CVS commit: src/sys

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    src
Committed By:   riastradh
Date:           Wed Feb 12 16:02:01 UTC 2020

Modified Files:
        src/sys/arch/mips/adm5120/dev: ahci.c
        src/sys/dev/usb: ehci.c ohci.c uhci.c vhci.c xhci.c
        src/sys/external/bsd/dwc2: dwc2.c

Log Message:
Fix steady state of root intr xfers.

Why?

- Avoid completing a root intr xfer multiple times in races.
- Avoid potential use-after-free in poll_hub callouts (uhci, ahci).

How?

- Use sc->sc_intr_xfer or equivalent to store only a pending xfer
  that has not yet completed -- whether successfully, by timeout, or
  by synchronous abort.  When any of those happens, set it to null
  under the lock, so the xfer is completed only once.

- For hci drivers that use a callout to poll the root hub (uhci, ahci):

  . Pass the softc pointer, not the xfer, to the callout, so the
    callout is not even tempted to use xfer after free -- if the
    callout fires, but the xfer is synchronously aborted before the
    callout can do anything, the xfer might be freed by the time the
    callout starts to examine it.

  . Teach the callout to do nothing if it is callout_pending after it
    has fired.  This way:

    1. completion or synchronous abort can just callout_stop
    2. start can just callout_schedule

    If the callout had already fired before (1), and doesn't acquire
    the bus lock until after (2), it may be tempted to abort the new
    root intr xfer just after submission, which would be wrong -- so
    instead we just have the callout do nothing if it notices it has
    been rescheduled, since it will fire again after the appropriate
    time has elapsed.


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 src/sys/arch/mips/adm5120/dev/ahci.c
cvs rdiff -u -r1.271 -r1.272 src/sys/dev/usb/ehci.c
cvs rdiff -u -r1.293 -r1.294 src/sys/dev/usb/ohci.c
cvs rdiff -u -r1.289 -r1.290 src/sys/dev/usb/uhci.c
cvs rdiff -u -r1.4 -r1.5 src/sys/dev/usb/vhci.c
cvs rdiff -u -r1.116 -r1.117 src/sys/dev/usb/xhci.c
cvs rdiff -u -r1.67 -r1.68 src/sys/external/bsd/dwc2/dwc2.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.