git: e0e1e9e08309 - stable/14 - libusb: dequeue next transfer on completion to prevent stalls

The branch stable/14 has been updated by bapt:

URL: https://cgit.FreeBSD.org/src/commit/?id=e0e1e9e083097383bcebf0b6cf65af46653e2f73

commit e0e1e9e083097383bcebf0b6cf65af46653e2f73
Author:     Baptiste Daroussin <bapt@FreeBSD.org>
AuthorDate: 2026-02-15 18:07:07 +0000
Commit:     Baptiste Daroussin <bapt@FreeBSD.org>
CommitDate: 2026-03-02 12:49:01 +0000

    libusb: dequeue next transfer on completion to prevent stalls
    
    The transfer proxy callbacks (bulk/interrupt, control, isochronous)
    only called libusb10_submit_transfer_sub() in the START path to
    pipeline the second kernel transfer slot. On completion or error,
    no attempt was made to dequeue the next pending transfer from
    tr_head onto the now-free slot.
    
    When more than two async transfers were submitted on the same
    endpoint, the third (and subsequent) transfers would remain stuck
    on tr_head indefinitely, since no completion ever triggered their
    submission. This caused a protocol-level deadlock in applications
    like adb that submit header + payload + zero-length terminator as
    three separate bulk transfers in sequence.
    
    Fix by calling libusb10_submit_transfer_sub() after every
    libusb10_complete_transfer() in all three proxy callbacks.
    
    MFC After:      2 weeks
    Reviewed by:    adrian
    Differential Revision:  https://reviews.freebsd.org/D55289
    
    (cherry picked from commit 38c18332642500fdfe075a82f88e033f6673a53f)
---
 lib/libusb/libusb10.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/libusb/libusb10.c b/lib/libusb/libusb10.c
index f8912b5c47cb..2d55a2852c67 100644
--- a/lib/libusb/libusb10.c
+++ b/lib/libusb/libusb10.c
@@ -1171,6 +1171,9 @@ libusb10_isoc_proxy(struct libusb20_transfer *pxfer)
 			    libusb20_tr_get_length(pxfer, i);
 		}
 		libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
+
+		/* start next queued transfer, if any */
+		libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 		break;
 	case LIBUSB20_TRANSFER_START:
 		/* setup length(s) */
@@ -1193,6 +1196,9 @@ libusb10_isoc_proxy(struct libusb20_transfer *pxfer)
 		break;
 	default:
 		libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status));
+
+		/* start next queued transfer, if any */
+		libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 		break;
 	}
 }
@@ -1234,11 +1240,15 @@ libusb10_bulk_intr_proxy(struct libusb20_transfer *pxfer)
 			} else {
 				libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
 			}
+			/* start next queued transfer, if any */
+			libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 			break;
 		}
 		/* check for end of data */
 		if (sxfer->rem_len == 0) {
 			libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
+			/* start next queued transfer, if any */
+			libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 			break;
 		}
 		/* FALLTHROUGH */
@@ -1265,6 +1275,8 @@ libusb10_bulk_intr_proxy(struct libusb20_transfer *pxfer)
 
 	default:
 		libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status));
+		/* start next queued transfer, if any */
+		libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 		break;
 	}
 }
@@ -1309,11 +1321,15 @@ libusb10_ctrl_proxy(struct libusb20_transfer *pxfer)
 			} else {
 				libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
 			}
+			/* start next queued transfer, if any */
+			libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 			break;
 		}
 		/* check for end of data */
 		if (sxfer->rem_len == 0) {
 			libusb10_complete_transfer(pxfer, sxfer, LIBUSB_TRANSFER_COMPLETED);
+			/* start next queued transfer, if any */
+			libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 			break;
 		}
 		/* FALLTHROUGH */
@@ -1354,6 +1370,8 @@ libusb10_ctrl_proxy(struct libusb20_transfer *pxfer)
 
 	default:
 		libusb10_complete_transfer(pxfer, sxfer, libusb10_convert_error(status));
+		/* start next queued transfer, if any */
+		libusb10_submit_transfer_sub(libusb20_tr_get_priv_sc0(pxfer), uxfer->endpoint);
 		break;
 	}
 }