A zero-length-packet write that returns `kIOReturnNoDevice` leaves the usbdev fd connected instead of marking it disconnected

Aperta
  • Qualcosa non va?
#529 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, macos
Ambito
operating-systems

Direzione di ricerca

Read usbdev_async_cb in src/syscall/usbdev.c and the existing zlpfail fixture step in src/syscall/usbdev-fixture.c. Then inspect tests/test-usbdev-urb-loopback.c to see how fixture steps are exercised. Add coverage for a zero-length write returning a device-gone code; done means the fd reports POLLERR | POLLHUP and refuses ioctls with ENODEV.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

What happens

When an OUT URB with USBDEVFS_URB_ZERO_PACKET completes and the terminating zero-length write in usbdev_async_cb (src/syscall/usbdev.c) returns kIOReturnNoDevice or kIOReturnNotAttached, the URB gets -ENODEV but the fd is not marked disconnected. Until the IOKit terminate notification arrives (or never, when usbdev_arm_disconnect_watch could not register it), poll does not report POLLERR | POLLHUP and ioctls are not refused with ENODEV.

Evidence

Checked by reading at a20dfab; not reproduced. The comment above usbdev_ioret_device_gone says "Every site that sees one owes the fd a disconnect stamp" and names three sites: SUBMITURB's start, the completion callback, and the queued follower's start. The zero-length write in usbdev_async_cb is a fourth site that sees an IOKit result. Its result goes only through usbdev_urb_status, while the main transfer result in the same callback goes through usbdev_ioret_device_gone and usbdev_mark_disconnected_locked.

Cause

The disconnect state is set at each site that sees a device-gone IOKit code, and the ZLP write is the one site without the check.

Reproduce

Not reproduced. The loopback fixture's zlpfail step makes the zero-length write return kIOUSBPipeStalled, not a device-gone code, and its terminate step also fires the terminate notification, which stamps the fd and hides this. A fixture step that makes only the zero-length write return kIOReturnNoDevice would reproduce it with tests/test-usbdev-urb-loopback.c.

Possible fix

In usbdev_async_cb, after the zero-length write, call usbdev_mark_disconnected_locked(u) when usbdev_ioret_device_gone(zr) holds, as the main result does, and add the ZLP write to the site list in the comment above usbdev_ioret_device_gone. Add a zlpnodev step to src/syscall/usbdev-fixture.c for the test.

Origin

Follow-up from #525.

Lingua principale
C
Stelle
282
Fork
32
Merge medio
1g 12h
PR unite (30g)
17

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di sysprog21/elfuse

Tutte le issue di sysprog21/elfuse

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.