[ 3.8.y.z extended stable ] Patch "xhci: Fix oops happening after address device timeout" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    xhci: Fix oops happening after address device timeout

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.11.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 1989c80d3a32a06d3e82469dd220e6d7b6ca155d Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman at linux.intel.com>
Date: Thu, 5 Sep 2013 11:01:20 +0300
Subject: xhci: Fix oops happening after address device timeout

commit 284d20552461466b04d6bfeafeb1c47a8891b591 upstream.

When a command times out, the command ring is first aborted,
and then stopped. If the command ring is empty when it is stopped
the stop event will point to next command which is not yet set.
xHCI tries to handle this next event often causing an oops.

Don't handle command completion events on stopped cmd ring if ring is
empty.

This patch should be backported to kernels as old as 3.7, that contain
the commit b92cc66c047ff7cf587b318fe377061a353c120f "xHCI: add aborting
command ring function"

Signed-off-by: Mathias Nyman <mathias.nyman at linux.intel.com>
Reported-by: Giovanni <giovanni.nervi at yahoo.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp at linux.intel.com>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/usb/host/xhci-ring.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 3020c71..04b212d 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1390,6 +1390,12 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
 			inc_deq(xhci, xhci->cmd_ring);
 			return;
 		}
+		/* There is no command to handle if we get a stop event when the
+		 * command ring is empty, event->cmd_trb points to the next
+		 * unset command
+		 */
+		if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
+			return;
 	}

 	switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
--
1.8.1.2