[xhci] Consume event TRB before reporting completion to USB core
authorMichael Brown <mcb30@ipxe.org>
Mon, 19 Feb 2018 18:59:45 +0000 (18:59 +0000)
committerMichael Brown <mcb30@ipxe.org>
Mon, 19 Feb 2018 18:59:45 +0000 (18:59 +0000)
commit8dbb73a779e5b11ee2b65f9d2af6dd9bd8998608
treefeea61eefea1cc2f6d4455257afc3c07cfa5e9df
parent6737a8795f20c21bb48d410c2d9266f8c9c11bbc
[xhci] Consume event TRB before reporting completion to USB core

Reporting a completion via usb_complete() will pass control outside
the scope of xhci.c, and could potentially result in a further call to
xhci_event_poll() before returning from usb_complete().  Since we
currently update the event consumer counter only after calling
usb_complete(), this can result in duplicate completions and
consequent corruption of the submission TRB ring structures.

Fix by updating the event ring consumer counter before passing control
to usb_complete().

Reported-by: Andreas Hammarskjöld <junior@2PintSoftware.com>
Tested-by: Andreas Hammarskjöld <junior@2PintSoftware.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
src/drivers/usb/xhci.c