[5.10,118/167] xhci: Fix lost USB 2 remote wake

Message ID	20210726153843.364980828@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Mathias Nyman <mathias.nyman@linux.intel.com> Subject: [PATCH 5.10 118/167] xhci: Fix lost USB 2 remote wake Date: Mon, 26 Jul 2021 17:39:11 +0200 Message-Id: <20210726153843.364980828@linuxfoundation.org> In-Reply-To: <20210726153839.371771838@linuxfoundation.org> References: <20210726153839.371771838@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,003/167] igc: change default return of igc_read_phy_reg() [5.10,006/167] igb: Fix an error handling path in igb_probe() [5.10,008/167] e1000e: Fix an error handling path in e1000_probe() [5.10,011/167] igb: Fix position of assignment to *ring [5.10,013/167] net: add kcov handle to skb extensions [5.10,014/167] net: Introduce preferred busy-polling [5.10,017/167] ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmd... [5.10,018/167] bonding: fix suspicious RCU usage in bond_ipsec_del_sa() [5.10,020/167] bonding: Add struct bond_ipesc to manage SA [5.10,022/167] bonding: fix incorrect return value of bond_ipsec_offload_ok() [5.10,024/167] stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() [5.10,027/167] pwm: sprd: Ensure configuring period and duty_cycle isnt wrongly skipped [5.10,028/167] cxgb4: fix IRQ free race during driver unload [5.10,032/167] KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM [5.10,034/167] perf map: Fix dso->nsinfo refcounting [5.10,035/167] perf probe: Fix dso->nsinfo refcounting [5.10,037/167] perf test session_topology: Delete session->evlist [5.10,039/167] perf dso: Fix memory leak in dso__new_map() [5.10,040/167] perf test maps__merge_in: Fix memory leak of maps [5.10,042/167] perf report: Free generated help strings for sort option [5.10,044/167] perf lzma: Close lzma stream on exit [5.10,046/167] perf data: Close all files in close_dir() [5.10,048/167] ASoC: wm_adsp: Correct wm_coeff_tlv_get handling [5.10,051/167] regulator: hi6421: Use correct variable type for regmap api val argument [5.10,053/167] spi: mediatek: fix fifo rx mode [5.10,055/167] bpf, test: fix NULL pointer dereference on invalid expected_attach_type [5.10,057/167] xdp, net: Fix use-after-free in bpf_xdp_link_release [5.10,059/167] liquidio: Fix unintentional sign extension issue on left shift of u16 [5.10,060/167] s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] [5.10,062/167] bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats [5.10,064/167] bpftool: Check malloc return value in mount_bpffs_for_pin [5.10,068/167] efi/tpm: Differentiate missing and invalid final event log table. [5.10,073/167] sctp: trim optlen when its a huge value in sctp_setsockopt [5.10,074/167] netrom: Decrease sock refcount when sock timers expire [5.10,075/167] scsi: iscsi: Fix iface sysfs attr detection [5.10,078/167] ACPI: Kconfig: Fix table override from built-in initrd [5.10,080/167] bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() [5.10,082/167] bnxt_en: Validate vlan protocol ID on RX packets [5.10,084/167] net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition [5.10,086/167] ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID [5.10,087/167] net: hns3: fix possible mismatches resp of mailbox [5.10,089/167] spi: spi-bcm2835: Fix deadlock [5.10,091/167] ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions [5.10,093/167] nvme-pci: dont WARN_ON in nvme_reset_work if ctrl.state is not RESETTING [5.10,095/167] afs: Fix tracepoint string placement with built-in AFS [5.10,097/167] nvme: set the PRACT bit when using Write Zeroes with T10 PI [5.10,098/167] sctp: update active_key for asoc when old key is being replaced [5.10,099/167] tcp: disable TFO blackhole logic by default [5.10,102/167] drm/panel: raspberrypi-touchscreen: Prevent double-free [5.10,104/167] cifs: fix fallocate when trying to allocate a hole. [5.10,105/167] proc: Avoid mixing integer types in mem_rw() [5.10,107/167] s390/ftrace: fix ftrace_update_ftrace_func implementation [5.10,108/167] s390/boot: fix use of expolines in the DMA code [5.10,109/167] ALSA: usb-audio: Add missing proc text entry for BESPOKEN type [5.10,110/167] ALSA: usb-audio: Add registration quirk for JBL Quantum headsets [5.10,112/167] ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine [5.10,116/167] Revert "usb: renesas-xhci: Fix handling of unknown ROM state" [5.10,117/167] usb: xhci: avoid renesas_usb_fw.mem when its unusable [5.10,118/167] xhci: Fix lost USB 2 remote wake [5.10,120/167] KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state [5.10,123/167] USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS [5.10,126/167] USB: serial: option: add support for u-blox LARA-R6 family [5.10,127/167] USB: serial: cp210x: fix comments for GE CS1000 [5.10,130/167] usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode. [5.10,132/167] usb: typec: stusb160x: register role switch before interrupt registration [5.10,134/167] tracepoints: Update static_call before tp_funcs when adding a tracepoint [5.10,135/167] tracing/histogram: Rename "cpu" to "common_cpu" [5.10,136/167] tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. [5.10,139/167] media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() [5.10,141/167] bus: mhi: core: Validate channel ID when processing command completions [5.10,145/167] io_uring: remove double poll entry on arm failure [5.10,147/167] memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions [5.10,148/167] hugetlbfs: fix mount mode command line processing [5.10,150/167] rbd: always kick acquire on "acquired" and "released" notifications [5.10,153/167] driver core: Prevent warning when removing a device link from unregistered consumer [5.10,154/167] Revert "drm/i915: Propagate errors on awaiting already signaled fences" [5.10,157/167] net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz [5.10,160/167] bonding: fix build issue [5.10,161/167] skbuff: Release nfct refcount on napi stolen or re-used skbs [5.10,166/167] sfc: ensure correct number of XDP queues [5.10,167/167] xhci: add xhci_get_virt_ep() helper

