uas: Check against unexpected completions (d89da03a) · Commits · 戴 / test

The status urb should not complete before the command has been submitted, nor should we get a second status urb for the same tag after a IU_ID_STATUS. Data urbs should not complete before the command has been submitted, but may complete after the IU_ID_STATUS. Signed-off-by:

Hans de Goede <hdegoede@redhat.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/usb/storage/uas.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -371,6 +371,12 @@ static void uas_stat_cmplt(struct urb *urb)

		cmnd = devinfo->cmnd[idx];
		cmdinfo = (void *)&cmnd->SCp;

		if (!(cmdinfo->state & COMMAND_INFLIGHT)) {
		scmd_printk(KERN_ERR, cmnd, "unexpected status cmplt\n");
		goto out;
		}

		switch (iu->iu_id) {
		case IU_ID_STATUS:
		if (urb->actual_length < 16)
		@@ -436,6 +442,12 @@ static void uas_data_cmplt(struct urb *urb)
		if (devinfo->resetting)
		goto out;

		/* Data urbs should not complete before the cmd urb is submitted */
		if (cmdinfo->state & SUBMIT_CMD_URB) {
		scmd_printk(KERN_ERR, cmnd, "unexpected data cmplt\n");
		goto out;
		}

		if (urb->status) {
		if (urb->status != -ECONNRESET) {
		uas_log_cmd_state(cmnd, __func__);

Admin message