patch "xhci: make sure interrupts are restored to correct state" added to usb-linus
Subsystems (3)
This is a note to let you know that I've just added the patch titled
xhci: make sure interrupts are restored to correct state
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
From bd82873f23c9a6ad834348f8b83f3b6a5bca2c65 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <[email protected]>
Date: Wed, 11 Dec 2019 16:20:07 +0200
Subject: xhci: make sure interrupts are restored to correct state
spin_unlock_irqrestore() might be called with stale flags after reading port status, possibly restoring interrupts to a incorrect state.
If a usb2 port just finished resuming while the port status is read the spin lock will be temporary released and re-acquired in a separate function. The flags parameter is passed as value instead of a pointer, not updating flags properly before the final spin_unlock_irqrestore() is called.
--- drivers/usb/host/xhci-hub.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/usb/host/xhci-hub.c +6 -6
@@ -806,7 +806,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,static int xhci_handle_usb2_port_link_resume (struct xhci_port *port,u32 *status,u32 portsc, -unsigned long flags) +unsigned long *flags) {struct xhci_bus_state *bus_state;struct xhci_hcd *xhci;
@@ -860,11 +860,11 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,xhci_test_and_clear_bit (xhci, port,PORT_PLC );xhci_set_link_state (xhci, port,XDEV_U0 ); -spin_unlock_irqrestore (&xhci->lock, flags); +spin_unlock_irqrestore (&xhci->lock, *flags); time_left =wait_for_completion_timeout ( &bus_state->rexit_done[wIndex],msecs_to_jiffies (XHCI_MAX_REXIT_TIMEOUT_MS )); -spin_lock_irqsave (&xhci->lock, flags); +spin_lock_irqsave (&xhci->lock, *flags);if (time_left) { slot_id = xhci_find_slot_id_by_port(hcd, xhci,
@@ -967,7 +967,7 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status, }static void xhci_get_usb2_port_status (struct xhci_port *port,u32 *status, -u32 portsc,unsigned long flags) +u32 portsc,unsigned long *flags) {struct xhci_bus_state *bus_state;u32 link_state;
@@ -1017,7 +1017,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,static u32 xhci_get_port_status (struct usb_hcd *hcd,struct xhci_bus_state *bus_state,u16 wIndex,u32 raw_port_status, -unsigned long flags) +unsigned long *flags) __releases(&xhci->lock) __acquires(&xhci->lock) {
@@ -1140,7 +1140,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, }trace_xhci_get_port_status (wIndex, temp); status =xhci_get_port_status (hcd, bus_state, wIndex, temp, - flags); + &flags);if (status ==0xffffffff ) goto error;
Signature · 1 line
2.24.1