Suwan Kim 8bbc1a734e usbip: Fix error path of vhci_recv_ret_submit() ... commit aabb5b8338 upstream. If a transaction error happens in vhci_recv_ret_submit(), event handler closes connection and changes port status to kick hub_event. Then hub tries to flush the endpoint URBs, but that causes infinite loop between usb_hub_flush_endpoint() and vhci_urb_dequeue() because "vhci_priv" in vhci_urb_dequeue() was already released by vhci_recv_ret_submit() before a transmission error occurred. Thus, vhci_urb_dequeue() terminates early and usb_hub_flush_endpoint() continuously calls vhci_urb_dequeue(). The root cause of this issue is that vhci_recv_ret_submit() terminates early without giving back URB when transaction error occurs in vhci_recv_ret_submit(). That causes the error URB to still be linked at endpoint list without “vhci_priv". So, in the case of transaction error in vhci_recv_ret_submit(), unlink URB from the endpoint, insert proper error code in urb->status and give back URB. Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> Cc: stable <stable@vger.kernel.org> Acked-by: Shuah Khan <skhan@linuxfoundation.org> Link: https://lore.kernel.org/r/20191213023055.19933-3-suwan.kim027@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-12-31 16:46:05 +01:00
..
Kconfig	USBIP: add config dependency for SGL_ALLOC	2019-11-29 10:10:20 +01:00
Makefile	…
stub.h	…
stub_dev.c	…
stub_main.c	…
stub_rx.c	usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()	2019-11-29 10:10:22 +01:00
stub_tx.c	…
usbip_common.c	usbip: Fix receive error in vhci-hcd when using scatter-gather	2019-12-31 16:46:05 +01:00
usbip_common.h	…
usbip_event.c	…
vhci.h	…
vhci_hcd.c	…
vhci_rx.c	usbip: Fix error path of vhci_recv_ret_submit()	2019-12-31 16:46:05 +01:00
vhci_sysfs.c	…
vhci_tx.c	usbip: Fix free of unallocated memory in vhci tx	2019-10-28 17:51:06 +01:00
vudc.h	…
vudc_dev.c	…
vudc_main.c	…
vudc_rx.c	…
vudc_sysfs.c	…
vudc_transfer.c	…
vudc_tx.c	…