From eafb4c30fd7b945de43aff104e34b4c8487d1142 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 2 Jan 2016 03:08:04 +0000 Subject: [PATCH] Revert "xhci: don't finish a TD if we get a short transfer event mid TD" Closes: #808602, #808953, regression in 4.3-rc7 --- debian/changelog | 2 + ...nish-a-td-if-we-get-a-short-transfer.patch | 37 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 40 insertions(+) create mode 100644 debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch diff --git a/debian/changelog b/debian/changelog index d55dff2f2..d7bce7a93 100644 --- a/debian/changelog +++ b/debian/changelog @@ -17,6 +17,8 @@ linux (4.3.3-3) UNRELEASED; urgency=medium * [x86] drm/i915: Don't compare has_drrs strictly in pipe config (Closes: #808720) * [armhf] crypto: sun4i-ss - add missing statesize (Closes: #808625) + * Revert "xhci: don't finish a TD if we get a short transfer event mid TD" + (Closes: #808602, #808953, regression in 4.3-rc7) [ Salvatore Bonaccorso ] * ovl: fix permission checking for setattr (CVE-2015-8660) diff --git a/debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch b/debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch new file mode 100644 index 000000000..7d7946064 --- /dev/null +++ b/debian/patches/bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch @@ -0,0 +1,37 @@ +From: Ben Hutchings +Date: Sat, 02 Jan 2016 03:03:27 +0000 +Subject: Revert "xhci: don't finish a TD if we get a short transfer event mid TD" +Bug-Debian: https://bugs.debian.org/808602 +Bug-Debian: https://bugs.debian.org/808953 + +This reverts commit dbd81f75b991c972970764ba75287cbbc8f066be, which +was commit e210c422b6fdd2dc123bedc588f399aefd8bf9de upstream. It +caused serious regressions as referenced above. + +--- +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2191,10 +2191,6 @@ static int process_bulk_intr_td(struct x + } + /* Fast path - was this the last TRB in the TD for this URB? */ + } else if (event_trb == td->last_trb) { +- if (td->urb_length_set && trb_comp_code == COMP_SHORT_TX) +- return finish_td(xhci, td, event_trb, event, ep, +- status, false); +- + if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) { + td->urb->actual_length = + td->urb->transfer_buffer_length - +@@ -2246,12 +2242,6 @@ static int process_bulk_intr_td(struct x + td->urb->actual_length += + TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) - + EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)); +- +- if (trb_comp_code == COMP_SHORT_TX) { +- xhci_dbg(xhci, "mid bulk/intr SP, wait for last TRB event\n"); +- td->urb_length_set = true; +- return 0; +- } + } + + return finish_td(xhci, td, event_trb, event, ep, status, false); diff --git a/debian/patches/series b/debian/patches/series index 8d55435e0..e041bdea3 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -131,3 +131,4 @@ bugfix/x86/KVM-x86-Reload-pit-counters-for-all-channels-when-re.patch bugfix/all/drm-nouveau-pmu-do-not-assume-a-pmu-is-present.patch bugfix/x86/drm-i915-don-t-compare-has_drrs-strictly-in-pipe-con.patch bugfix/arm/crypto-sun4i-ss-add-missing-statesize.patch +bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch