From patchwork Thu Apr 4 12:11:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathias Nyman X-Patchwork-Id: 786451 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA04185279; Thu, 4 Apr 2024 12:09:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712232565; cv=none; b=SK4JGtJ2zwJBwM1UYRNbv4xoqoACvcSHG997ykRLQTLHMyyXCWqzYwe1d+/IJHN18nuxNyr/rvaApes2RUFqIhZxCn/2/e5Ihz/ydtoAzQXge4q34RViNcYjVw4LiHqWwO+w8ARR7DmqjaRMK6BQtNbvMKUOTZM+OnteBXdo5OM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712232565; c=relaxed/simple; bh=S2N3uB7P/OzEiBwNbUDT5i7k1PICI8SjBF1ZYyxVtaM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IQ3PjaEgbTwQtPYeebHtDTmF3lNqpwi/ghwYs5vN7YZIJF72DEoRDaSgqdUGY/PxCxhRE++S7muMNgU8sV8CqmfTZSDyhOZYJr9GBwnlphEKdCBGPIyljQPFtrPk4C4H62gZCmWrdYoPTO8Jcvbmgam5ksBJfqplhX8qCorNOVw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Z+PcCasG; arc=none smtp.client-ip=192.198.163.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Z+PcCasG" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1712232564; x=1743768564; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=S2N3uB7P/OzEiBwNbUDT5i7k1PICI8SjBF1ZYyxVtaM=; b=Z+PcCasGeRSFrVad4VcoftFMg0eqIBAMNRgQjQVwk9eQUvkBFXiBTq09 kasBnjHb3DbFwrCS/w3rPyODXmJI298Ui1Q4Y0mSp7KzygzKbdf/8tsr/ UevpztE3XADUGUIx6+74jPu/iks5+I+1huV4S9Lbv1B13c2lqlyBu22E3 8YxlgOYM1QNG8fcEbmFX1V4wZ7xeyIX/v8gFX+LX6/mZtGczjglHUkXbU wy0tphH3v6Td1dtug+ebB5lOmDj1CI7mJEyFkrqdEUsLvijuycbjKraAI rWRd4u95NEmLsT9S4J0hJBVmhKRyzbmZPZbZC14SeU6vtE037BXRGhb92 w==; X-CSE-ConnectionGUID: 1KjmZ3VuTLaR5elcyvojnw== X-CSE-MsgGUID: gCEHk9u3QwyG6SQXv2/2mg== X-IronPort-AV: E=McAfee;i="6600,9927,11033"; a="18240638" X-IronPort-AV: E=Sophos;i="6.07,179,1708416000"; d="scan'208";a="18240638" Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmvoesa103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Apr 2024 05:09:23 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,11033"; a="937086424" X-IronPort-AV: E=Sophos;i="6.07,179,1708416000"; d="scan'208";a="937086424" Received: from mattu-haswell.fi.intel.com ([10.237.72.199]) by fmsmga001.fm.intel.com with ESMTP; 04 Apr 2024 05:09:21 -0700 From: Mathias Nyman To: Cc: , niklas.neronin@intel.com, Thinh.Nguyen@synopsys.com, Oliver Neukum , stable@vger.kernel.org, Mathias Nyman Subject: [PATCH 1/2] usb: xhci: correct return value in case of STS_HCE Date: Thu, 4 Apr 2024 15:11:05 +0300 Message-Id: <20240404121106.2842417-2-mathias.nyman@linux.intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240404121106.2842417-1-mathias.nyman@linux.intel.com> References: <20240404121106.2842417-1-mathias.nyman@linux.intel.com> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Oliver Neukum If we get STS_HCE we give up on the interrupt, but for the purpose of IRQ handling that still counts as ours. We may return IRQ_NONE only if we are positive that it wasn't ours. Hence correct the default. Fixes: 2a25e66d676d ("xhci: print warning when HCE was set") Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Oliver Neukum Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci-ring.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 52278afea94b..575f0fd9c9f1 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3133,7 +3133,7 @@ static int xhci_handle_events(struct xhci_hcd *xhci, struct xhci_interrupter *ir irqreturn_t xhci_irq(struct usb_hcd *hcd) { struct xhci_hcd *xhci = hcd_to_xhci(hcd); - irqreturn_t ret = IRQ_NONE; + irqreturn_t ret = IRQ_HANDLED; u32 status; spin_lock(&xhci->lock); @@ -3141,12 +3141,13 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) status = readl(&xhci->op_regs->status); if (status == ~(u32)0) { xhci_hc_died(xhci); - ret = IRQ_HANDLED; goto out; } - if (!(status & STS_EINT)) + if (!(status & STS_EINT)) { + ret = IRQ_NONE; goto out; + } if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); @@ -3156,7 +3157,6 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_FATAL) { xhci_warn(xhci, "WARNING: Host System Error\n"); xhci_halt(xhci); - ret = IRQ_HANDLED; goto out; } @@ -3167,7 +3167,6 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) */ status |= STS_EINT; writel(status, &xhci->op_regs->status); - ret = IRQ_HANDLED; /* This is the handler of the primary interrupter */ xhci_handle_events(xhci, xhci->interrupters[0]); From patchwork Thu Apr 4 12:11:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathias Nyman X-Patchwork-Id: 786165 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D349284D35 for ; Thu, 4 Apr 2024 12:09:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712232567; cv=none; b=aekDq0rsFad4L6lUEJ3bUAVJurpXLpPgR82ZY2uA6qaftEX57g5JBPAkYHZT9NJh7A0yCErDfF5Ab7iJOngOlzpEiPOHEACKoN0Cd65KRgPKMMQWkLOKqwYlnNGULK0O9D3kPBTsgz/DIYAMyC5PcwuhUzjJMnmcYpuV+9po068= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712232567; c=relaxed/simple; bh=g4d8KzhHonSVDOgQJ7Tbuom6AzzNathrJGIa6HeYMSA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=e30sPbTi4JkMpPWLh/tr+UHBlDAp/PDuUMpeaHX1tZx5WdCq5HMXbb0URoDHjJ/q1CS7F71qcfMI9DuSAurcmPA8IGug9gqJHxs3dS7OVdN+kI3UR9KR3mjm5CZ2UdemhQXs03a6g6MciUas9PQ/WSgSvN0t2IhTTdQdgMaJ9ug= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=WrM1UpFp; arc=none smtp.client-ip=192.198.163.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="WrM1UpFp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1712232565; x=1743768565; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=g4d8KzhHonSVDOgQJ7Tbuom6AzzNathrJGIa6HeYMSA=; b=WrM1UpFp/8EL8BzAB5/ArN/9VUCyTkQAG2ezxlt4XWMLkhPgy6I8+kMY QLLeVfzOqZfGf/WP5OLGuO2fa3QQ04hkB5f2M5+a5B33zKE9ingGg6s9I u94sZ7+3GE/qb5WcrpIAtLwP/mM/RgvEHz+Ad3/diP82DyYTD8RiRAniV M2Z6lXmPM29wRBOz/v09H/lR9/jb97cOfSXRo8FtT/yYS5kO3FpJethXW /9zVovnEZTdiuKU5t3iHlP3R6FUTDU+kUAM0R65qkk0QBM6+AIbj0cDT9 1EcWBo0ymTOH7wUNOt+OGqifpvVO6YcQF0sjC/DrtozNtIDgtN7gaOUNg A==; X-CSE-ConnectionGUID: dWKvarxxTBq9ZJeLSp0tqA== X-CSE-MsgGUID: TNVcEg7TS5KlCqqmaA9YwA== X-IronPort-AV: E=McAfee;i="6600,9927,11033"; a="18240651" X-IronPort-AV: E=Sophos;i="6.07,179,1708416000"; d="scan'208";a="18240651" Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmvoesa103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Apr 2024 05:09:25 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,11033"; a="937086427" X-IronPort-AV: E=Sophos;i="6.07,179,1708416000"; d="scan'208";a="937086427" Received: from mattu-haswell.fi.intel.com ([10.237.72.199]) by fmsmga001.fm.intel.com with ESMTP; 04 Apr 2024 05:09:23 -0700 From: Mathias Nyman To: Cc: , niklas.neronin@intel.com, Thinh.Nguyen@synopsys.com, Mathias Nyman Subject: [PATCH 2/2] xhci: Fix root hub port null pointer dereference in xhci tracepoints Date: Thu, 4 Apr 2024 15:11:06 +0300 Message-Id: <20240404121106.2842417-3-mathias.nyman@linux.intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240404121106.2842417-1-mathias.nyman@linux.intel.com> References: <20240404121106.2842417-1-mathias.nyman@linux.intel.com> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The pointer from a xhci usb virt device to its root hub port (vdev->rhub_port) is set later when device is addressed, not while vdev is allocated. Tracepoints dereferenced this rhub_port pointer when freeing the virt device, which causes null pointer dereference if tracing is enabled and device is freed before addressed. This can happen if tracing is enabled and xhci driver is unloaded before a device is fully enumerated, or initial enumeration fails and device is reset and freed before retry. Don't dereference the rhub_port or show port numbers when tracing xhci_free_virt_device(). This info is not very useful anyway. Print the more useful slot id instead Fixes: 06790c19086f ("xhci: replace real & fake port with pointer to root hub port") Reported-by: Thinh Nguyen Closes: https://lore.kernel.org/linux-usb/20240402005007.klv2ij727fkz7rpd@synopsys.com/ Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci-trace.h | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h index 1740000d54c2..5762564b9d73 100644 --- a/drivers/usb/host/xhci-trace.h +++ b/drivers/usb/host/xhci-trace.h @@ -172,8 +172,7 @@ DECLARE_EVENT_CLASS(xhci_log_free_virt_dev, __field(void *, vdev) __field(unsigned long long, out_ctx) __field(unsigned long long, in_ctx) - __field(int, hcd_portnum) - __field(int, hw_portnum) + __field(int, slot_id) __field(u16, current_mel) ), @@ -181,13 +180,12 @@ DECLARE_EVENT_CLASS(xhci_log_free_virt_dev, __entry->vdev = vdev; __entry->in_ctx = (unsigned long long) vdev->in_ctx->dma; __entry->out_ctx = (unsigned long long) vdev->out_ctx->dma; - __entry->hcd_portnum = (int) vdev->rhub_port->hcd_portnum; - __entry->hw_portnum = (int) vdev->rhub_port->hw_portnum; + __entry->slot_id = (int) vdev->slot_id; __entry->current_mel = (u16) vdev->current_mel; ), - TP_printk("vdev %p ctx %llx | %llx hcd_portnum %d hw_portnum %d current_mel %d", - __entry->vdev, __entry->in_ctx, __entry->out_ctx, - __entry->hcd_portnum, __entry->hw_portnum, __entry->current_mel + TP_printk("vdev %p slot %d ctx %llx | %llx current_mel %d", + __entry->vdev, __entry->slot_id, __entry->in_ctx, + __entry->out_ctx, __entry->current_mel ) );