xhci: sideband: don't dereference freed ring when removing sideband endpoint

xhci_sideband_remove_endpoint() incorrecly assumes that the endpoint is
running and has a valid transfer ring.

Lianqin reported a crash during suspend/wake-up stress testing, and
found the cause to be dereferencing a non-existing transfer ring
'ep->ring' during xhci_sideband_remove_endpoint().

The endpoint and its ring may be in unknown state if this function
is called after xHCI was reinitialized in resume (lost power), or if
device is being re-enumerated, disconnected or endpoint already dropped.

Fix this by both removing unnecessary ring access, and by checking
ep->ring exists before dereferencing it. Also make sure endpoint is
running before attempting to stop it.

Remove the xhci_initialize_ring_info() call during sideband endpoint
removal as is it only initializes ring structure enqueue, dequeue and
cycle state values to their starting values without changing actual
hardware enqueue, dequeue and cycle state. Leaving them out of sync
is worse than leaving it as it is. The endpoint will get freed in after
this in most usecases.

If the (audio) class driver want's to reuse the endpoint after offload
then it is up to the class driver to ensure endpoint is properly set up.

Reported-by: 胡连勤 <hulianqin@vivo.com>
Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217B105B059A7730C4F6EC8D2B9A@TYUPR06MB6217.apcprd06.prod.outlook.com/
Tested-by: 胡连勤 <hulianqin@vivo.com>
Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260115233758.364097-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-sideband.c b/drivers/usb/host/xhci-sideband.c
index a85f62a73313ab9481fb508074b8f47985eadb37..2bd77255032b975d8b1d7b0b80f2cbf06c66bac4 100644 (file)
--- a/drivers/usb/host/xhci-sideband.c
+++ b/drivers/usb/host/xhci-sideband.c
@@ -210,7 +210,6 @@ xhci_sideband_remove_endpoint(struct xhci_sideband *sb,
                return -ENODEV;
 
        __xhci_sideband_remove_endpoint(sb, ep);
-       xhci_initialize_ring_info(ep->ring);
 
        return 0;
 }

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 02c9bfe21ae27583160625c6e6c73603b0226e62..b3ba16b9718cf6d63054de48c10b1d7bc11cef93 100644 (file)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2898,16 +2898,25 @@ int xhci_stop_endpoint_sync(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, int
                            gfp_t gfp_flags)
 {
        struct xhci_command *command;
+       struct xhci_ep_ctx *ep_ctx;
        unsigned long flags;
-       int ret;
+       int ret = -ENODEV;
 
        command = xhci_alloc_command(xhci, true, gfp_flags);
        if (!command)
                return -ENOMEM;
 
        spin_lock_irqsave(&xhci->lock, flags);
-       ret = xhci_queue_stop_endpoint(xhci, command, ep->vdev->slot_id,
-                                      ep->ep_index, suspend);
+
+       /* make sure endpoint exists and is running before stopping it */
+       if (ep->ring) {
+               ep_ctx = xhci_get_ep_ctx(xhci, ep->vdev->out_ctx, ep->ep_index);
+               if (GET_EP_CTX_STATE(ep_ctx) == EP_STATE_RUNNING)
+                       ret = xhci_queue_stop_endpoint(xhci, command,
+                                                      ep->vdev->slot_id,
+                                                      ep->ep_index, suspend);
+       }
+
        if (ret < 0) {
                spin_unlock_irqrestore(&xhci->lock, flags);
                goto out;