Control: tag -1 upstream patch Control: forwarded -1 http://mid.gmane.org/1388978192.28110.27.camel@deadeye.wl.decadent.org.uk I think I understand why the log message was repeated so many times, and have submitted the attached patch upstream (forgetting to cc the bug address). I'll commit it if it's accepted upstream. Ben. -- Ben Hutchings Any smoothly functioning technology is indistinguishable from a rigged demo.
From: Ben Hutchings <ben@decadent.org.uk>
Date: Mon, 6 Jan 2014 03:04:46 +0000
Subject: xhci: Avoid infinite loop when sg urb requires too many trbs
Forwarded: http://mid.gmane.org/1388978192.28110.27.camel@deadeye.wl.decadent.org.uk
Currently prepare_ring() returns -ENOMEM if the urb won't fit into a
single ring segment. usb_sg_wait() treats this error as a temporary
condition and will keep retrying until something else goes wrong.
The number of retries should be limited in usb_sg_wait(), but also
prepare_ring() should not return an error code that suggests it might
be worth retrying. Change it to -EINVAL.
Reported-by: jidanni@jidanni.org
References: http://bugs.debian.org/733907
Fixes: 35773dac5f86 ('usb: xhci: Link TRB must not occur within a USB payload burst')
Cc: stable <stable@vger.kernel.org> # 3.12
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 53c2e29..64c36fe 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3008,7 +3008,7 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
if (num_trbs >= TRBS_PER_SEGMENT) {
xhci_err(xhci, "Too many fragments %d, max %d\n",
num_trbs, TRBS_PER_SEGMENT - 1);
- return -ENOMEM;
+ return -EINVAL;
}
nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
Attachment:
signature.asc
Description: This is a digitally signed message part