Unverified Commit 4c131939 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9743 USB: core: Fix hang in usb_kill_urb by adding memory barriers 

Merge Pull Request from: @ci-robot 
 
PR sync from: Cheng Yu <serein.chengyu@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6D5RKCBLCDGNLTGPPIKDG5AAPP2CZKQC/ 
 
https://gitee.com/src-openeuler/kernel/issues/IA72HV 
 
Link:https://gitee.com/openeuler/kernel/pulls/9743

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 8ecd4eb5 b0855613

drivers/usb/core/hcd.c

+14 −0
Original line number Diff line number Diff line
@@ -1663,6 +1663,13 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags) 
		urb->hcpriv = NULL;

		INIT_LIST_HEAD(&urb->urb_list);

		atomic_dec(&urb->use_count);

		/*

		 * Order the write of urb->use_count above before the read

		 * of urb->reject below.  Pairs with the memory barriers in

		 * usb_kill_urb() and usb_poison_urb().

		 */

		smp_mb__after_atomic();



		atomic_dec(&urb->dev->urbnum);

		if (atomic_read(&urb->reject))

			wake_up(&usb_kill_urb_queue);
@@ -1772,6 +1779,13 @@ static void __usb_hcd_giveback_urb(struct urb *urb) 


	usb_anchor_resume_wakeups(anchor);

	atomic_dec(&urb->use_count);

	/*

	 * Order the write of urb->use_count above before the read

	 * of urb->reject below.  Pairs with the memory barriers in

	 * usb_kill_urb() and usb_poison_urb().

	 */

	smp_mb__after_atomic();



	if (unlikely(atomic_read(&urb->reject)))

		wake_up(&usb_kill_urb_queue);

	usb_put_urb(urb);

drivers/usb/core/urb.c

+12 −0
Original line number Diff line number Diff line
@@ -692,6 +692,12 @@ void usb_kill_urb(struct urb *urb) 
	if (!(urb && urb->dev && urb->ep))

		return;

	atomic_inc(&urb->reject);

	/*

	 * Order the write of urb->reject above before the read

	 * of urb->use_count below.  Pairs with the barriers in

	 * __usb_hcd_giveback_urb() and usb_hcd_submit_urb().

	 */

	smp_mb__after_atomic();



	usb_hcd_unlink_urb(urb, -ENOENT);

	wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0);
@@ -733,6 +739,12 @@ void usb_poison_urb(struct urb *urb) 
	if (!urb)

		return;

	atomic_inc(&urb->reject);

	/*

	 * Order the write of urb->reject above before the read

	 * of urb->use_count below.  Pairs with the barriers in

	 * __usb_hcd_giveback_urb() and usb_hcd_submit_urb().

	 */

	smp_mb__after_atomic();



	if (!urb->dev || !urb->ep)

		return;