lkml.org 
[lkml]   [2021]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 12/50] xhci: guard accesses to ep_state in xhci_endpoint_reset()
    Date
    From: Jonathan Bell <jonathan@raspberrypi.com>

    commit a01ba2a3378be85538e0183ae5367c1bc1d5aaf3 upstream.

    See https://github.com/raspberrypi/linux/issues/3981

    Two read-modify-write cycles on ep->ep_state are not guarded by
    xhci->lock. Fix these.

    Fixes: f5249461b504 ("xhci: Clear the host side toggle manually when endpoint is soft reset")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://lore.kernel.org/r/20211008092547.3996295-2-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/host/xhci.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/drivers/usb/host/xhci.c
    +++ b/drivers/usb/host/xhci.c
    @@ -3093,10 +3093,13 @@ static void xhci_endpoint_reset(struct u
    ep = &vdev->eps[ep_index];

    /* Bail out if toggle is already being cleared by a endpoint reset */
    + spin_lock_irqsave(&xhci->lock, flags);
    if (ep->ep_state & EP_HARD_CLEAR_TOGGLE) {
    ep->ep_state &= ~EP_HARD_CLEAR_TOGGLE;
    + spin_unlock_irqrestore(&xhci->lock, flags);
    return;
    }
    + spin_unlock_irqrestore(&xhci->lock, flags);
    /* Only interrupt and bulk ep's use data toggle, USB2 spec 5.5.4-> */
    if (usb_endpoint_xfer_control(&host_ep->desc) ||
    usb_endpoint_xfer_isoc(&host_ep->desc))
    @@ -3182,8 +3185,10 @@ static void xhci_endpoint_reset(struct u
    xhci_free_command(xhci, cfg_cmd);
    cleanup:
    xhci_free_command(xhci, stop_cmd);
    + spin_lock_irqsave(&xhci->lock, flags);
    if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE)
    ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
    + spin_unlock_irqrestore(&xhci->lock, flags);
    }

    static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,

    \
     
     \ /
      Last update: 2021-10-18 15:40    [W:2.337 / U:0.384 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site