--- /dev/null
+From 0f73628e9da1ee39daf5f188190cdbaee5e0c98c Mon Sep 17 00:00:00 2001
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+Date: Fri, 28 Mar 2025 00:03:50 +0900
+Subject: thunderbolt: Do not double dequeue a configuration request
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+commit 0f73628e9da1ee39daf5f188190cdbaee5e0c98c upstream.
+
+Some of our devices crash in tb_cfg_request_dequeue():
+
+ general protection fault, probably for non-canonical address 0xdead000000000122
+
+ CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65
+ RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0
+ Call Trace:
+ <TASK>
+ ? tb_cfg_request_dequeue+0x2d/0xa0
+ tb_cfg_request_work+0x33/0x80
+ worker_thread+0x386/0x8f0
+ kthread+0xed/0x110
+ ret_from_fork+0x38/0x50
+ ret_from_fork_asm+0x1b/0x30
+
+The circumstances are unclear, however, the theory is that
+tb_cfg_request_work() can be scheduled twice for a request:
+first time via frame.callback from ring_work() and second
+time from tb_cfg_request(). Both times kworkers will execute
+tb_cfg_request_dequeue(), which results in double list_del()
+from the ctl->request_queue (the list poison deference hints
+at it: 0xdead000000000122).
+
+Do not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE
+bit set.
+
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/ctl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/thunderbolt/ctl.c
++++ b/drivers/thunderbolt/ctl.c
+@@ -131,6 +131,11 @@ static void tb_cfg_request_dequeue(struc
+ struct tb_ctl *ctl = req->ctl;
+
+ mutex_lock(&ctl->request_queue_lock);
++ if (!test_bit(TB_CFG_REQUEST_ACTIVE, &req->flags)) {
++ mutex_unlock(&ctl->request_queue_lock);
++ return;
++ }
++
+ list_del(&req->list);
+ clear_bit(TB_CFG_REQUEST_ACTIVE, &req->flags);
+ if (test_bit(TB_CFG_REQUEST_CANCELED, &req->flags))
--- /dev/null
+From 19f795591947596b5b9efa86fd4b9058e45786e9 Mon Sep 17 00:00:00 2001
+From: Jiayi Li <lijiayi@kylinos.cn>
+Date: Thu, 8 May 2025 13:59:47 +0800
+Subject: usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+commit 19f795591947596b5b9efa86fd4b9058e45786e9 upstream.
+
+This device exhibits I/O errors during file transfers due to unstable
+link power management (LPM) behavior. The kernel logs show repeated
+warm resets and eventual disconnection when LPM is enabled:
+
+[ 3467.810740] hub 2-0:1.0: state 7 ports 6 chg 0000 evt 0020
+[ 3467.810740] usb usb2-port5: do warm reset
+[ 3467.866444] usb usb2-port5: not warm reset yet, waiting 50ms
+[ 3467.907407] sd 0:0:0:0: [sda] tag#12 sense submit err -19
+[ 3467.994423] usb usb2-port5: status 02c0, change 0001, 10.0 Gb/s
+[ 3467.994453] usb 2-5: USB disconnect, device number 4
+
+The error -19 (ENODEV) occurs when the device disappears during write
+operations. Adding USB_QUIRK_NO_LPM disables link power management
+for this specific device, resolving the stability issues.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20250508055947.764538-1-lijiayi@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -369,6 +369,9 @@ static const struct usb_device_id usb_qu
+ /* SanDisk Corp. SanDisk 3.2Gen1 */
+ { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* SanDisk Extreme 55AE */
++ { USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Realforce 87U Keyboard */
+ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
+
--- /dev/null
+From a541acceedf4f639f928f41fbb676b75946dc295 Mon Sep 17 00:00:00 2001
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+Date: Mon, 19 May 2025 10:33:28 +0800
+Subject: usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+commit a541acceedf4f639f928f41fbb676b75946dc295 upstream.
+
+SanDisk 3.2 Gen2 storage device(0781:55e8) doesn't work well with UAS.
+Log says,
+[ 6.507865][ 3] [ T159] usb 2-1.4: new SuperSpeed Gen 1 USB device number 4 using xhci_hcd
+[ 6.540314][ 3] [ T159] usb 2-1.4: New USB device found, idVendor=0781, idProduct=55e8, bcdDevice= 0.01
+[ 6.576304][ 3] [ T159] usb 2-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+[ 6.584727][ 3] [ T159] usb 2-1.4: Product: SanDisk 3.2 Gen2
+[ 6.590459][ 3] [ T159] usb 2-1.4: Manufacturer: SanDisk
+[ 6.595845][ 3] [ T159] usb 2-1.4: SerialNumber: 03021707022525140940
+[ 7.230852][ 0] [ T265] usbcore: registered new interface driver usb-storage
+[ 7.251247][ 0] [ T265] scsi host3: uas
+[ 7.255280][ 0] [ T265] usbcore: registered new interface driver uas
+[ 7.270498][ 1] [ T192] scsi 3:0:0:0: Direct-Access SanDisk Extreme Pro DDE1 0110 PQ: 0 ANSI: 6
+[ 7.299588][ 3] [ T192] scsi 3:0:0:1: Enclosure SanDisk SES Device 0110 PQ: 0 ANSI: 6
+[ 7.321681][ 3] [ T192] sd 3:0:0:0: Attached scsi generic sg1 type 0
+[ 7.328185][ 3] [ T192] scsi 3:0:0:1: Attached scsi generic sg2 type 13
+[ 7.328804][ 0] [ T191] sd 3:0:0:0: [sda] 976773168 512-byte logical blocks: (500 GB/466 GiB)
+[ 7.343486][ 0] [ T191] sd 3:0:0:0: [sda] 4096-byte physical blocks
+[ 7.364611][ 0] [ T191] sd 3:0:0:0: [sda] Write Protect is off
+[ 7.370524][ 0] [ T191] sd 3:0:0:0: [sda] Mode Sense: 3d 00 10 00
+[ 7.390655][ 0] [ T191] sd 3:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA
+[ 7.401363][ 0] [ T191] sd 3:0:0:0: [sda] Optimal transfer size 1048576 bytes
+[ 7.436010][ 0] [ T191] sda: sda1
+[ 7.450850][ 0] [ T191] sd 3:0:0:0: [sda] Attached SCSI disk
+[ 7.470218][ 4] [ T262] scsi 3:0:0:1: Failed to get diagnostic page 0x1
+[ 7.474869][ 0] [ C0] sd 3:0:0:0: [sda] tag#0 data cmplt err -75 uas-tag 2 inflight: CMD
+[ 7.476911][ 4] [ T262] scsi 3:0:0:1: Failed to bind enclosure -19
+[ 7.485330][ 0] [ C0] sd 3:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 00 00 28 00 00 10 00
+[ 7.491593][ 4] [ T262] ses 3:0:0:1: Attached Enclosure device
+[ 38.066980][ 4] [ T192] sd 3:0:0:0: [sda] tag#4 uas_eh_abort_handler 0 uas-tag 5 inflight: CMD IN
+[ 38.076012][ 4] [ T192] sd 3:0:0:0: [sda] tag#4 CDB: Read(10) 28 00 00 00 01 08 00 00 f8 00
+[ 38.086485][ 4] [ T192] sd 3:0:0:0: [sda] tag#3 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD IN
+[ 38.095515][ 4] [ T192] sd 3:0:0:0: [sda] tag#3 CDB: Read(10) 28 00 00 00 00 10 00 00 08 00
+[ 38.104122][ 4] [ T192] sd 3:0:0:0: [sda] tag#2 uas_eh_abort_handler 0 uas-tag 4 inflight: CMD IN
+[ 38.113152][ 4] [ T192] sd 3:0:0:0: [sda] tag#2 CDB: Read(10) 28 00 00 00 00 88 00 00 78 00
+[ 38.121761][ 4] [ T192] sd 3:0:0:0: [sda] tag#1 uas_eh_abort_handler 0 uas-tag 3 inflight: CMD IN
+[ 38.130791][ 4] [ T192] sd 3:0:0:0: [sda] tag#1 CDB: Read(10) 28 00 00 00 00 48 00 00 30 00
+[ 38.139401][ 4] [ T192] sd 3:0:0:0: [sda] tag#0 uas_eh_abort_handler 0 uas-tag 2 inflight: CMD
+[ 38.148170][ 4] [ T192] sd 3:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 00 00 28 00 00 10 00
+[ 38.178980][ 2] [ T304] scsi host3: uas_eh_device_reset_handler start
+[ 38.901540][ 2] [ T304] usb 2-1.4: reset SuperSpeed Gen 1 USB device number 4 using xhci_hcd
+[ 38.936791][ 2] [ T304] scsi host3: uas_eh_device_reset_handler success
+
+Device decriptor is below,
+Bus 002 Device 006: ID 0781:55e8 SanDisk Corp. SanDisk 3.2 Gen2
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 3.20
+ bDeviceClass 0
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 9
+ idVendor 0x0781 SanDisk Corp.
+ idProduct 0x55e8
+ bcdDevice 0.01
+ iManufacturer 1 SanDisk
+ iProduct 2 SanDisk 3.2 Gen2
+ iSerial 3 03021707022525140940
+ bNumConfigurations 1
+ Configuration Descriptor:
+ bLength 9
+ bDescriptorType 2
+ wTotalLength 0x0079
+ bNumInterfaces 1
+ bConfigurationValue 1
+ iConfiguration 0
+ bmAttributes 0x80
+ (Bus Powered)
+ MaxPower 896mA
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 8 Mass Storage
+ bInterfaceSubClass 6 SCSI
+ bInterfaceProtocol 80 Bulk-Only
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x82 EP 2 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 15
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x01 EP 1 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 15
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 1
+ bNumEndpoints 4
+ bInterfaceClass 8 Mass Storage
+ bInterfaceSubClass 6 SCSI
+ bInterfaceProtocol 98
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x01 EP 1 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Command pipe (0x01)
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x84 EP 4 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 15
+ MaxStreams 32
+ Status pipe (0x02)
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x82 EP 2 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 15
+ MaxStreams 32
+ Data-in pipe (0x03)
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x03 EP 3 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 15
+ MaxStreams 32
+ Data-out pipe (0x04)
+Binary Object Store Descriptor:
+ bLength 5
+ bDescriptorType 15
+ wTotalLength 0x002a
+ bNumDeviceCaps 3
+ USB 2.0 Extension Device Capability:
+ bLength 7
+ bDescriptorType 16
+ bDevCapabilityType 2
+ bmAttributes 0x0000f41e
+ BESL Link Power Management (LPM) Supported
+ BESL value 1024 us
+ Deep BESL value 61440 us
+ SuperSpeed USB Device Capability:
+ bLength 10
+ bDescriptorType 16
+ bDevCapabilityType 3
+ bmAttributes 0x00
+ wSpeedsSupported 0x000e
+ Device can operate at Full Speed (12Mbps)
+ Device can operate at High Speed (480Mbps)
+ Device can operate at SuperSpeed (5Gbps)
+ bFunctionalitySupport 1
+ Lowest fully-functional device speed is Full Speed (12Mbps)
+ bU1DevExitLat 10 micro seconds
+ bU2DevExitLat 2047 micro seconds
+ SuperSpeedPlus USB Device Capability:
+ bLength 20
+ bDescriptorType 16
+ bDevCapabilityType 10
+ bmAttributes 0x00000001
+ Sublink Speed Attribute count 1
+ Sublink Speed ID count 0
+ wFunctionalitySupport 0x1100
+ bmSublinkSpeedAttr[0] 0x000a4030
+ Speed Attribute ID: 0 10Gb/s Symmetric RX SuperSpeedPlus
+ bmSublinkSpeedAttr[1] 0x000a40b0
+ Speed Attribute ID: 0 10Gb/s Symmetric TX SuperSpeedPlus
+Device Status: 0x0000
+ (Bus Powered)
+
+So ignore UAS driver for this device.
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20250519023328.1498856-1-xiehongyu1@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/unusual_uas.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -52,6 +52,13 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x99
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
+
++/* Reported-by: Zhihong Zhou <zhouzhihong@greatwall.com.cn> */
++UNUSUAL_DEV(0x0781, 0x55e8, 0x0000, 0x9999,
++ "SanDisk",
++ "",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
+ UNUSUAL_DEV(0x090c, 0x2000, 0x0000, 0x9999,
+ "Hiksemi",
--- /dev/null
+From 342e4955a1f1ce28c70a589999b76365082dbf10 Mon Sep 17 00:00:00 2001
+From: Dave Penkler <dpenkler@gmail.com>
+Date: Wed, 21 May 2025 14:16:56 +0200
+Subject: usb: usbtmc: Fix timeout value in get_stb
+
+From: Dave Penkler <dpenkler@gmail.com>
+
+commit 342e4955a1f1ce28c70a589999b76365082dbf10 upstream.
+
+wait_event_interruptible_timeout requires a timeout argument
+in units of jiffies. It was being called in usbtmc_get_stb
+with the usb timeout value which is in units of milliseconds.
+
+Pass the timeout argument converted to jiffies.
+
+Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Penkler <dpenkler@gmail.com>
+Link: https://lore.kernel.org/r/20250521121656.18174-4-dpenkler@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/usbtmc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -486,6 +486,7 @@ static int usbtmc488_ioctl_read_stb(stru
+ __u8 stb;
+ int rv;
+ long wait_rv;
++ unsigned long expire;
+
+ dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n",
+ data->iin_ep_present);
+@@ -528,10 +529,11 @@ static int usbtmc488_ioctl_read_stb(stru
+ }
+
+ if (data->iin_ep_present) {
++ expire = msecs_to_jiffies(file_data->timeout);
+ wait_rv = wait_event_interruptible_timeout(
+ data->waitq,
+ atomic_read(&data->iin_data_valid) != 0,
+- file_data->timeout);
++ expire);
+ if (wait_rv < 0) {
+ dev_dbg(dev, "wait interrupted %ld\n", wait_rv);
+ rv = wait_rv;
projects / thirdparty / kernel / stable-queue.git / commitdiff
