Skip to content

[transport] usb: Fix htool crash on USB disconnect - #249

Merged
wak-google merged 1 commit into
google:mainfrom
wak-google:libusb-transport
Jul 27, 2026
Merged

[transport] usb: Fix htool crash on USB disconnect#249
wak-google merged 1 commit into
google:mainfrom
wak-google:libusb-transport

Conversation

@wak-google

Copy link
Copy Markdown
Collaborator

Previously, libhoth_usb_fifo_run_transfers() could return while one or more libusb transfers were still pending. This happened if the second transfer submission failed, or if the event handling loop was interrupted by a signal (e.g. SIGINT).

When htool subsequently attempted to close and reopen the transport, it would call libusb_free_transfer() on these pending transfers, triggering an assertion failure in libusb:
'usbi_mutex_lock: Assertion pthread_mutex_lock(mutex) == 0 failed'

This change ensures that:

  1. All submitted transfers are completed (success, error, or cancel) before the function returns.
  2. If a transfer submission fails, any other successfully submitted transfer is cancelled and waited for.
  3. Signal interruptions do not cause an early return while transfers are pending.
  4. Completion flags are correctly initialized on open.

Verified on yutulis-ru4-bmc-01 with 1000 iterations of target reset spam without a crash.

Comment thread transports/libhoth_usb_fifo.c
Comment thread transports/libhoth_usb_fifo.c Outdated
Comment thread transports/libhoth_usb_fifo.c Outdated
Comment thread transports/libhoth_usb_fifo.c Outdated
@wak-google

Copy link
Copy Markdown
Collaborator Author

Should be fixed up now

@xorptr
xorptr requested a review from korran May 19, 2026 00:09
Comment thread transports/libhoth_usb_fifo.c Outdated
Comment thread transports/libhoth_usb_fifo.c
Comment thread transports/libhoth_usb_fifo.c Outdated
Comment thread transports/libhoth_usb_fifo.c Outdated
Previously, libhoth_usb_fifo_run_transfers() could return while one
or more libusb transfers were still pending. This happened if the
second transfer submission failed, or if the event handling loop was
interrupted by a signal (e.g. SIGINT).

When htool subsequently attempted to close and reopen the transport,
it would call libusb_free_transfer() on these pending transfers,
triggering an assertion failure in libusb:
'usbi_mutex_lock: Assertion pthread_mutex_lock(mutex) == 0 failed'

This change ensures that:
1. All submitted transfers are completed (success, error, or cancel)
   before the function returns.
2. If a transfer submission fails, any other successfully submitted
   transfer is cancelled and waited for.
3. Signal interruptions do not cause an early return while transfers
   are pending.
4. Completion flags are correctly initialized on open.

Verified on yutulis-ru4-bmc-01 with 1000 iterations of target reset
spam without a crash.

Signed-off-by: William A. Kennington III <wak@google.com>
@wak-google
wak-google merged commit a3f9a5f into google:main Jul 27, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants