[5.7,332/393] usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint

From: Peter Chen <peter.chen@nxp.com>

From: Peter Chen <peter.chen@nxp.com>

commit 95f5acfc4f58f01a22b66d8c9c0ffb72aa96271c upstream.

During the endpoint dequeue operation, it changes dequeued TRB as link
TRB, when the endpoint is disabled and re-enabled, the DMA fetches the
TRB before the link TRB, after it handles current TRB, the DMA pointer
will advance to the TRB after link TRB, but enqueue and dequene
variables don't know it due to no hardware interrupt at the time, when
the next TRB is added to link TRB position, the DMA will not handle
this TRB due to its pointer is already at the next TRB. See the trace
log like below:

file-storage-675   [001] d..1    86.585657: usb_ep_queue: ep0: req 00000000df9b3a4f length 0/0 sgs 0/0 stream 0 zsI status 0 --> 0
file-storage-675   [001] d..1    86.585663: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr (null)], flags:0 SID: 0
file-storage-675   [001] d..1    86.585671: cdns3_prepare_trb: ep1out: trb 000000007f770303, dma buf: 0xbd195800, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
file-storage-675   [001] d..1    86.585676: cdns3_ring:
            Ring contents for ep1out:
            Ring deq index: 0, trb: 000000007f770303 (virt), 0xc4003000 (dma)
            Ring enq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
            free trbs: 38, CCS=1, PCS=1
            @0x00000000c4003000 bd195800 80020400 00000425
            @0x00000000c400300c c4003018 80020400 00001811
            @0x00000000c4003018 bcfcc000 0000001f 00000426
            @0x00000000c4003024 bcfce800 0000001f 00000426

	    ...

 irq/144-5b13000-698   [000] d...    87.619286: usb_gadget_giveback_request: ep1in: req 0000000031b832eb length 13/13 sgs 0/0 stream 0 zsI status 0 --> 0
    file-storage-675   [001] d..1    87.619287: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr 0x80020400c400300c], flags:0 SID: 0
    file-storage-675   [001] d..1    87.619294: cdns3_prepare_trb: ep1out: trb 0000000049c1ba21, dma buf: 0xbd198000, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
    file-storage-675   [001] d..1    87.619297: cdns3_ring:
                Ring contents for ep1out:
                Ring deq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
                Ring enq index: 2, trb: 0000000059b34b67 (virt), 0xc4003018 (dma)
                free trbs: 38, CCS=1, PCS=1
                @0x00000000c4003000 bd195800 0000001f 00000427
                @0x00000000c400300c bd198000 80020400 00000425
                @0x00000000c4003018 bcfcc000 0000001f 00000426
                @0x00000000c4003024 bcfce800 0000001f 00000426
		...

    file-storage-675   [001] d..1    87.619305: cdns3_doorbell_epx: ep1out, ep_trbaddr c4003018
    file-storage-675   [001] ....    87.619308: usb_ep_queue: ep1out: req 000000002ebce364 length 0/1024 sgs 0/0 stream 0 zsI status -115 --> 0
 irq/144-5b13000-698   [000] d..1    87.619315: cdns3_epx_irq: IRQ for ep1out: 01000c80 TRBERR , ep_traddr: c4003018 ep_last_sid: 00000000 use_streams: 0
 irq/144-5b13000-698   [000] d..1    87.619395: cdns3_usb_irq: IRQ 00000008 = Hot Reset

Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/cdns3/gadget.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20200817143835.702004847@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=5nKa=B3=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Peter Chen <peter.chen@nxp.com>, Felipe Balbi <balbi@kernel.org> Subject: [PATCH 5.7 332/393] usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint Date: Mon, 17 Aug 2020 17:16:22 +0200 Message-Id: <20200817143835.702004847@linuxfoundation.org> In-Reply-To: <20200817143819.579311991@linuxfoundation.org> References: <20200817143819.579311991@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,003/393] io_uring: abstract out task work running [5.7,005/393] ARM: dts: stm32: fix uart7_pins_a comments in stm32mp15-pinctrl [5.7,008/393] x86, sched: Bail out of frequency invariance if turbo frequency is unknown [5.7,009/393] x86, sched: Bail out of frequency invariance if turbo_freq/base_freq gives 0 [5.7,010/393] sched/fair: Fix NOHZ next idle balance [5.7,011/393] sched: correct SD_flags returned by tl->sd_flags() [5.7,012/393] arm64: dts: rockchip: fix rk3368-lion gmac reset gpio [5.7,013/393] arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio [5.7,014/393] arm64: dts: rockchip: fix rk3399-puma gmac reset gpio [5.7,017/393] arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property [5.7,018/393] memory: tegra: Fix an error handling path in tegra186_emc_probe() [5.7,020/393] crypto: ccree - fix resource leak on error path [5.7,021/393] ARM: exynos: MCPM: Restore big.LITTLE cpuidle support [5.7,022/393] rcu/tree: Repeat the monitor if any free channel is busy [5.7,023/393] firmware: arm_scmi: Fix SCMI genpd domain probing [5.7,024/393] arm64: dts: sun50i-pinephone: dldo4 must not be >= 1.8V [5.7,026/393] sched/uclamp: Fix initialization of struct uclamp_rq [5.7,027/393] crypto: qat - allow xts requests not multiple of block [5.7,028/393] clk: scmi: Fix min and max rate when registering clocks with discrete rates [5.7,032/393] platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() [5.7,034/393] arm64: dts: renesas: Fix SD Card/eMMC interface device node names [5.7,035/393] ARM: dts: gose: Fix ports node name for adv7612 [5.7,037/393] ARM: dts: exynos: Disable frequency scaling for FSYS bus on Odroid XU3 family [5.7,040/393] ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages [5.7,042/393] tpm: Require that all digests are present in TCG_PCR_EVENT2 structures [5.7,043/393] recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64. [5.7,048/393] spi: rockchip: Fix error in SPI slave pio read [5.7,050/393] iocost: Fix check condition of iocg abs_vdebt [5.7,051/393] scripts/selinux/mdp: fix initial SID handling [5.7,053/393] seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID [5.7,054/393] md: raid0/linear: fix dereference before null check on pointer mddev [5.7,055/393] irqchip/loongson-liointc: Fix potential dead lock [5.7,056/393] irqchip/irq-bcm7038-l1: Guard uses of cpu_logical_map [5.7,060/393] nvme-multipath: fix logic for non-optimized paths [5.7,061/393] nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths [5.7,062/393] block: dont do revalidate zones on invalid devices [5.7,066/393] ARM: exynos: clear L310_AUX_CTRL_FULL_LINE_ZERO in default l2c_aux_val [5.7,067/393] Bluetooth: add a mutex lock to avoid UAF in do_enale_set [5.7,068/393] loop: be paranoid on exit and prevent new additions / removals [5.7,069/393] io_uring: fix req->work corruption [5.7,070/393] fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls [5.7,075/393] video: fbdev: neofb: fix memory leak in neo_scan_monitor() [5.7,078/393] drm/nouveau/kms/nv50-: Fix disabling dithering [5.7,079/393] arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding [5.7,080/393] drm/etnaviv: fix ref count leak via pm_runtime_get_sync [5.7,082/393] drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek [5.7,084/393] mmc: sdhci-cadence: do not use hardware tuning for SD mode [5.7,085/393] btrfs: fix lockdep splat from btrfs_dump_space_info [5.7,087/393] drm: msm: a6xx: fix gpu failure after system resume [5.7,091/393] net: phy: mscc: restore the base page in vsc8514/8584_config_init [5.7,093/393] mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls [5.7,095/393] drm/amdgpu/display bail early in dm_pp_get_static_clocks [5.7,100/393] brcmfmac: keep SDIO watchdog running when console_interval is non-zero [5.7,101/393] brcmfmac: To fix Bss Info flag definition Bug [5.7,103/393] platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15 [5.7,104/393] iwlegacy: Check the return value of pcie_capability_read_*() [5.7,106/393] drm/amd/powerplay: suppress compile error around BUG_ON [5.7,108/393] x86/uaccess: Make __get_user_size() Clang compliant on 32-bit [5.7,109/393] mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1 [5.7,110/393] usb: gadget: net2280: fix memory leak on probe error handling paths [5.7,112/393] usb: bdc: Halt controller on suspend [5.7,113/393] dyndbg: fix a BUG_ON in ddebug_describe_flags [5.7,117/393] ACPICA: Do not increment operation_region reference counts for field units [5.7,118/393] io_uring: fix racy overflow count reporting [5.7,122/393] drm/gem: Fix a leak in drm_gem_objects_lookup() [5.7,124/393] drm/bridge: ti-sn65dsi86: Fix off-by-one error in clock choice [5.7,125/393] drm/amdgpu: use the unlocked drm_gem_object_put [5.7,129/393] btmrvl: Fix firmware filename for sd8977 chipset [5.7,130/393] btmrvl: Fix firmware filename for sd8997 chipset [5.7,132/393] console: newport_con: fix an issue about leak related system resources [5.7,135/393] Bluetooth: hci_qca: Only remove TX clock vote after TX is completed [5.7,138/393] Bluetooth: hci_qca: Bug fix during SSR timeout [5.7,139/393] Bluetooth: hci_qca: Increase SoC idle timeout to 200ms [5.7,142/393] scsi: ufs: Fix imprecise load calculation in devfreq window [5.7,143/393] drm/etnaviv: Fix error path on failure to enable bus clk [5.7,146/393] clk: bcm63xx-gate: fix last clock availability [5.7,148/393] powerpc/fixmap: Fix FIX_EARLY_DEBUG_BASE when page size is 256k [5.7,149/393] leds: lm355x: avoid enum conversion warning [5.7,151/393] Bluetooth: btmtksdio: fix up firmware download sequence [5.7,152/393] media: cxusb-analog: fix V4L2 dependency [5.7,153/393] media: marvell-ccic: Add missed v4l2_async_notifier_cleanup() [5.7,154/393] media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() [5.7,155/393] staging: most: avoid null pointer dereference when iface is null [5.7,158/393] ASoC: Intel: cml_rt1011_rt5682: add missing .owner field [5.7,160/393] ASoC: Intel: bxt_rt298: add missing .owner field [5.7,161/393] net: atlantic: MACSec offload statistics checkpatch fix [5.7,163/393] drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline [5.7,164/393] cxl: Fix kobject memleak [5.7,165/393] lkdtm: Avoid more compiler optimizations for bad writes [5.7,168/393] net: ethernet: ti: am65-cpsw-nuss: restore vlan configuration while down/up [5.7,172/393] staging: vchiq_arm: Add a matching unregister call [5.7,174/393] iavf: Fix updating statistics [5.7,175/393] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() [5.7,176/393] scsi: powertec: Fix different dev_id between request_irq() and free_irq() [5.7,178/393] ipvs: allow connection reuse for unconfirmed conntrack [5.7,181/393] media: staging: rkisp1: rsz: supported formats are the isps src formats, not sink f... [5.7,183/393] media: tvp5150: Add missed media_entity_cleanup() [5.7,184/393] media: exynos4-is: Add missed check for pinctrl_lookup_state() [5.7,186/393] xfs: dont eat an EIO/ENOSPC writeback error when scrubbing data fork [5.7,188/393] iomap: Make sure iomap_end is called after iomap_begin [5.7,189/393] RDMA/rxe: Skip dgid check in loopback mode [5.7,195/393] drm: panel: simple: Fix bpc for LG LB070WV8 panel [5.7,196/393] phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY [5.7,198/393] drm/bridge: sil_sii8620: initialize return of sii8620_readb [5.7,199/393] scsi: scsi_debug: Add check for sdebug_max_queue during module init [5.7,200/393] mwifiex: Prevent memory corruption handling keys [5.7,201/393] kernfs: do not call fsnotify() with name without a parent [5.7,204/393] powerpc/vdso: Fix vdso cpu truncation [5.7,207/393] ima: Have the LSM free its audit rule [5.7,210/393] ima: Fail rule parsing when buffer hook functions have an invalid action [5.7,212/393] ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond [5.7,214/393] ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback [5.7,215/393] PCI/ASPM: Add missing newline in sysfs policy [5.7,217/393] media: s5p-g2d: Fix a memory leak in an error handling path in g2d_probe() [5.7,218/393] phy: renesas: rcar-gen3-usb2: move irq registration to init [5.7,222/393] gpu: ipu-v3: Restore RGB32, BGR32 [5.7,223/393] spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM [5.7,224/393] USB: serial: iuu_phoenix: fix led-activity helpers [5.7,225/393] clk: qcom: gcc: Make disp gpll0 branch aon for sc7180/sdm845 [5.7,227/393] thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() [5.7,228/393] coresight: etmv4: Fix resource selector constant [5.7,229/393] coresight: etmv4: Counter values not saved on disable [5.7,231/393] coresight: etm4x: Fix save/restore during cpu idle [5.7,232/393] powerpc/perf: Fix missing is_sier_aviable() during build [5.7,233/393] mt76: mt7615: fix potential memory leak in mcu message handler [5.7,235/393] phy: armada-38x: fix NETA lockup when repeatedly switching speeds [5.7,237/393] s390/bpf: Use brcl for jumping to exit_ip if necessary [5.7,239/393] tools/bpftool: Fix error handing in do_skeleton() [5.7,240/393] ASoC: tas2770: Fix reset gpio property name [5.7,241/393] ASoC: hdac_hda: fix deadlock after PCM open error [5.7,244/393] usb: dwc2: Fix error path in gadget registration [5.7,246/393] scsi: megaraid_sas: Clear affinity hint [5.7,248/393] net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration [5.7,250/393] PCI: cadence: Fix cdns_pcie_{host\|ep}_setup() error path [5.7,251/393] PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register [5.7,253/393] Smack: fix another vsscanf out of bounds [5.7,256/393] Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers [5.7,259/393] Bluetooth: Fix suspend notifier race [5.7,260/393] Bluetooth: hci_qca: Stop collecting memdump again for command timeout during SSR [5.7,261/393] net: dsa: rtl8366: Fix VLAN semantics [5.7,262/393] net: dsa: rtl8366: Fix VLAN set-up [5.7,265/393] selftests/powerpc: Squash spurious errors due to device removal [5.7,266/393] powerpc/32s: Fix CONFIG_BOOK3S_601 uses [5.7,268/393] selftests/powerpc: Fix CPU affinity for child process [5.7,271/393] PCI: Release IVRS table in AMD ACS quirk [5.7,273/393] powerpc/pseries/hotplug-cpu: Remove double free in error path [5.7,274/393] selftests/powerpc: Fix online CPU selection [5.7,275/393] ASoC: meson: axg-tdm-interface: fix link fmt setup [5.7,276/393] ASoC: meson: axg-tdmin: fix g12a skew [5.7,277/393] ASoC: meson: axg-tdm-formatters: fix sclk inversion [5.7,278/393] ASoC: soc-core: Fix regression causing sysfs entries to disappear [5.7,280/393] ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK [5.7,282/393] s390/qeth: dont process empty bridge port events [5.7,283/393] ice: Clear and free XLT entries on reset [5.7,285/393] netfilter: nft_meta: fix iifgroup matching [5.7,287/393] rtw88: fix short GI capability based on current bandwidth [5.7,288/393] rtw88: coex: only skip coex triggered by BT info [5.7,289/393] qtnfmac: Missing platform_device_unregister() on error in qtnf_core_mac_alloc() [5.7,291/393] tools, build: Propagate build failures from tools/build/Makefile.build [5.7,292/393] tools, bpftool: Fix wrong return value in do_dump() [5.7,294/393] net/mlx5: Delete extra dump stack that gives nothing [5.7,295/393] ftrace: Fix ftrace_trace_task return value [5.7,299/393] net: spider_net: Fix the size used in a dma_free_coherent() call [5.7,302/393] fsl/fman: fix unreachable code [5.7,304/393] fsl/fman: fix eth hash table allocation [5.7,305/393] gpio: dont use same lockdep class for all devm_gpiochip_add_data users [5.7,307/393] media: mtk-mdp: Fix a refcounting bug on error in init [5.7,309/393] ocfs2: fix unbalanced locking [5.7,313/393] nfsd: avoid a NULL dereference in __cld_pipe_upcall() [5.7,314/393] SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") [5.7,316/393] crypto: aesni - add compatibility with IAS [5.7,321/393] net: phy: fix memory leak in device-create error path [5.7,322/393] net: Set fput_needed iff FDPUT_FPUT is set [5.7,323/393] net/tls: Fix kmap usage [5.7,327/393] net: initialize fastreuse on inet_inherit_port [5.7,329/393] net: phy: marvell10g: fix null pointer dereference [5.7,331/393] USB: serial: cp210x: enable usb generic throttle/unthrottle [5.7,332/393] usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint [5.7,334/393] ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO [5.7,336/393] ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 [5.7,340/393] pstore: Fix linking when crypto API disabled [5.7,341/393] crypto: hisilicon - dont sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified [5.7,342/393] crypto: qat - fix double free in qat_uclo_create_batch_init_list [5.7,344/393] crypto: cpt - dont sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified [5.7,348/393] fs/minix: dont allow getting deleted inodes [5.7,350/393] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on the host [5.7,352/393] driver core: Fix probe_count imbalance in really_probe() [5.7,353/393] media: media-request: Fix crash if memory allocation fails [5.7,354/393] drm/ttm/nouveau: dont call tt destroy callback on alloc failure. [5.7,355/393] io_uring: set ctx sq/cq entry count earlier [5.7,356/393] io_uring: use TWA_SIGNAL for task_work uncondtionally [5.7,359/393] NFS: Dont return layout segments that are in use [5.7,360/393] cpufreq: Fix locking issues with governors [5.7,361/393] cpufreq: dt: fix oops on armada37xx [5.7,364/393] PM / devfreq: Fix indentaion of devfreq_summary debugfs node [5.7,365/393] spi: spidev: Align buffers for DMA [5.7,366/393] mtd: rawnand: qcom: avoid write to unavailable register [5.7,368/393] erofs: fix extended inode could cross boundary [5.7,370/393] Revert "parisc: Drop LDCW barrier in CAS code when running UP" [5.7,373/393] parisc: Do not use an ordered store in pa_tlb_lock() [5.7,375/393] parisc: mask out enable and reserved bits from sba imask [5.7,376/393] ARM: dts: exynos: Extend all Exynos5800 A15s OPPs with max voltage data [5.7,378/393] firmware: qcom_scm: Fix legacy convention SCM accessors [5.7,379/393] irqdomain/treewide: Free firmware node after domain removal [5.7,385/393] s390/dasd: fix inability to use DASD with DIAG driver [5.7,386/393] s390/numa: set node distance to LOCAL_DISTANCE [5.7,390/393] task_work: only grab task signal lock when needed [5.7,392/393] io_uring: enable lookup of links holding inflight files [5.7,393/393] io_uring: hold ctx reference around task_work queue + execute

[5.7,332/393] usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint

Commit Message

Patch