Message ID

20210726153843.364980828@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org,
	Mathias Nyman <mathias.nyman@linux.intel.com>
Subject: [PATCH 5.10 118/167] xhci: Fix lost USB 2 remote wake
Date: Mon, 26 Jul 2021 17:39:11 +0200
Message-Id: <20210726153843.364980828@linuxfoundation.org>
In-Reply-To: <20210726153839.371771838@linuxfoundation.org>
References: <20210726153839.371771838@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman July 26, 2021, 3:39 p.m. UTC

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit 72f68bf5c756f5ce1139b31daae2684501383ad5 upstream.

There's a small window where a USB 2 remote wake may be left unhandled
due to a race between hub thread and xhci port event interrupt handler.

When the resume event is detected in the xhci interrupt handler it kicks
the hub timer, which should move the port from resume to U0 once resume
has been signalled for long enough.

To keep the hub "thread" running we set a bus_state->resuming_ports flag.
This flag makes sure hub timer function kicks itself.

checking this flag was not properly protected by the spinlock. Flag was
copied to a local variable before lock was taken. The local variable was
then checked later with spinlock held.

If interrupt is handled right after copying the flag to the local variable
we end up stopping the hub thread before it can handle the USB 2 resume.

CPU0					CPU1
(hub thread)				(xhci event handler)

xhci_hub_status_data()
status = bus_state->resuming_ports;
					<Interrupt>
					handle_port_status()
					spin_lock()
					bus_state->resuming_ports = 1
					set_flag(HCD_FLAG_POLL_RH)
					spin_unlock()
spin_lock()
if (!status)
  clear_flag(HCD_FLAG_POLL_RH)
spin_unlock()

Fix this by taking the lock a bit earlier so that it covers
the resuming_ports flag copy in the hub thread

Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210715150651.1996099-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-hub.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1552,11 +1552,12 @@  int xhci_hub_status_data(struct usb_hcd
 	 * Inform the usbcore about resume-in-progress by returning
 	 * a non-zero value even if there are no status changes.
 	 */
+	spin_lock_irqsave(&xhci->lock, flags);
+
 	status = bus_state->resuming_ports;
 
 	mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
 
-	spin_lock_irqsave(&xhci->lock, flags);
 	/* For each port, did anything change?  If so, set that bit in buf. */
 	for (i = 0; i < max_ports; i++) {
 		temp = readl(ports[i]->addr);

[5.10,118/167] xhci: Fix lost USB 2 remote wake

Commit Message

Patch