Changeset 93993 in vbox

Timestamp:

Feb 28, 2022 6:28:04 PM (3 years ago)

Author:

vboxsync

Message:

Devices/USB: Fix crash introduced with r150219 when a USB device is detached while the roothub tries to queue an URB but can't find the device. Also cancel all in flight URBs after the device was removed from the lookup tables in order to prevent the roothub from queueing URBs simultaneously, bugref:10196

Location:

trunk/src/VBox/Devices/USB

Files:

• DrvVUSBRootHub.cpp (modified) (3 diffs)
• VUSBInternal.h (modified) (2 diffs)
• VUSBUrb.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/USB/DrvVUSBRootHub.cpp

@@ -411 +411 @@
     Assert(pDev->i16Port != -1);
 
-    /* Cancel all in-flight URBs from this device. */
-    vusbDevCancelAllUrbs(pDev, true);
-
     /*
      * Detach the device and mark the port as available.
@@ -434 +431 @@
     }
     RTCritSectLeave(&pThis->CritSectDevices);
+
+    /* Cancel all in-flight URBs from this device. */
+    vusbDevCancelAllUrbs(pDev, true);
 
     /* Free resources. */
@@ -956 +956 @@
         pUrb->enmState = VUSBURBSTATE_REAPED;
         pUrb->enmStatus = VUSBSTATUS_DNR;
-        vusbUrbCompletionRh(pUrb);
+        vusbUrbCompletionRhEx(pRh, pUrb);
         rc = VINF_SUCCESS;
     }

trunk/src/VBox/Devices/USB/VUSBInternal.h

@@ -484 +484 @@
 void vusbUrbCancelAsync(PVUSBURB pUrb, CANCELMODE mode);
 void vusbUrbRipe(PVUSBURB pUrb);
-void vusbUrbCompletionRh(PVUSBURB pUrb);
+void vusbUrbCompletionRhEx(PVUSBROOTHUB pRh, PVUSBURB pUrb);
 int vusbUrbSubmitHardError(PVUSBURB pUrb);
-int vusbUrbErrorRh(PVUSBURB pUrb);
+int vusbUrbErrorRhEx(PVUSBROOTHUB pRh, PVUSBURB pUrb);
 int vusbDevUrbIoThreadWakeup(PVUSBDEV pDev);
 int vusbDevUrbIoThreadCreate(PVUSBDEV pDev);
@@ -578 +578 @@
     RTCritSectLeave(&pDev->CritSectAsyncUrbs);
 }
+
+
+DECLINLINE(int) vusbUrbErrorRh(PVUSBURB pUrb)
+{
+    PVUSBDEV pDev = pUrb->pVUsb->pDev;
+    PVUSBROOTHUB pRh = vusbDevGetRh(pDev);
+    AssertPtrReturn(pRh, VERR_VUSB_DEVICE_NOT_ATTACHED);
+
+    return vusbUrbErrorRhEx(pRh, pUrb);
+}
+
+
+DECLINLINE(void) vusbUrbCompletionRh(PVUSBURB pUrb)
+{
+    PVUSBROOTHUB pRh = vusbDevGetRh(pUrb->pVUsb->pDev);
+    AssertPtrReturnVoid(pRh);
+
+    vusbUrbCompletionRhEx(pRh, pUrb);
+}
+
 
 /** @def vusbUrbAssert

trunk/src/VBox/Devices/USB/VUSBUrb.cpp

@@ -216 +216 @@
  * @returns true if it could be retried.
  * @returns false if it should be completed with failure.
+ * @param   pRh     The roothub the URB originated from.
  * @param   pUrb    The URB in question.
  */
-int vusbUrbErrorRh(PVUSBURB pUrb)
+int vusbUrbErrorRhEx(PVUSBROOTHUB pRh, PVUSBURB pUrb)
 {
     PVUSBDEV pDev = pUrb->pVUsb->pDev;
-    PVUSBROOTHUB pRh = vusbDevGetRh(pDev);
-    AssertPtrReturn(pRh, VERR_VUSB_DEVICE_NOT_ATTACHED);
     LogFlow(("%s: vusbUrbErrorRh: pDev=%p[%s] rh=%p\n", pUrb->pszDesc, pDev, pDev->pUsbIns ? pDev->pUsbIns->pszName : "", pRh));
     return pRh->pIRhPort->pfnXferError(pRh->pIRhPort, pUrb);
@@ -230 +229 @@
  * Does URB completion on roothub level.
  *
+ * @param   pRh     The roothub the URB originated from.
  * @param   pUrb    The URB to complete.
  */
-void vusbUrbCompletionRh(PVUSBURB pUrb)
+void vusbUrbCompletionRhEx(PVUSBROOTHUB pRh, PVUSBURB pUrb)
 {
     LogFlow(("%s: vusbUrbCompletionRh: type=%s status=%s\n",
@@ -249 +249 @@
             LogRel(("VUSB: Capturing URB completion event failed with %Rrc\n", rc));
     }
-
-    PVUSBROOTHUB pRh = vusbDevGetRh(pUrb->pVUsb->pDev);
-    AssertPtrReturnVoid(pRh);
 
     /* If there is a sniffer on the roothub record the completed URB there too. */
@@ -365 +362 @@
         case VUSBXFERTYPE_BULK:
             if (pUrb->enmStatus != VUSBSTATUS_OK)
-                vusbUrbErrorRh(pUrb);
+                vusbUrbErrorRhEx(pRh, pUrb);
             break;
     }