linux-stable.git/drivers/usb/host, branch v6.11

xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration

2024-08-15T14:29:46+00:00

re-enumerating full-speed devices after a failed address device command
can trigger a NULL pointer dereference.

Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size
value during enumeration. Usb core calls usb_ep0_reinit() in this case,
which ends up calling xhci_configure_endpoint().

On Panther point xHC the xhci_configure_endpoint() function will
additionally check and reserve bandwidth in software. Other hosts do
this in hardware

If xHC address device command fails then a new xhci_virt_device structure
is allocated as part of re-enabling the slot, but the bandwidth table
pointers are not set up properly here.
This triggers the NULL pointer dereference the next time usb_ep0_reinit()
is called and xhci_configure_endpoint() tries to check and reserve
bandwidth

[46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd
[46710.713699] usb 3-1: Device not responding to setup address.
[46710.917684] usb 3-1: Device not responding to setup address.
[46711.125536] usb 3-1: device not accepting address 5, error -71
[46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008
[46711.125600] #PF: supervisor read access in kernel mode
[46711.125603] #PF: error_code(0x0000) - not-present page
[46711.125606] PGD 0 P4D 0
[46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI
[46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1
[46711.125620] Hardware name: Gigabyte Technology Co., Ltd.
[46711.125623] Workqueue: usb_hub_wq hub_event [usbcore]
[46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c

Fix this by making sure bandwidth table pointers are set up correctly
after a failed address device command, and additionally by avoiding
checking for bandwidth in cases like this where no actual endpoints are
added or removed, i.e. only context for default control endpoint 0 is
evaluated.

Reported-by: Karel Balej 
Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/
Cc: stable@vger.kernel.org
Fixes: 651aaf36a7d7 ("usb: xhci: Handle USB transaction error on address command")
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240815141117.2702314-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: fix duplicate stall handling in handle_tx_event()

2024-08-13T08:26:28+00:00

Stall handling is managed in the 'process_*' functions, which are called
right before the 'goto' stall handling code snippet. Thus, there should
be a return after the 'process_*' functions. Otherwise, the stall code may
run twice.

Fixes: 1b349f214ac7 ("usb: xhci: add 'goto' for halted endpoint check in handle_tx_event()")
Reported-by: Michal Pecio 
Signed-off-by: Niklas Neronin 
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240809124408.505786-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup()

2024-08-13T08:26:27+00:00

If xhci_mem_init() fails, it calls into xhci_mem_cleanup() to mop
up the damage. If it fails early enough, before xhci->interrupters
is allocated but after xhci->max_interrupters has been set, which
happens in most (all?) cases, things get uglier, as xhci_mem_cleanup()
unconditionally derefences xhci->interrupters. With prejudice.

Gate the interrupt freeing loop with a check on xhci->interrupters
being non-NULL.

Found while debugging a DMA allocation issue that led the XHCI driver
on this exact path.

Fixes: c99b38c41234 ("xhci: add support to allocate several interrupters")
Cc: Mathias Nyman 
Cc: Wesley Cheng 
Cc: Greg Kroah-Hartman 
Signed-off-by: Marc Zyngier 
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240809124408.505786-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2024-07-19T22:37:48+00:00

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 6.11-rc1.

  Nothing earth-shattering in here, just constant forward progress in
  adding support for new hardware and better debugging functionalities
  for thunderbolt devices and the subsystem. Included in here are:

   - thunderbolt debugging update and driver additions

   - xhci driver updates

   - typec driver updates

   - kselftest device driver changes (acked by the relevant maintainers,
     depended on other changes in this tree.)

   - cdns3 driver updates

   - gadget driver updates

   - MODULE_DESCRIPTION() additions

   - dwc3 driver updates and fixes

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (112 commits)
  kselftest: devices: Add test to detect device error logs
  kselftest: Move ksft helper module to common directory
  kselftest: devices: Move discoverable devices test to subdirectory
  usb: gadget: f_uac2: fix non-newline-terminated function name
  USB: uas: Implement the new shutdown callback
  USB: core: add 'shutdown' callback to usb_driver
  usb: typec: Drop explicit initialization of struct i2c_device_id::driver_data to 0
  usb: dwc3: enable CCI support for AMD-xilinx DWC3 controller
  usb: dwc2: add support for other Lantiq SoCs
  usb: gadget: Use u16 types for 16-bit fields
  usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
  usb: dwc3: core: Check all ports when set phy suspend
  usb: typec: tcpci: add support to set connector orientation
  dt-bindings: usb: Convert fsl-usb to yaml
  usb: typec: ucsi: reorder operations in ucsi_run_command()
  usb: typec: ucsi: extract common code for command handling
  usb: typec: ucsi: inline ucsi_read_message_in
  usb: typec: ucsi: rework command execution functions
  usb: typec: ucsi: split read operation
  usb: typec: ucsi: simplify command sending API
  ...

xhci: always resume roothubs if xHC was reset during resume

2024-07-03T14:02:33+00:00

Usb device connect may not be detected after runtime resume if
xHC is reset during resume.

In runtime resume cases xhci_resume() will only resume roothubs if there
are pending port events. If the xHC host is reset during runtime resume
due to a Save/Restore Error (SRE) then these pending port events won't be
detected as PORTSC change bits are not immediately set by host after reset.

Unconditionally resume roothubs if xHC is reset during resume to ensure
device connections are detected.

Also return early with error code if starting xHC fails after reset.

Issue was debugged and a similar solution suggested by Remi Pommarel.
Using this instead as it simplifies future refactoring.

Reported-by: Remi Pommarel 
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218987
Suggested-by: Remi Pommarel 
Tested-by: Remi Pommarel 
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240627145523.1453155-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

xhci: sort out TRB Endpoint ID bitfield macros

2024-06-27T14:08:06+00:00

xhci macros that read and write endpoint ID bitfields of TRBs are mixing
the 1-based Endpoint ID as described in the xHCI specification, and
0-based endpoint index used by driver as an array index.

Sort this out by naming macros that deal with 1 based Endpoint ID fields
to *_EP_ID_*, and 0 based endpoint index values to *_EP_INDEX_*.

Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240626124835.1023046-22-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

xhci: Apply XHCI_RESET_TO_DEFAULT quirk to TGL

2024-06-27T14:08:06+00:00

TGL systems have the same issue as ADL, where a large boot firmware
delay is seen if USB ports are left in U3 at shutdown. So apply the
XHCI_RESET_TO_DEFAULT quirk to TGL as well.

The issue it fixes is a ~20s boot time delay when booting from S5. It
affects TGL devices, and TGL support was added starting from v5.3.

Cc: stable@vger.kernel.org
Signed-off-by: Reka Norman 
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240626124835.1023046-21-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: add 'goto' for halted endpoint check in handle_tx_event()

2024-06-27T14:08:06+00:00

Add 'goto' statement for a halted endpoint, streamlining the error
handling process. In future handle_tx_event() changes this 'goto'
statement will have more uses.

Signed-off-by: Niklas Neronin 
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240626124835.1023046-20-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: move process TD code out of the while loop

2024-06-27T14:08:06+00:00

This part is and should only performed once, so it's moved out of the
while loop to improve code readability.

Signed-off-by: Niklas Neronin 
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240626124835.1023046-19-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: remove infinite loop prevention

2024-06-27T14:08:06+00:00

If a buggy HW reports some unpredicted event (for example, an overrun event
following a MSE event while the EP ring is actually not empty), the driver
will never find the TD, and it will loop until the TD list is empty.

Before commits [1][2], the spin lock was released when giving back a URB in
the do-while loop. This could cause more TD to be added to TD list, causing
an infinite loop.

Because of commits [1][2] the spin lock is not released any more, thus the
infinite loop prevention is unnecessary and is removed.

[1], commit 0c03d89d0c71 ("xhci: Giveback urb in finish_td directly")
[2], commit 36dc01657b49 ("usb: host: xhci: Support running urb giveback in
			   tasklet context")

Signed-off-by: Niklas Neronin 
Signed-off-by: Mathias Nyman 
Link: https://lore.kernel.org/r/20240626124835.1023046-18-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman