from iedowse) Message-Id: <200503191908.j2JJ8kA6032098@repoman.freebsd.org> From: Ian Dowse Date: Sat, 19 Mar 2005 19:08:46 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/dev/usb ehci.c ehcivar.h ohci.c ohcivar.h uhci.c uhcivar.h X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Mar 2005 19:08:46 -0000 iedowse 2005-03-19 19:08:46 UTC FreeBSD src repository Modified files: sys/dev/usb ehci.c ehcivar.h ohci.c ohcivar.h uhci.c uhcivar.h Log: It was possible to have two threads concurrently aborting the same transfer, which lead to panics or page faults. For example if a transfer timed out, another thread could come along and attempt to abort the same transfer while the timeout task was sleeping in the *_abort_xfer() function. Add an "aborting" flag to the private transfer state in each host controller driver and use this to ensure that the abort is only executed once. Also prioritise normal abort requests over timeouts so that the callback is always given a status of USB_CANCELLED even if the timeout-initiated abort began first. The crashes caused by this bug were mainly reported in connection with lpd printing to a USB printer. PR: usb/78208, usb/78986 Revision Changes Path 1.34 +26 -0 src/sys/dev/usb/ehci.c 1.9 +4 -0 src/sys/dev/usb/ehcivar.h 1.153 +28 -0 src/sys/dev/usb/ohci.c 1.40 +2 -0 src/sys/dev/usb/ohcivar.h 1.161 +28 -1 src/sys/dev/usb/uhci.c 1.40 +4 -0 src/sys/dev/usb/uhcivar.h