A zero-length-packet write that returns `kIOReturnNoDevice` leaves the usbdev fd connected instead of marking it disconnected

未关闭
  • 哪里不对？
#529 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
c, macos
领域
operating-systems

调研方向

Read usbdev_async_cb in src/syscall/usbdev.c and the existing zlpfail fixture step in src/syscall/usbdev-fixture.c. Then inspect tests/test-usbdev-urb-loopback.c to see how fixture steps are exercised. Add coverage for a zero-length write returning a device-gone code; done means the fd reports POLLERR | POLLHUP and refuses ioctls with ENODEV.

由索引模型根据 Issue 内容生成。

描述

bug

What happens

When an OUT URB with USBDEVFS_URB_ZERO_PACKET completes and the terminating zero-length write in usbdev_async_cb (src/syscall/usbdev.c) returns kIOReturnNoDevice or kIOReturnNotAttached, the URB gets -ENODEV but the fd is not marked disconnected. Until the IOKit terminate notification arrives (or never, when usbdev_arm_disconnect_watch could not register it), poll does not report POLLERR | POLLHUP and ioctls are not refused with ENODEV.

Evidence

Checked by reading at a20dfab; not reproduced. The comment above usbdev_ioret_device_gone says "Every site that sees one owes the fd a disconnect stamp" and names three sites: SUBMITURB's start, the completion callback, and the queued follower's start. The zero-length write in usbdev_async_cb is a fourth site that sees an IOKit result. Its result goes only through usbdev_urb_status, while the main transfer result in the same callback goes through usbdev_ioret_device_gone and usbdev_mark_disconnected_locked.

Cause

The disconnect state is set at each site that sees a device-gone IOKit code, and the ZLP write is the one site without the check.

Reproduce

Not reproduced. The loopback fixture's zlpfail step makes the zero-length write return kIOUSBPipeStalled, not a device-gone code, and its terminate step also fires the terminate notification, which stamps the fd and hides this. A fixture step that makes only the zero-length write return kIOReturnNoDevice would reproduce it with tests/test-usbdev-urb-loopback.c.

Possible fix

In usbdev_async_cb, after the zero-length write, call usbdev_mark_disconnected_locked(u) when usbdev_ioret_device_gone(zr) holds, as the main result does, and add the ZLP write to the site list in the comment above usbdev_ioret_device_gone. Add a zlpnodev step to src/syscall/usbdev-fixture.c for the test.

Origin

Follow-up from #525.

主要语言
C
星标
282
派生
32
平均合并
1 天 12 小时
30 天内合并 PR
17

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

sysprog21/elfuse 的其他 Issue

查看 sysprog21/elfuse 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。