• Aleksander Morgado's avatar
    xhci: fix reporting of 0-sized URBs in control endpoint · 45ba2154
    Aleksander Morgado authored
    When a control transfer has a short data stage, the xHCI controller generates
    two transfer events: a COMP_SHORT_TX event that specifies the untransferred
    amount, and a COMP_SUCCESS event. But when the data stage is not short, only the
    COMP_SUCCESS event occurs. Therefore, xhci-hcd must set urb->actual_length to
    urb->transfer_buffer_length while processing the COMP_SUCCESS event, unless
    urb->actual_length was set already by a previous COMP_SHORT_TX event.
    
    The driver checks this by seeing whether urb->actual_length == 0, but this alone
    is the wrong test, as it is entirely possible for a short transfer to have an
    urb->actual_length = 0.
    
    This patch changes the xhci driver to rely on a new td->urb_length_set flag,
    which is set to true when a COMP_SHORT_TX event is received and the URB length
    updated at that stage.
    
    This fixes a bug which affected the HSO plugin, which relies on URBs with
    urb->actual_length == 0 to halt re-submitting the RX URB in the control
    endpoint.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAleksander Morgado <aleksander@aleksander.es>
    Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    45ba2154
xhci-ring.c 121 KB