Patch "xhci: free xhci virtual devices with leaf nodes first" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

xhci: free xhci virtual devices with leaf nodes first

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xhci-free-xhci-virtual-devices-with-leaf-nodes-first.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Mathias Nyman <[email protected]>
Date: Tue, 3 Jan 2017 18:28:43 +0200
Subject: xhci: free xhci virtual devices with leaf nodes first

From: Mathias Nyman <[email protected]>

commit ee8665e28e8d90ce69d4abe5a469c14a8707ae0e upstream.

the tt_info provided by a HS hub might be in use to by a child device Make sure we free the devices in the correct order.

This is needed in special cases such as when xhci controller is reset when resuming from hibernate, and all virt_devices are freed.

Also free the virt_devices starting from max slot_id as children more commonly have higher slot_id than parent.

---
 drivers/usb/host/xhci-mem.c |   38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

@@ -964,6 +964,40 @@ void xhci_free_virt_device(struct xhci_h
 	xhci->devs[slot_id] = NULL;
 }
 
+/*
+ * Free a virt_device structure.
+ * If the virt_device added a tt_info (a hub) and has children pointing to
+ * that tt_info, then free the child first. Recursive.
+ * We can't rely on udev at this point to find child-parent relationships.
+ */
+void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
+{
+	struct xhci_virt_device *vdev;
+	struct list_head *tt_list_head;
+	struct xhci_tt_bw_info *tt_info, *next;
+	int i;
+
+	vdev = xhci->devs[slot_id];
+	if (!vdev)
+		return;
+
+	tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
+	list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
+		/* is this a hub device that added a tt_info to the tts list */
+		if (tt_info->slot_id == slot_id) {
+			/* are any devices using this tt_info? */
+			for (i = 1; i < HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
+				vdev = xhci->devs[i];
+				if (vdev && (vdev->tt_info == tt_info))
+					xhci_free_virt_devices_depth_first(
+						xhci, i);
+			}
+		}
+	}
+	/* we are now at a leaf device */
+	xhci_free_virt_device(xhci, slot_id);
+}
+
 int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 		struct usb_device *udev, gfp_t flags)
 {

@@ -1828,8 +1862,8 @@ void xhci_mem_cleanup(struct xhci_hcd *x
 		}
 	}
 
-	for (i = 1; i < MAX_HC_SLOTS; ++i)
-		xhci_free_virt_device(xhci, i);
+	for (i = HCS_MAX_SLOTS(xhci->hcs_params1); i > 0; i--)
+		xhci_free_virt_devices_depth_first(xhci, i);
 
 	dma_pool_destroy(xhci->segment_pool);
 	xhci->segment_pool = NULL;

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/usb-host-xhci-fix-possible-wild-pointer-when-handling-abort-command.patch queue-4.4/xhci-workaround-for-hosts-missing-cas-bit.patch queue-4.4/xhci-handle-command-completion-and-timeout-race.patch queue-4.4/usb-xhci-fix-possible-wild-pointer.patch queue-4.4/xhci-free-xhci-virtual-devices-with-leaf-nodes-first.patch queue-4.4/usb-xhci-fix-return-value-of-xhci_setup_device.patch queue-4.4/usb-xhci-apply-xhci_pme_stuck_quirk-to-intel-apollo-lake.patch queue-4.4/usb-xhci-hold-lock-over-xhci_abort_cmd_ring.patch