From patchwork Mon Aug 30 15:13:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Juerg Haefliger X-Patchwork-Id: 1522257 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=WXvSwm3H; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4Gyv4P55JGz9sWd; Tue, 31 Aug 2021 01:14:28 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1mKizM-0004RZ-SR; Mon, 30 Aug 2021 15:14:20 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1mKizA-0004R1-C6 for kernel-team@lists.ubuntu.com; Mon, 30 Aug 2021 15:14:08 +0000 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 3B61C3F31C for ; Mon, 30 Aug 2021 15:14:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1630336448; bh=Wir/Qi7hIH2Ubz4NnB82ldqCQ8KasirIf+flFR/mhgI=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=WXvSwm3H75p5hcG86mSJ/yVD3Dw/efMSQB8Ir6m8Q4l/KX3Qq/V4Jp7IjCl3fluUW lnsH5x35Mhclc97TriaLBMtd2NMJgkXl2eLeja6o8xMwwN29F2rSG2+2Pf2KtDRTg8 U4ozrNhT20bfdMfzVSJpBhSx+w40/GSol99s3gbP9WzWx0qgiqDkugyfQeDE1o5Xks kEMzuGbTu4BA4mEFHSzdMzDJU2/qSO6FKn2asbySy+Gh6BOA8vsoFiONa33va6siST zMTTu0hBtQtLOiWozz5hzBoEmFgWm6eVjs5WTxKjSCh2dxHCmGaZ5T39BxUBn5gqTr IDmhWsXaVyGrQ== Received: by mail-wm1-f70.google.com with SMTP id x125-20020a1c3183000000b002e73f079eefso8888442wmx.0 for ; Mon, 30 Aug 2021 08:14:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Wir/Qi7hIH2Ubz4NnB82ldqCQ8KasirIf+flFR/mhgI=; b=OcZXSidrxJ7HCJblObjEgPXY2V6nYX5MKhDN6Ci6prkVwfoq/0CL/Ax4TOmRRCLGkh LiGXHLgNI1Z0tOeugrW3PLMeDPjVLZfahq0seIUfPG0qNY64VOqP9bXLljK0DzW1cgxZ tR41tL8Wa871i71HEf4NjJtEZb2mcqRJzKlZeFxC5sHRsQcgqWsLawsExPzCxJJjqKBF od/W5O+VvPCW7vrzj81S7wON11wgAt9j8tdAvc2dD2326V0dWi91UZJZ1Y+eAT/V5fZn AIMf8VwCWPGwNRvkid6u8Zq3jv/WyipROvBdcX7H+epUp9KkrvdJEvzaUBNhcSHOpHw2 3YkQ== X-Gm-Message-State: AOAM531MzC/PUpK/Sgrjtj2vRIiHdrGfb37K5MQeiE3tPWaDNT1nqOhd 6QzBeEE+A/IFjDAO75dlUtlUS8QQ8Atymu8ymypgjSZ4+kIUzrB9TzDGuOx87IaLBWi+hwZfA/P UXm325EZjADTfI/OCzc3UFC0kQkw/7bpQPeFVa+OusQ== X-Received: by 2002:a05:600c:2056:: with SMTP id p22mr22699038wmg.8.1630336447975; Mon, 30 Aug 2021 08:14:07 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy98lkT5JxwARLkr8CP1cHgs96z8GptQPct0FpWYFAczXyDFEfOkB2OcVr6IEC9pmCpjcddhQ== X-Received: by 2002:a05:600c:2056:: with SMTP id p22mr22699025wmg.8.1630336447844; Mon, 30 Aug 2021 08:14:07 -0700 (PDT) Received: from gollum.fritz.box ([194.191.244.86]) by smtp.gmail.com with ESMTPSA id b62sm9188666wmb.17.2021.08.30.08.14.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 30 Aug 2021 08:14:07 -0700 (PDT) From: Juerg Haefliger X-Google-Original-From: Juerg Haefliger To: kernel-team@lists.ubuntu.com Subject: [SRU][I/raspi][PATCH 2/2] xhci: guard accesses to ep_state in xhci_endpoint_reset() Date: Mon, 30 Aug 2021 17:13:34 +0200 Message-Id: <20210830151334.288681-3-juergh@canonical.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210830151334.288681-1-juergh@canonical.com> References: <20210830151334.288681-1-juergh@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jonathan Bell BugLink: https://bugs.launchpad.net/bugs/1930629 See https://github.com/raspberrypi/linux/issues/3981 Two read-modify-write cycles on ep->ep_state are not guarded by xhci->lock. Fix these. Signed-off-by: Jonathan Bell (cherry picked from commit 30cafea2f07dd5d1f550631ee9e60160076ec4fd rpi-5.13.y) Signed-off-by: Juerg Haefliger --- drivers/usb/host/xhci.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index c006fa6f3578..1fdcff4e257e 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3309,10 +3309,13 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd, return; /* Bail out if toggle is already being cleared by a endpoint reset */ + spin_lock_irqsave(&xhci->lock, flags); if (ep->ep_state & EP_HARD_CLEAR_TOGGLE) { ep->ep_state &= ~EP_HARD_CLEAR_TOGGLE; + spin_unlock_irqrestore(&xhci->lock, flags); return; } + spin_unlock_irqrestore(&xhci->lock, flags); /* Only interrupt and bulk ep's use data toggle, USB2 spec 5.5.4-> */ if (usb_endpoint_xfer_control(&host_ep->desc) || usb_endpoint_xfer_isoc(&host_ep->desc)) @@ -3398,8 +3401,10 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd, xhci_free_command(xhci, cfg_cmd); cleanup: xhci_free_command(xhci, stop_cmd); + spin_lock_irqsave(&xhci->lock, flags); if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE) ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE; + spin_unlock_irqrestore(&xhci->lock, flags); } static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,