From: Greg Kroah-Hartman Date: Sun, 1 May 2022 15:54:45 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.4.192~76 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=978e97586974556b8bfc933969c25d705e47d211;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch usb-quirks-add-a-realtek-card-reader.patch usb-quirks-add-string-quirk-for-vcom-device.patch usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch xhci-stop-polling-roothubs-after-shutdown.patch --- diff --git a/queue-4.14/series b/queue-4.14/series index 0b712f085f7..c6aa74a9abc 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -4,3 +4,11 @@ hamradio-remove-needs_free_netdev-to-avoid-uaf.patch net-sched-cls_u32-fix-netns-refcount-changes-in-u32_change.patch revert-net-ethernet-stmmac-fix-altr_tse_pcs-function-when-using-a-fixed-link.patch lightnvm-disable-the-subsystem.patch +usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch +usb-quirks-add-a-realtek-card-reader.patch +usb-quirks-add-string-quirk-for-vcom-device.patch +usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch +usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch +usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch +usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch +xhci-stop-polling-roothubs-after-shutdown.patch diff --git a/queue-4.14/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch b/queue-4.14/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch new file mode 100644 index 00000000000..7608cb96bb7 --- /dev/null +++ b/queue-4.14/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch @@ -0,0 +1,51 @@ +From 456244aeecd54249096362a173dfe06b82a5cafa Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Tue, 19 Apr 2022 16:12:45 +0800 +Subject: usb: mtu3: fix USB 3.0 dual-role-switch from device to host + +From: Macpaul Lin + +commit 456244aeecd54249096362a173dfe06b82a5cafa upstream. + +Issue description: + When an OTG port has been switched to device role and then switch back + to host role again, the USB 3.0 Host (XHCI) will not be able to detect + "plug in event of a connected USB 2.0/1.0 ((Highspeed and Fullspeed) + devices until system reboot. + +Root cause and Solution: + There is a condition checking flag "ssusb->otg_switch.is_u3_drd" in + toggle_opstate(). At the end of role switch procedure, toggle_opstate() + will be called to set DC_SESSION and SOFT_CONN bit. If "is_u3_drd" was + set and switched the role to USB host 3.0, bit DC_SESSION and SOFT_CONN + will be skipped hence caused the port cannot detect connected USB 2.0 + (Highspeed and Fullspeed) devices. Simply remove the condition check to + solve this issue. + +Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support") +Cc: stable@vger.kernel.org +Tested-by: Fabien Parent +Reviewed-by: Chunfeng Yun +Signed-off-by: Macpaul Lin +Signed-off-by: Tainping Fang +Link: https://lore.kernel.org/r/20220419081245.21015-1-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_dr.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/usb/mtu3/mtu3_dr.c ++++ b/drivers/usb/mtu3/mtu3_dr.c +@@ -39,10 +39,8 @@ enum mtu3_vbus_id_state { + + static void toggle_opstate(struct ssusb_mtk *ssusb) + { +- if (!ssusb->otg_switch.is_u3_drd) { +- mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); +- mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); +- } ++ mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); ++ mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); + } + + /* only port0 supports dual-role mode */ diff --git a/queue-4.14/usb-quirks-add-a-realtek-card-reader.patch b/queue-4.14/usb-quirks-add-a-realtek-card-reader.patch new file mode 100644 index 00000000000..bac0d78f2b7 --- /dev/null +++ b/queue-4.14/usb-quirks-add-a-realtek-card-reader.patch @@ -0,0 +1,31 @@ +From 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 14 Apr 2022 13:02:09 +0200 +Subject: USB: quirks: add a Realtek card reader + +From: Oliver Neukum + +commit 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d upstream. + +This device is reported to stall when enummerated. + +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220414110209.30924-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -243,6 +243,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ ++ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME }, diff --git a/queue-4.14/usb-quirks-add-string-quirk-for-vcom-device.patch b/queue-4.14/usb-quirks-add-string-quirk-for-vcom-device.patch new file mode 100644 index 00000000000..accb1d56492 --- /dev/null +++ b/queue-4.14/usb-quirks-add-string-quirk-for-vcom-device.patch @@ -0,0 +1,31 @@ +From ec547af8a9ea6441864bad34172676b5652ceb96 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 14 Apr 2022 14:31:52 +0200 +Subject: USB: quirks: add STRING quirk for VCOM device + +From: Oliver Neukum + +commit ec547af8a9ea6441864bad34172676b5652ceb96 upstream. + +This has been reported to stall if queried + +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220414123152.1700-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -328,6 +328,9 @@ static const struct usb_device_id usb_qu + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* VCOM device */ ++ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-4.14/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch b/queue-4.14/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch new file mode 100644 index 00000000000..c8c3773e39d --- /dev/null +++ b/queue-4.14/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch @@ -0,0 +1,38 @@ +From 35a923a0b329c343e9e81d79518e2937eba06fcd Mon Sep 17 00:00:00 2001 +From: Bruno Thomsen +Date: Thu, 14 Apr 2022 10:12:02 +0200 +Subject: USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader + +From: Bruno Thomsen + +commit 35a923a0b329c343e9e81d79518e2937eba06fcd upstream. + +Wireless reading of water and heat meters using 868 MHz wM-Bus mode C1. + +The two different product IDs allow detection of dongle antenna +solution: +- Internal antenna +- External antenna using SMA connector + +https://www.kamstrup.com/en-en/water-solutions/water-meter-reading/usb-meter-reader + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20220414081202.5591-1-bruno.thomsen@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -198,6 +198,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */ + { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ + { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ ++ { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Int Ant) */ ++ { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Ext Ant) */ + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ diff --git a/queue-4.14/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch b/queue-4.14/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch new file mode 100644 index 00000000000..d441a46f962 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch @@ -0,0 +1,75 @@ +From b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Thu, 14 Apr 2022 15:44:34 +0800 +Subject: USB: serial: option: add support for Cinterion MV32-WA/MV32-WB + +From: Slark Xiao + +commit b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 upstream. + +Add support for Cinterion device MV32-WA/MV32-WB. MV32-WA PID is +0x00F1, and MV32-WB PID is 0x00F2. + +Test evidence as below: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f1 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F1 USB Mobile Broadband +S: SerialNumber=78ada8c4 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f2 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F2 USB Mobile Broadband +S: SerialNumber=cdd06a78 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +Interface 0&1: MBIM, 2:Modem, 3: GNSS, 4: NMEA, 5: Diag +GNSS port don't use serial driver. + +Signed-off-by: Slark Xiao +Link: https://lore.kernel.org/r/20220414074434.5699-1-slark_xiao@163.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -435,6 +435,8 @@ static void option_instat_callback(struc + #define CINTERION_PRODUCT_CLS8 0x00b0 + #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 + #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 ++#define CINTERION_PRODUCT_MV32_WA 0x00f1 ++#define CINTERION_PRODUCT_MV32_WB 0x00f2 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -1972,6 +1974,10 @@ static const struct usb_device_id option + .driver_info = RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff), + .driver_info = RSVD(0)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), ++ .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), ++ .driver_info = RSVD(3)}, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), + .driver_info = RSVD(4) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), diff --git a/queue-4.14/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch b/queue-4.14/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch new file mode 100644 index 00000000000..31bfb7f04c6 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch @@ -0,0 +1,46 @@ +From f32c5a0423400e01f4d7c607949fa3a1f006e8fa Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Wed, 6 Apr 2022 16:14:08 +0200 +Subject: USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions + +From: Daniele Palmas + +commit f32c5a0423400e01f4d7c607949fa3a1f006e8fa upstream. + +Add support for the following Telit FN980 and FN990 compositions: + +0x1057: tty, adb, rmnet, tty, tty, tty, tty, tty +0x1058: tty, adb, tty, tty, tty, tty, tty +0x1075: adb, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20220406141408.580669-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1222,6 +1222,10 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN980 */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ +@@ -1238,6 +1242,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ ++ .driver_info = RSVD(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-4.14/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch b/queue-4.14/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch new file mode 100644 index 00000000000..6ef525b94c6 --- /dev/null +++ b/queue-4.14/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch @@ -0,0 +1,72 @@ +From e23e50e7acc8d8f16498e9c129db33e6a00e80eb Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 20 Apr 2022 17:12:34 -0700 +Subject: USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS + +From: Kees Cook + +commit e23e50e7acc8d8f16498e9c129db33e6a00e80eb upstream. + +The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=n +due to "-mabi=apcs-gnu", even though it has a single u8: + +whiteheat_private { + __u8 mcr; /* 0 1 */ + + /* size: 4, cachelines: 1, members: 1 */ + /* padding: 3 */ + /* last cacheline: 4 bytes */ +}; + +The result is technically harmless, as both the source and the +destinations are currently the same allocation size (4 bytes) and don't +use their padding, but if anything were to ever be added after the +"mcr" member in "struct whiteheat_private", it would be overwritten. The +structs both have a single u8 "mcr" member, but are 4 bytes in padded +size. The memcpy() destination was explicitly targeting the u8 member +(size 1) with the length of the whole structure (size 4), triggering +the memcpy buffer overflow warning: + +In file included from include/linux/string.h:253, + from include/linux/bitmap.h:11, + from include/linux/cpumask.h:12, + from include/linux/smp.h:13, + from include/linux/lockdep.h:14, + from include/linux/spinlock.h:62, + from include/linux/mmzone.h:8, + from include/linux/gfp.h:6, + from include/linux/slab.h:15, + from drivers/usb/serial/whiteheat.c:17: +In function 'fortify_memcpy_chk', + inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:4: +include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] + 328 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Instead, just assign the one byte directly. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com +Cc: stable@vger.kernel.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/whiteheat.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -615,9 +615,8 @@ static int firm_send_command(struct usb_ + switch (command) { + case WHITEHEAT_GET_DTR_RTS: + info = usb_get_serial_port_data(port); +- memcpy(&info->mcr, command_info->result_buffer, +- sizeof(struct whiteheat_dr_info)); +- break; ++ info->mcr = command_info->result_buffer[0]; ++ break; + } + } + exit: diff --git a/queue-4.14/xhci-stop-polling-roothubs-after-shutdown.patch b/queue-4.14/xhci-stop-polling-roothubs-after-shutdown.patch new file mode 100644 index 00000000000..23f9a7f4d8b --- /dev/null +++ b/queue-4.14/xhci-stop-polling-roothubs-after-shutdown.patch @@ -0,0 +1,49 @@ +From dc92944a014cd6a6f6c94299aaa36164dd2c238a Mon Sep 17 00:00:00 2001 +From: Henry Lin +Date: Fri, 8 Apr 2022 16:48:22 +0300 +Subject: xhci: stop polling roothubs after shutdown + +From: Henry Lin + +commit dc92944a014cd6a6f6c94299aaa36164dd2c238a upstream. + +While rebooting, XHCI controller and its bus device will be shut down +in order by .shutdown callback. Stopping roothubs polling in +xhci_shutdown() can prevent XHCI driver from accessing port status +after its bus device shutdown. + +Take PCIe XHCI controller as example, if XHCI driver doesn't stop roothubs +polling, XHCI driver may access PCIe BAR register for port status after +parent PCIe root port driver is shutdown and cause PCIe bus error. + +[check shared hcd exist before stopping its roothub polling -Mathias] + +Cc: stable@vger.kernel.org +Signed-off-by: Henry Lin +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220408134823.2527272-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -724,6 +724,17 @@ void xhci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_REBOOT) + usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); + ++ /* Don't poll the roothubs after shutdown. */ ++ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", ++ __func__, hcd->self.busnum); ++ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); ++ del_timer_sync(&hcd->rh_timer); ++ ++ if (xhci->shared_hcd) { ++ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); ++ del_timer_sync(&xhci->shared_hcd->rh_timer); ++ } ++ + spin_lock_irq(&xhci->lock); + xhci_halt(xhci); + /* Workaround for spurious wakeups at shutdown with HSW */