diff mbox series

[1/1] xhci: Fix null pointer dereference during S4 resume when resetting ep0

Message ID 20231215125707.1732989-2-mathias.nyman@linux.intel.com
State New
Headers show
Series xhci feature-fix for usb-next | expand

Commit Message

Mathias Nyman Dec. 15, 2023, 12:57 p.m. UTC 
During device enumeration usb core resets endpoint 0 if the max packet
size value differs from the one read from the device descriptor.

usb core will additionally reset endpoint 0 during S4 resume, before
re-enumerating the device, if the device has a reset-resume flag set.

In this case the xhci device representation vdev may be lost due to
xHC restore error and re-initialization during S4 resume.

Make sure slot_id and vdev are valid before trying to re-configure max
packet size during endpoint 0 reset.
max packet size will be re-configured later during re-enumeration.

This fixes commit e34900f46cd6 ("xhci: Reconfigure endpoint 0 max packet
size only during endpoint reset") which is currently in usb-next,
on its way to 6.7

Fixes: e34900f46cd6 ("xhci: Reconfigure endpoint 0 max packet size only during endpoint reset")
Tested-by: Wendy Wang <wendy.wang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

Comments

Greg Kroah-Hartman Dec. 15, 2023, 5:27 p.m. UTC | #1 
On Fri, Dec 15, 2023 at 02:57:07PM +0200, Mathias Nyman wrote:
> During device enumeration usb core resets endpoint 0 if the max packet
> size value differs from the one read from the device descriptor.
> 
> usb core will additionally reset endpoint 0 during S4 resume, before
> re-enumerating the device, if the device has a reset-resume flag set.
> 
> In this case the xhci device representation vdev may be lost due to
> xHC restore error and re-initialization during S4 resume.
> 
> Make sure slot_id and vdev are valid before trying to re-configure max
> packet size during endpoint 0 reset.
> max packet size will be re-configured later during re-enumeration.
> 
> This fixes commit e34900f46cd6 ("xhci: Reconfigure endpoint 0 max packet
> size only during endpoint reset") which is currently in usb-next,
> on its way to 6.7

You mean "6.8" here, right?

thanks,

greg k-h
diff mbox series

Patch

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f62b4b252192..ff38c8badbcc 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3133,6 +3133,9 @@  static void xhci_endpoint_disable(struct usb_hcd *hcd,
  * of an endpoint that isn't in the halted state this function will issue a
  * configure endpoint command with the Drop and Add bits set for the target
  * endpoint. Refer to the additional note in xhci spcification section 4.6.8.
+ *
+ * vdev may be lost due to xHC restore error and re-initialization during S3/S4
+ * resume. A new vdev will be allocated later by xhci_discover_or_reset_device()
  */
 
 static void xhci_endpoint_reset(struct usb_hcd *hcd,
@@ -3158,9 +3161,17 @@  static void xhci_endpoint_reset(struct usb_hcd *hcd,
 	 * mismatch. Reconfigure the xhci ep0 endpoint context here in that case
 	 */
 	if (usb_endpoint_xfer_control(&host_ep->desc) && ep_index == 0) {
+
 		udev = container_of(host_ep, struct usb_device, ep0);
-		if (udev->speed == USB_SPEED_FULL)
-			xhci_check_ep0_maxpacket(xhci, xhci->devs[udev->slot_id]);
+		if (udev->speed != USB_SPEED_FULL || !udev->slot_id)
+			return;
+
+		vdev = xhci->devs[udev->slot_id];
+		if (!vdev || vdev->udev != udev)
+			return;
+
+		xhci_check_ep0_maxpacket(xhci, vdev);
+
 		/* Nothing else should be done here for ep0 during ep reset */
 		return;
 	}
@@ -3171,11 +3182,6 @@  static void xhci_endpoint_reset(struct usb_hcd *hcd,
 	udev = (struct usb_device *) host_ep->hcpriv;
 	vdev = xhci->devs[udev->slot_id];
 
-	/*
-	 * vdev may be lost due to xHC restore error and re-initialization
-	 * during S3/S4 resume. A new vdev will be allocated later by
-	 * xhci_discover_or_reset_device()
-	 */
 	if (!udev->slot_id || !vdev)
 		return;