From ea36715980ba60a230a1ec09bcbb4946ec0c3406 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 6 Sep 2022 14:18:59 +0200 Subject: [PATCH] 5.10-stable patches added patches: usb-dwc3-disable-usb-core-phy-management.patch usb-dwc3-fix-phy-disable-sequence.patch usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch --- queue-5.10/series | 3 + ...dwc3-disable-usb-core-phy-management.patch | 63 ++++++++++++++ .../usb-dwc3-fix-phy-disable-sequence.patch | 84 +++++++++++++++++++ ...-use-after-free-on-runtime-pm-wakeup.patch | 80 ++++++++++++++++++ 4 files changed, 230 insertions(+) create mode 100644 queue-5.10/usb-dwc3-disable-usb-core-phy-management.patch create mode 100644 queue-5.10/usb-dwc3-fix-phy-disable-sequence.patch create mode 100644 queue-5.10/usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch diff --git a/queue-5.10/series b/queue-5.10/series index 797dab42196..204747b1893 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -73,3 +73,6 @@ alsa-seq-fix-data-race-at-module-auto-loading.patch drm-i915-glk-ecs-liva-q2-needs-glk-hdmi-port-timing-quirk.patch btrfs-harden-identification-of-a-stale-device.patch mmc-core-fix-uhs-i-sd-1.8v-workaround-branch.patch +usb-dwc3-fix-phy-disable-sequence.patch +usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch +usb-dwc3-disable-usb-core-phy-management.patch diff --git a/queue-5.10/usb-dwc3-disable-usb-core-phy-management.patch b/queue-5.10/usb-dwc3-disable-usb-core-phy-management.patch new file mode 100644 index 00000000000..dc86271130f --- /dev/null +++ b/queue-5.10/usb-dwc3-disable-usb-core-phy-management.patch @@ -0,0 +1,63 @@ +From foo@baz Tue Sep 6 02:14:47 PM CEST 2022 +From: Johan Hovold +Date: Tue, 6 Sep 2022 14:07:02 +0200 +Subject: usb: dwc3: disable USB core PHY management +To: Greg Kroah-Hartman +Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Matthias Kaehlcke , stable +Message-ID: <20220906120702.19219-4-johan@kernel.org> + +From: Johan Hovold + +commit 6000b8d900cd5f52fbcd0776d0cc396e88c8c2ea upstream. + +The dwc3 driver manages its PHYs itself so the USB core PHY management +needs to be disabled. + +Use the struct xhci_plat_priv hack added by commits 46034a999c07 ("usb: +host: xhci-plat: add platform data support") and f768e718911e ("usb: +host: xhci-plat: add priv quirk for skip PHY initialization") to +propagate the setting for now. + +Fixes: 4e88d4c08301 ("usb: add a flag to skip PHY initialization to struct usb_hcd") +Fixes: 178a0bce05cb ("usb: core: hcd: integrate the PHY wrapper into the HCD core") +Tested-by: Matthias Kaehlcke +Cc: stable +Reviewed-by: Matthias Kaehlcke +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220825131836.19769-1-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +[ johan: adjust context to 5.15 ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/host.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/usb/dwc3/host.c ++++ b/drivers/usb/dwc3/host.c +@@ -10,8 +10,13 @@ + #include + #include + ++#include "../host/xhci-plat.h" + #include "core.h" + ++static const struct xhci_plat_priv dwc3_xhci_plat_priv = { ++ .quirks = XHCI_SKIP_PHY_INIT, ++}; ++ + static int dwc3_host_get_irq(struct dwc3 *dwc) + { + struct platform_device *dwc3_pdev = to_platform_device(dwc->dev); +@@ -87,6 +92,11 @@ int dwc3_host_init(struct dwc3 *dwc) + goto err; + } + ++ ret = platform_device_add_data(xhci, &dwc3_xhci_plat_priv, ++ sizeof(dwc3_xhci_plat_priv)); ++ if (ret) ++ goto err; ++ + memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props)); + + if (dwc->usb3_lpm_capable) diff --git a/queue-5.10/usb-dwc3-fix-phy-disable-sequence.patch b/queue-5.10/usb-dwc3-fix-phy-disable-sequence.patch new file mode 100644 index 00000000000..098be69e4a8 --- /dev/null +++ b/queue-5.10/usb-dwc3-fix-phy-disable-sequence.patch @@ -0,0 +1,84 @@ +From foo@baz Tue Sep 6 02:14:47 PM CEST 2022 +From: Johan Hovold +Date: Tue, 6 Sep 2022 14:07:00 +0200 +Subject: usb: dwc3: fix PHY disable sequence +To: Greg Kroah-Hartman +Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Andrew Halaney , Matthias Kaehlcke , Manivannan Sadhasivam +Message-ID: <20220906120702.19219-2-johan@kernel.org> + +From: Johan Hovold + +commit d2ac7bef95c9ead307801ccb6cb6dfbeb14247bf upstream. + +Generic PHYs must be powered-off before they can be tore down. + +Similarly, suspending legacy PHYs after having powered them off makes no +sense. + +Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded +dwc3_probe() error-path sequences that got this wrong. + +Note that this makes dwc3_core_exit() match the dwc3_core_init() error +path with respect to powering off the PHYs. + +Fixes: 03c1fd622f72 ("usb: dwc3: core: add phy cleanup for probe error handling") +Fixes: c499ff71ff2a ("usb: dwc3: core: re-factor init and exit paths") +Cc: stable@vger.kernel.org # 4.8 +Reviewed-by: Andrew Halaney +Reviewed-by: Matthias Kaehlcke +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +[ johan: adjust context to 5.15 ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -728,15 +728,16 @@ static void dwc3_core_exit(struct dwc3 * + { + dwc3_event_buffers_cleanup(dwc); + ++ usb_phy_set_suspend(dwc->usb2_phy, 1); ++ usb_phy_set_suspend(dwc->usb3_phy, 1); ++ phy_power_off(dwc->usb2_generic_phy); ++ phy_power_off(dwc->usb3_generic_phy); ++ + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); + +- usb_phy_set_suspend(dwc->usb2_phy, 1); +- usb_phy_set_suspend(dwc->usb3_phy, 1); +- phy_power_off(dwc->usb2_generic_phy); +- phy_power_off(dwc->usb3_generic_phy); + clk_bulk_disable_unprepare(dwc->num_clks, dwc->clks); + reset_control_assert(dwc->reset); + } +@@ -1606,16 +1607,16 @@ err5: + dwc3_debugfs_exit(dwc); + dwc3_event_buffers_cleanup(dwc); + +- usb_phy_shutdown(dwc->usb2_phy); +- usb_phy_shutdown(dwc->usb3_phy); +- phy_exit(dwc->usb2_generic_phy); +- phy_exit(dwc->usb3_generic_phy); +- + usb_phy_set_suspend(dwc->usb2_phy, 1); + usb_phy_set_suspend(dwc->usb3_phy, 1); + phy_power_off(dwc->usb2_generic_phy); + phy_power_off(dwc->usb3_generic_phy); + ++ usb_phy_shutdown(dwc->usb2_phy); ++ usb_phy_shutdown(dwc->usb3_phy); ++ phy_exit(dwc->usb2_generic_phy); ++ phy_exit(dwc->usb3_generic_phy); ++ + dwc3_ulpi_exit(dwc); + + err4: diff --git a/queue-5.10/usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch b/queue-5.10/usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch new file mode 100644 index 00000000000..4fd15d9f386 --- /dev/null +++ b/queue-5.10/usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeup.patch @@ -0,0 +1,80 @@ +From foo@baz Tue Sep 6 02:14:47 PM CEST 2022 +From: Johan Hovold +Date: Tue, 6 Sep 2022 14:07:01 +0200 +Subject: usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup +To: Greg Kroah-Hartman +Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Matthias Kaehlcke , Manivannan Sadhasivam +Message-ID: <20220906120702.19219-3-johan@kernel.org> + +From: Johan Hovold + +commit a872ab303d5ddd4c965f9cd868677781a33ce35a upstream. + +The Qualcomm dwc3 runtime-PM implementation checks the xhci +platform-device pointer in the wakeup-interrupt handler to determine +whether the controller is in host mode and if so triggers a resume. + +After a role switch in OTG mode the xhci platform-device would have been +freed and the next wakeup from runtime suspend would access the freed +memory. + +Note that role switching is executed from a freezable workqueue, which +guarantees that the pointer is stable during suspend. + +Also note that runtime PM has been broken since commit 2664deb09306 +("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which +incidentally also prevents this issue from being triggered. + +Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") +Cc: stable@vger.kernel.org # 4.18 +Reviewed-by: Matthias Kaehlcke +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220804151001.23612-5-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +[ johan: adjust context for 5.15 ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-qcom.c | 14 +++++++++++++- + drivers/usb/dwc3/host.c | 1 + + 2 files changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -296,6 +296,14 @@ static void dwc3_qcom_interconnect_exit( + icc_put(qcom->icc_path_apps); + } + ++/* Only usable in contexts where the role can not change. */ ++static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) ++{ ++ struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3); ++ ++ return dwc->xhci; ++} ++ + static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom) + { + if (qcom->hs_phy_irq) { +@@ -411,7 +419,11 @@ static irqreturn_t qcom_dwc3_resume_irq( + if (qcom->pm_suspended) + return IRQ_HANDLED; + +- if (dwc->xhci) ++ /* ++ * This is safe as role switching is done from a freezable workqueue ++ * and the wakeup interrupts are disabled as part of resume. ++ */ ++ if (dwc3_qcom_is_host(qcom)) + pm_runtime_resume(&dwc->xhci->dev); + + return IRQ_HANDLED; +--- a/drivers/usb/dwc3/host.c ++++ b/drivers/usb/dwc3/host.c +@@ -130,4 +130,5 @@ err: + void dwc3_host_exit(struct dwc3 *dwc) + { + platform_device_unregister(dwc->xhci); ++ dwc->xhci = NULL; + } -- 2.47.3