Re: xHCI corruption after double URB submit

[Alan Stern]

On Tue, 28 Jul 2015, Laura Abbott wrote:

> Hi,
> 
> While debugging an issue with another driver, I've hit some corruption in xHCI.
> I'm not sure if the corruption is directly caused by the first warning or if
> the warning is exposing an issue with the driver. The issue I was actually
> trying to debug was a URB double submit:
> 
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 3563 at drivers/usb/core/urb.c:339 usb_submit_urb+0x2ad/0x5a0()
> URB ffff8804078ac240 submitted while active

...

> I've found several issues where a double submit can happen so I mostly have
> a handle on that. Shortly after the double submit though, I see corruption:
> 
>   ------------[ cut here ]------------
>   WARNING: CPU: 3 PID: 0 at lib/list_debug.c:36 __list_add+0xb4/0xc0()
>   list_add double add: new=ffff8804078ac260, prev=ffff8804078ac260, next=ffff88040456c358.

> which will repeat itself until the kernel GPFs or crashes somewhere
> else. The test case for reproducing this is sending commands to the
> USB driver very rapidly so the double submit is happening fairly
> frequently. Is this a case where the driver is very questionable so
> all bets are off or is this an issue in the xHCI layer? I've never
> seen any other double submit reports indicating this type of corruption.

It's fair to say that once a double-submit error occurs, all bets are 
off.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/