--- /dev/null
+From e8da46d99d3710106e7c44db14566bf9b57386b5 Mon Sep 17 00:00:00 2001
+From: Myeonghun Pak <mhun512@gmail.com>
+Date: Mon, 6 Jul 2026 23:53:12 +0900
+Subject: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
+
+From: Myeonghun Pak <mhun512@gmail.com>
+
+commit e8da46d99d3710106e7c44db14566bf9b57386b5 upstream.
+
+rt1711h_probe() registers the TCPCI port before requesting the interrupt
+and enabling alert interrupts. If either of those later steps fails, the
+probe function returns without unregistering the TCPCI port. The explicit
+unregister currently only happens from the remove callback.
+
+Register a devres action immediately after tcpci_register_port() succeeds,
+so tcpci_unregister_port() runs on later probe failures and on driver
+detach. Drop the remove callback to avoid unregistering the same port
+twice.
+
+This issue was identified during our ongoing static-analysis research while
+reviewing kernel code.
+
+Fixes: 302c570bf36e ("usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs")
+Cc: stable <stable@kernel.org>
+Co-developed-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
+Link: https://patch.msgid.link/20260706145312.37260-1-mhun512@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c
++++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c
+@@ -330,6 +330,8 @@ static int rt1711h_check_revision(struct
+ return ret;
+ }
+
++static void rt1711h_unregister_tcpci_port(void *tcpci);
++
+ static int rt1711h_probe(struct i2c_client *client)
+ {
+ int ret;
+@@ -381,6 +383,10 @@ static int rt1711h_probe(struct i2c_clie
+ if (IS_ERR_OR_NULL(chip->tcpci))
+ return PTR_ERR(chip->tcpci);
+
++ ret = devm_add_action_or_reset(chip->dev, rt1711h_unregister_tcpci_port, chip->tcpci);
++ if (ret)
++ return ret;
++
+ ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
+ rt1711h_irq,
+ IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+@@ -398,11 +404,9 @@ static int rt1711h_probe(struct i2c_clie
+ return 0;
+ }
+
+-static void rt1711h_remove(struct i2c_client *client)
++static void rt1711h_unregister_tcpci_port(void *tcpci)
+ {
+- struct rt1711h_chip *chip = i2c_get_clientdata(client);
+-
+- tcpci_unregister_port(chip->tcpci);
++ tcpci_unregister_port(tcpci);
+ }
+
+ static const struct rt1711h_chip_info rt1711h = {
+@@ -435,7 +439,6 @@ static struct i2c_driver rt1711h_i2c_dri
+ .of_match_table = rt1711h_of_match,
+ },
+ .probe = rt1711h_probe,
+- .remove = rt1711h_remove,
+ .id_table = rt1711h_id,
+ };
+ module_i2c_driver(rt1711h_i2c_driver);
--- /dev/null
+From 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E8=83=A1=E8=BF=9E=E5=8B=A4?= <hulianqin@vivo.com>
+Date: Fri, 3 Jul 2026 17:40:33 +0300
+Subject: usb: xhci: Fix sleep in atomic context in xhci_free_streams()
+
+From: 胡连勤 <hulianqin@vivo.com>
+
+commit 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a upstream.
+
+When a USB device with active stream endpoints is disconnected,
+xhci_free_streams() is called from the hub_event workqueue to
+free the stream resources. It calls xhci_free_stream_info()
+while holding xhci->lock with irqs disabled.
+
+xhci_free_stream_info() invokes xhci_free_stream_ctx(), which
+calls dma_free_coherent() for large stream context arrays.
+
+dma_free_coherent() can sleep (e.g. via vunmap), triggering
+a BUG when called from atomic context.
+
+Call trace:
+ dma_free_attrs+0x174/0x220
+ xhci_free_stream_info+0xd0/0x11c
+ xhci_free_streams+0x278/0x37c
+ usb_free_streams+0x98/0xc0
+ usb_unbind_interface+0x1b8/0x2f8
+ device_release_driver_internal+0x1d4/0x2cc
+ device_release_driver+0x18/0x28
+ bus_remove_device+0x160/0x1a4
+ device_del+0x1ec/0x350
+ usb_disable_device+0x98/0x214
+ usb_disconnect+0xf0/0x35c
+ hub_event+0xab4/0x19ec
+ process_one_work+0x278/0x63c
+
+Fix this by saving the stream_info pointers and clearing the
+ep references under the lock, then calling xhci_free_stream_info()
+outside the lock where sleeping is allowed.
+
+Fixes: 8df75f42f8e6 ("USB: xhci: Add memory allocation for USB3 bulk streams.")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20260703144033.483286-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3576,6 +3576,7 @@ static int xhci_free_streams(struct usb_
+ struct xhci_virt_device *vdev;
+ struct xhci_command *command;
+ struct xhci_input_control_ctx *ctrl_ctx;
++ struct xhci_stream_info *stream_info[EP_CTX_PER_DEV];
+ unsigned int ep_index;
+ unsigned long flags;
+ u32 changed_ep_bitmask;
+@@ -3636,10 +3637,15 @@ static int xhci_free_streams(struct usb_
+ if (ret < 0)
+ return ret;
+
++ /*
++ * dma_free_coherent() called by xhci_free_stream_info() may sleep,
++ * so save stream_info pointers and clear references under lock,
++ * then free the memory outside lock.
++ */
+ spin_lock_irqsave(&xhci->lock, flags);
+ for (i = 0; i < num_eps; i++) {
+ ep_index = xhci_get_endpoint_index(&eps[i]->desc);
+- xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info);
++ stream_info[i] = vdev->eps[ep_index].stream_info;
+ vdev->eps[ep_index].stream_info = NULL;
+ /* FIXME Unset maxPstreams in endpoint context and
+ * update deq ptr to point to normal string ring.
+@@ -3649,6 +3655,9 @@ static int xhci_free_streams(struct usb_
+ }
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
++ for (i = 0; i < num_eps; i++)
++ xhci_free_stream_info(xhci, stream_info[i]);
++
+ return 0;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
