>Number:         26546
>Category:       misc
>Synopsis:       ohci can cancel timeouts before transfer have finished
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    misc-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Aug 04 15:43:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Dan Ellis
>Release:        
>Organization:
Conexant Systems Inc.
>Environment:
>Description:
In ohci.c, control transfers can fail to time out after the setup phase has completed if another transfer flushes the done queue. The same situation exists for bulk transfers split over more than one transfer descriptor.
>How-To-Repeat:
Heavy USB load with badly behaved hardware.
>Fix:
The cancellation of the timeout in ohci_softintr should predicate on the transfer being the last of the batch (in ohci.c):

@@ -1324,7 +1337,9 @@
 			/* Handled by abort routine. */
 			continue;
 		}
-		usb_uncallout(xfer->timeout_handle, ohci_timeout, xfer);
+
+                if (std->flags & OHCI_CALL_DONE)
+                        usb_uncallout(xfer->timeout_handle, ohci_timeout, xfer);
 
 		len = std->len;
 		if (std->td.td_cbp != 0)

>Release-Note:
>Audit-Trail:
>Unformatted: