linux.git/drivers/usb/typec/ucsi, branch vsnprintf

usb: typec: ucsi: Fix connector status writing past buffer size

2024-12-04T15:30:28+00:00

Similar to commit 65c4c9447bfc ("usb: typec: ucsi: Fix a missing bits to
bytes conversion in ucsi_init()"), there was a missing conversion from
bits to bytes. Here the outcome is worse though: since the value is
lower than UCSI_MAX_DATA_LENGTH, instead of bailing out with an error,
it writes past the buffer size.

The error is then seen in other places like below:

	Oops: general protection fault, probably for non-canonical address 0x891e812cd0ed968: 0000 [#1] PREEMPT SMP NOPTI
	CPU: 3 UID: 110 PID: 906 Comm: prometheus-node Not tainted 6.13.0-rc1-xe #1
	Hardware name: Intel Corporation Lunar Lake Client Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3222.D84.2410171025 10/17/2024
	RIP: 0010:power_supply_get_property+0x3e/0xe0
	Code: 85 c0 7e 4f 4c 8b 07 89 f3 49 89 d4 49 8b 48 20 48 85 c9 74 72 49 8b 70 18 31 d2 31 c0 eb 0b 83 c2 01 48 63 c2 48 39 c8 73 5d <3b> 1c 86 75 f0 49 8b 40 28 4c 89 e2 89 de ff d0 0f 1f 00 5b 41 5c
	RSP: 0018:ffffc900017dfa50 EFLAGS: 00010246
	RAX: 0000000000000000 RBX: 0000000000000011 RCX: c963b02c06092008
	RDX: 0000000000000000 RSI: 0891e812cd0ed968 RDI: ffff888121dd6800
	RBP: ffffc900017dfa68 R08: ffff88810a4024b8 R09: 0000000000000000
	R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900017dfa78
	R13: ffff888121dd6800 R14: ffff888138ad2c00 R15: ffff88810c57c528
	FS:  00007713a2ffd6c0(0000) GS:ffff88846f380000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000000c0004b1000 CR3: 0000000121ce8003 CR4: 0000000000f72ef0
	DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
	DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400
	PKRU: 55555554
	Call Trace:
	 
	 ? show_regs+0x6c/0x80
	 ? die_addr+0x37/0xa0
	 ? exc_general_protection+0x1c1/0x440
	 ? asm_exc_general_protection+0x27/0x30
	 ? power_supply_get_property+0x3e/0xe0
	 power_supply_hwmon_read+0x50/0xe0
	 hwmon_attr_show+0x46/0x170
	 dev_attr_show+0x1a/0x70
	 sysfs_kf_seq_show+0xaa/0x120
	 kernfs_seq_show+0x41/0x60

Just use the buffer size as argument to fix it.

Fixes: 226ff2e681d0 ("usb: typec: ucsi: Convert connector specific commands to bitmaps")
Signed-off-by: Lucas De Marchi 
Reviewed-by: Thomas Weißschuh 
Reviewed-by: Sebastian Reichel 
Reported-by: Chaitanya Kumar Borah 
Closes: https://lore.kernel.org/all/SJ1PR11MB6129CCD82CD78D8EE6E27EF4B9362@SJ1PR11MB6129.namprd11.prod.outlook.com/
Suggested-by: Thomas Weißschuh 
Reviewed-by: Heikki Krogerus 
Tested-by: Chaitanya Kumar Borah 
Link: https://lore.kernel.org/r/20241203200010.2821132-1-lucas.demarchi@intel.com
Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Fix completion notifications

2024-12-04T15:30:16+00:00

OPM                         PPM                         LPM
 |        1.send cmd         |                           |
 |-------------------------->|                           |
 |                           |--                         |
 |                           |  | 2.set busy bit in CCI  |
 |                           |<-                         |
 |      3.notify the OPM     |                           |
 |<--------------------------|                           |
 |                           | 4.send cmd to be executed |
 |                           |-------------------------->|
 |                           |                           |
 |                           |      5.cmd completed      |
 |                           |<--------------------------|
 |                           |                           |
 |                           |--                         |
 |                           |  | 6.set cmd completed    |
 |                           |<-       bit in CCI        |
 |                           |                           |
 |     7.notify the OPM      |                           |
 |<--------------------------|                           |
 |                           |                           |
 |   8.handle notification   |                           |
 |   from point 3, read CCI  |                           |
 |<--------------------------|                           |
 |                           |                           |

When the PPM receives command from the OPM (p.1) it sets the busy bit
in the CCI (p.2), sends notification to the OPM (p.3) and forwards the
command to be executed by the LPM (p.4). When the PPM receives command
completion from the LPM (p.5) it sets command completion bit in the CCI
(p.6) and sends notification to the OPM (p.7). If command execution by
the LPM is fast enough then when the OPM starts handling the notification
from p.3 in p.8 and reads the CCI value it will see command completion bit
set and will call complete(). Then complete() might be called again when
the OPM handles notification from p.7.

This fix replaces test_bit() with test_and_clear_bit()
in ucsi_notify_common() in order to call complete() only
once per request.

This fix also reinitializes completion variable in
ucsi_sync_control_common() before a command is sent.

Fixes: 584e8df58942 ("usb: typec: ucsi: extract common code for command handling")
Cc: stable@vger.kernel.org
Signed-off-by: Łukasz Bartosik 
Reviewed-by: Dmitry Baryshkov 
Reviewed-by: Heikki Krogerus 
Reviewed-by: Benson Leung 
Link: https://lore.kernel.org/r/20241203102318.3386345-1-ukaszb@chromium.org
Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-6.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2024-11-29T19:19:31+00:00

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 6.13-rc1.

  Overall, a pretty slow development cycle, the majority of the work
  going into the debugfs interface for the thunderbolt (i.e. USB4) code,
  to help with debugging the myrad ways that hardware vendors get their
  interfaces messed up. Other than that, here's the highlights:

   - thunderbolt changes and additions to debugfs interfaces

   - lots of device tree updates for new and old hardware

   - UVC configfs gadget updates and new apis for features

   - xhci driver updates and fixes

   - dwc3 driver updates and fixes

   - typec driver updates and fixes

   - lots of other small updates and fixes, full details in the shortlog

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'usb-6.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (148 commits)
  usb: typec: tcpm: Add support for sink-bc12-completion-time-ms DT property
  dt-bindings: usb: maxim,max33359: add usage of sink bc12 time property
  dt-bindings: connector: Add time property for Sink BC12 detection completion
  usb: dwc3: gadget: Remove dwc3_request->needs_extra_trb
  usb: dwc3: gadget: Cleanup SG handling
  usb: dwc3: gadget: Fix looping of queued SG entries
  usb: dwc3: gadget: Fix checking for number of TRBs left
  usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
  Revert "usb: gadget: composite: fix OS descriptors w_value logic"
  usb: ehci-spear: fix call balance of sehci clk handling routines
  USB: make to_usb_device_driver() use container_of_const()
  USB: make to_usb_driver() use container_of_const()
  USB: properly lock dynamic id list when showing an id
  USB: make single lock for all usb dynamic id lists
  drivers/usb/storage: refactor min with min_t
  drivers/usb/serial: refactor min with min_t
  drivers/usb/musb: refactor min/max with min_t/max_t
  drivers/usb/mon: refactor min with min_t
  drivers/usb/misc: refactor min with min_t
  drivers/usb/host: refactor min/max with min_t/max_t
  ...

usb: typec: fix potential array underflow in ucsi_ccg_sync_control()

2024-11-12T11:54:01+00:00

The "command" variable can be controlled by the user via debugfs.  The
worry is that if con_index is zero then "&uc->ucsi->connector[con_index
- 1]" would be an array underflow.

Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Signed-off-by: Dan Carpenter 
Reviewed-by: Heikki Krogerus 
Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.mountain
Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Fix a missing bits to bytes conversion in ucsi_init()

2024-11-12T11:14:47+00:00

The GET_CAPABILITY size is wrong. The definitions for the
command sizes are for bitfieds and therefore in bits, not
bytes.

This fixes an issue that prevents the interface from being
registered with UCSI versions older than 2.0 because the
command size exceeds the MESSAGE_IN field size.

Fixes: 226ff2e681d0 ("usb: typec: ucsi: Convert connector specific commands to bitmaps")
Reported-by: Abel Vesa 
Closes: https://lore.kernel.org/linux-usb/Zy864W7sysWZbCTd@linaro.org/
Signed-off-by: Heikki Krogerus 
Reviewed-by: Abel Vesa 
Tested-by: Abel Vesa 
Link: https://lore.kernel.org/r/20241111100220.1743872-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: glink: be more precise on orientation-aware ports

2024-11-10T10:06:51+00:00

Instead of checking if any of the USB-C ports have orientation GPIO and
thus is orientation-aware, check for the GPIO for the port being
registered. There are no boards that are affected by this change at this
moment, so the patch is not marked as a fix, but it might affect other
boards in future.

Reviewed-by: Abel Vesa 
Reviewed-by: Neil Armstrong 
Reviewed-by: Johan Hovold 
Tested-by: Johan Hovold 
Signed-off-by: Dmitry Baryshkov 
Link: https://lore.kernel.org/r/20241109-ucsi-glue-fixes-v2-2-8b21ff4f9fbe@linaro.org
Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: glink: fix off-by-one in connector_status

2024-11-10T10:06:51+00:00

UCSI connector's indices start from 1 up to 3, PMIC_GLINK_MAX_PORTS.
Correct the condition in the pmic_glink_ucsi_connector_status()
callback, fixing Type-C orientation reporting for the third USB-C
connector.

Fixes: 76716fd5bf09 ("usb: typec: ucsi: glink: move GPIO reading into connector_status callback")
Cc: stable@vger.kernel.org
Reported-by: Abel Vesa 
Reviewed-by: Neil Armstrong 
Reviewed-by: Johan Hovold 
Tested-by: Johan Hovold 
Signed-off-by: Dmitry Baryshkov 
Link: https://lore.kernel.org/r/20241109-ucsi-glue-fixes-v2-1-8b21ff4f9fbe@linaro.org
Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Convert connector specific commands to bitmaps

2024-11-07T09:02:36+00:00

That allows the fields in those command data structures to
be easily validated. If an unsupported field is accessed, a
warning is generated.

This will not force UCSI version checks to be made in every
place where these data structures are accessed, but it will
make it easier to pinpoint issues that are caused by the
unconditional accesses to those fields, and perhaps more
importantly, allow those issues to be noticed immediately.

Signed-off-by: Heikki Krogerus 
Link: https://lore.kernel.org/r/20241106150605.1017744-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()

2024-11-05T12:55:19+00:00

The "*cmd" variable can be controlled by the user via debugfs.  That means
"new_cam" can be as high as 255 while the size of the uc->updated[] array
is UCSI_MAX_ALTMODES (30).

The call tree is:
ucsi_cmd() // val comes from simple_attr_write_xsigned()
-> ucsi_send_command()
   -> ucsi_send_command_common()
      -> ucsi_run_command() // calls ucsi->ops->sync_control()
         -> ucsi_ccg_sync_control()

Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Cc: stable 
Signed-off-by: Dan Carpenter 
Reviewed-by: Heikki Krogerus 
Link: https://lore.kernel.org/r/325102b3-eaa8-4918-a947-22aca1146586@stanley.mountain
Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Helper for Get Connector Status command

2024-10-29T03:33:03+00:00

That command is executed from several locations in the
driver, so providing a dedicated helper function for it.

Reviewed-by: Abhishek Pandit-Subedi 
Reviewed-by: Dmitry Baryshkov 
Signed-off-by: Heikki Krogerus 
Link: https://lore.kernel.org/r/20241017091112.1178509-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman