KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

libusb: dequeue next transfer on completion to prevent stalls

Browse Source 
The transfer proxy callbacks (bulk/interrupt, control, isochronous)
only called libusb10_submit_transfer_sub() in the START path to
pipeline the second kernel transfer slot. On completion or error,
no attempt was made to dequeue the next pending transfer from
tr_head onto the now-free slot.

When more than two async transfers were submitted on the same
endpoint, the third (and subsequent) transfers would remain stuck
on tr_head indefinitely, since no completion ever triggered their
submission. This caused a protocol-level deadlock in applications
like adb that submit header + payload + zero-length terminator as
three separate bulk transfers in sequence.

Fix by calling libusb10_submit_transfer_sub() after every
libusb10_complete_transfer() in all three proxy callbacks.

MFC After:	2 weeks
Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D55289
This commit is contained in:
Baptiste Daroussin
2026-02-15 19:07:07 +01:00
parent be52217695
commit 38c1833264
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/libusb/libusb10.c
+18
View File
@@ -1259,6 +1259,9 @@ libusb10_isoc_proxy(struct libusb20_transfer *pxfer)
libusb20_tr_get_length(pxfer, i);
}
libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
case LIBUSB20_TRANSFER_START:
/* setup length(s) */
@@ -1281,6 +1284,9 @@ libusb10_isoc_proxy(struct libusb20_transfer *pxfer)
break;
default:
libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status));
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
}
@@ -1322,11 +1328,15 @@ libusb10_bulk_intr_proxy(struct libusb20_transfer *pxfer)
} else {
libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
}
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
/* check for end of data */
if (sxfer->rem_len == 0) {
libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
/* FALLTHROUGH */
@@ -1353,6 +1363,8 @@ libusb10_bulk_intr_proxy(struct libusb20_transfer *pxfer)
default:
libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status));
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
}
@@ -1397,11 +1409,15 @@ libusb10_ctrl_proxy(struct libusb20_transfer *pxfer)
} else {
libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
}
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
/* check for end of data */
if (sxfer->rem_len == 0) {
libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
/* FALLTHROUGH */
@@ -1442,6 +1458,8 @@ libusb10_ctrl_proxy(struct libusb20_transfer *pxfer)
default:
libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status));
/* start next queued transfer, if any */
libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
break;
}
}