patch "Revert "xhci: Fix memory leak when caching protocol extended" added to usb-linus
Subsystems (3)
This is a note to let you know that I've just added the patch titled
Revert "xhci: Fix memory leak when caching protocol extended
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
From 67f68f977a12657028e866c013d43dd87320d210 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <[email protected]>
Date: Wed, 12 Feb 2020 09:48:57 -0800
Subject: Revert "xhci: Fix memory leak when caching protocol extended
capability PSI tables"
This reverts commit fc57313d1017dd6b6f37a94e88daa8df54368ecc.
Marek reports that it breaks things:
This patch landed in today's linux-next (20200211) and causes NULL pointer dereference during second suspend/resume cycle on Samsung Exynos5422-based (arm 32bit) Odroid XU3lite board:
A more complete fix will be added soon.
--- drivers/usb/host/xhci-hub.c | 25 +++++----------- drivers/usb/host/xhci-mem.c | 58 ++++++++++++++----------------------- drivers/usb/host/xhci.h | 14 ++------- 3 files changed, 33 insertions(+), 64 deletions(-)
drivers/usb/host/xhci-hub.c +8 -17
@@ -55,7 +55,6 @@ static u8 usb_bos_descriptor [] = {static int xhci_create_usb3_bos_desc (struct xhci_hcd *xhci,char *buf,u16 wLength) { -struct xhci_port_cap *port_cap =NULL ;int i, ssa_count;u32 temp;u16 desc_size, ssp_cap_size, ssa_size =0 ;
@@ -65,24 +64,16 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, ssp_cap_size =sizeof (usb_bos_descriptor) - desc_size;/* does xhci support USB 3.1 Enhanced SuperSpeed */ -for (i =0 ; i < xhci->num_port_caps; i++) { -if (xhci->port_caps[i].maj_rev ==0x03 && - xhci->port_caps[i].min_rev >=0x01 ) { - usb3_1 = true; - port_cap = &xhci->port_caps[i]; -break ; - } - } - -if (usb3_1) { +if (xhci->usb3_rhub.min_rev >=0x01 ) {/* does xhci provide a PSI table for SSA speed attributes? */ -if (port_cap->psi_count) { +if (xhci->usb3_rhub.psi_count) {/* two SSA entries for each unique PSI ID, RX and TX */ - ssa_count = port_cap->psi_uid_count *2 ; + ssa_count = xhci->usb3_rhub.psi_uid_count *2 ; ssa_size = ssa_count *sizeof (u32); ssp_cap_size -=16 ;/* skip copying the default SSA */ } desc_size += ssp_cap_size; + usb3_1 = true; }memcpy (buf, &usb_bos_descriptor,min (desc_size, wLength));
@@ -108,7 +99,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, }/* If PSI table exists, add the custom speed attributes from it */ -if (usb3_1 && port_cap->psi_count) { +if (usb3_1 && xhci->usb3_rhub.psi_count) {u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;int offset;
@@ -120,7 +111,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,/* attribute count SSAC bits 4:0 and ID count SSIC bits 8:5 */ bm_attrib = (ssa_count -1 ) &0x1f ; - bm_attrib |= (port_cap->psi_uid_count -1 ) <<5 ; + bm_attrib |= (xhci->usb3_rhub.psi_uid_count -1 ) <<5 ;put_unaligned_le32 (bm_attrib, &buf[ssp_cap_base +4 ]);if (wLength < desc_size + ssa_size)
@@ -133,8 +124,8 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,* USB 3.1 requires two SSA entries (RX and TX) for every link */ offset = desc_size; -for (i =0 ; i < port_cap->psi_count; i++) { - psi = port_cap->psi[i]; +for (i =0 ; i < xhci->usb3_rhub.psi_count; i++) { + psi = xhci->usb3_rhub.psi[i]; psi &= ~USB_SSP_SUBLINK_SPEED_RSVD ; psi_exp =XHCI_EXT_PORT_PSIE (psi); psi_mant =XHCI_EXT_PORT_PSIM (psi);
drivers/usb/host/xhci-mem.c +22 -36
102 lines not on this page · raw message
drivers/usb/host/xhci.h +3 -11
@@ -1702,20 +1702,12 @@ struct xhci_bus_state {* Intel Lynx Point LP xHCI host. */ #define XHCI_MAX_REXIT_TIMEOUT_MS 20 -struct xhci_port_cap { -u32 *psi;/* array of protocol speed ID entries */ -u8 psi_count; -u8 psi_uid_count; -u8 maj_rev; -u8 min_rev; -};struct xhci_port {__le32 __iomem *addr;int hw_portnum;int hcd_portnum;struct xhci_hub *rhub; -struct xhci_port_cap *port_cap; };struct xhci_hub {
@@ -1727,6 +1719,9 @@ struct xhci_hub {/* supported prococol extended capabiliy values */ u8 maj_rev;u8 min_rev; +u32 *psi;/* array of protocol speed ID entries */ +u8 psi_count; +u8 psi_uid_count; };/* There is one xhci_hcd structure per controller */
@@ -1885,9 +1880,6 @@ struct xhci_hcd {/* cached usb2 extened protocol capabilites */ u32 *ext_caps;unsigned int num_ext_caps; -/* cached extended protocol port capabilities */ -struct xhci_port_cap *port_caps; -unsigned int num_port_caps;/* Compliance Mode Recovery Data */ struct timer_list comp_mode_recovery_timer;u32 port_status_u0;
Signature · 1 line
2.25.0