| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20241213235403.4109199-7-quic_wcheng@quicinc.com>
Date: Fri, 13 Dec 2024 15:53:37 -0800
From: Wesley Cheng <quic_wcheng@...cinc.com>
To: <srinivas.kandagatla@...aro.org>, <mathias.nyman@...el.com>,
<perex@...ex.cz>, <conor+dt@...nel.org>, <dmitry.torokhov@...il.com>,
<corbet@....net>, <broonie@...nel.org>, <lgirdwood@...il.com>,
<tiwai@...e.com>, <krzk+dt@...nel.org>,
<pierre-louis.bossart@...ux.dev>, <Thinh.Nguyen@...opsys.com>,
<robh@...nel.org>, <gregkh@...uxfoundation.org>
CC: <linux-kernel@...r.kernel.org>, <devicetree@...r.kernel.org>,
<linux-sound@...r.kernel.org>, <linux-input@...r.kernel.org>,
<linux-usb@...r.kernel.org>, <linux-arm-msm@...r.kernel.org>,
<linux-doc@...r.kernel.org>, Wesley Cheng <quic_wcheng@...cinc.com>
Subject: [PATCH v31 06/32] usb: host: xhci: Notify xHCI sideband on transfer ring free
In the case of handling a USB bus reset, the xhci_discover_or_reset_device
can run without first notifying the xHCI sideband client driver to stop or
prevent the use of the transfer ring. It was seen that when a bus reset
situation happened, the USB offload driver was attempting to fetch the xHCI
transfer ring information, which was already freed.
Signed-off-by: Wesley Cheng <quic_wcheng@...cinc.com>
---
drivers/usb/host/xhci-sideband.c | 29 ++++++++++++++++++++++++++++-
drivers/usb/host/xhci.c | 3 +++
include/linux/usb/xhci-sideband.h | 30 +++++++++++++++++++++++++++++-
3 files changed, 60 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/host/xhci-sideband.c b/drivers/usb/host/xhci-sideband.c
index baf252a3de48..ffa6f1b825ff 100644
--- a/drivers/usb/host/xhci-sideband.c
+++ b/drivers/usb/host/xhci-sideband.c
@@ -88,6 +88,30 @@ __xhci_sideband_remove_endpoint(struct xhci_sideband *sb, struct xhci_virt_ep *e
/* sideband api functions */
+/**
+ * xhci_sideband_notify_ep_ring_free - notify client of xfer ring free
+ * @sb: sideband instance for this usb device
+ * @ep_index: usb endpoint index
+ *
+ * Notifies the xHCI sideband client driver of a xHCI transfer ring free
+ * routine. This will allow for the client to ensure that all transfers
+ * are completed.
+ *
+ * The callback should be synchronous, as the ring free happens after.
+ */
+void xhci_sideband_notify_ep_ring_free(struct xhci_sideband *sb,
+ unsigned int ep_index)
+{
+ struct xhci_sideband_event evt;
+
+ evt.type = XHCI_SIDEBAND_XFER_RING_FREE;
+ evt.evt_data = &ep_index;
+
+ if (sb->notify_client)
+ sb->notify_client(sb->intf, &evt);
+}
+EXPORT_SYMBOL_GPL(xhci_sideband_notify_ep_ring_free);
+
/**
* xhci_sideband_add_endpoint - add endpoint to sideband access list
* @sb: sideband instance for this usb device
@@ -344,7 +368,9 @@ EXPORT_SYMBOL_GPL(xhci_sideband_interrupter_id);
* Return: pointer to a new xhci_sideband instance if successful. NULL otherwise.
*/
struct xhci_sideband *
-xhci_sideband_register(struct usb_interface *intf, enum xhci_sideband_type type)
+xhci_sideband_register(struct usb_interface *intf, enum xhci_sideband_type type,
+ int (*notify_client)(struct usb_interface *intf,
+ struct xhci_sideband_event *evt))
{
struct usb_device *udev = interface_to_usbdev(intf);
struct usb_hcd *hcd = bus_to_hcd(udev->bus);
@@ -383,6 +409,7 @@ xhci_sideband_register(struct usb_interface *intf, enum xhci_sideband_type type)
sb->vdev = vdev;
sb->intf = intf;
sb->type = type;
+ sb->notify_client = notify_client;
vdev->sideband = sb;
spin_unlock_irq(&xhci->lock);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 514a36914ed9..972395d297f1 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -19,6 +19,7 @@
#include <linux/slab.h>
#include <linux/dmi.h>
#include <linux/dma-mapping.h>
+#include <linux/usb/xhci-sideband.h>
#include "xhci.h"
#include "xhci-trace.h"
@@ -3909,6 +3910,8 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
}
if (ep->ring) {
+ if (ep->sideband)
+ xhci_sideband_notify_ep_ring_free(ep->sideband, i);
xhci_debugfs_remove_endpoint(xhci, virt_dev, i);
xhci_free_endpoint_ring(xhci, virt_dev, i);
}
diff --git a/include/linux/usb/xhci-sideband.h b/include/linux/usb/xhci-sideband.h
index f6023b1b062b..72aa17eb068d 100644
--- a/include/linux/usb/xhci-sideband.h
+++ b/include/linux/usb/xhci-sideband.h
@@ -21,6 +21,20 @@ enum xhci_sideband_type {
XHCI_SIDEBAND_VENDOR,
};
+enum xhci_sideband_notify_type {
+ XHCI_SIDEBAND_XFER_RING_FREE,
+};
+
+/**
+ * struct xhci_sideband_event - sideband event
+ * @type: notifier type
+ * @evt_data: event data
+ */
+struct xhci_sideband_event {
+ enum xhci_sideband_notify_type type;
+ void *evt_data;
+};
+
/**
* struct xhci_sideband - representation of a sideband accessed usb device.
* @xhci: The xhci host controller the usb device is connected to
@@ -29,6 +43,7 @@ enum xhci_sideband_type {
* @ir: event handling and buffer for sideband accessed device
* @mutex: mutex for sideband operations
* @intf: USB sideband client interface
+ * @notify_client: callback for xHCI sideband sequences
*
* FIXME usb device accessed via sideband Keeping track of sideband accessed usb devices.
*/
@@ -43,10 +58,14 @@ struct xhci_sideband {
struct mutex mutex;
struct usb_interface *intf;
+ int (*notify_client)(struct usb_interface *intf,
+ struct xhci_sideband_event *evt);
};
struct xhci_sideband *
-xhci_sideband_register(struct usb_interface *intf, enum xhci_sideband_type type);
+xhci_sideband_register(struct usb_interface *intf, enum xhci_sideband_type type,
+ int (*notify_client)(struct usb_interface *intf,
+ struct xhci_sideband_event *evt));
void
xhci_sideband_unregister(struct xhci_sideband *sb);
int
@@ -70,4 +89,13 @@ void
xhci_sideband_remove_interrupter(struct xhci_sideband *sb);
int
xhci_sideband_interrupter_id(struct xhci_sideband *sb);
+
+#if IS_ENABLED(CONFIG_USB_XHCI_SIDEBAND)
+void xhci_sideband_notify_ep_ring_free(struct xhci_sideband *sb,
+ unsigned int ep_index);
+#else
+static inline void xhci_sideband_notify_ep_ring_free(struct xhci_sideband *sb,
+ unsigned int ep_index)
+{ }
+#endif /* IS_ENABLED(CONFIG_USB_XHCI_SIDEBAND) */
#endif /* __LINUX_XHCI_SIDEBAND_H */
Powered by blists - more mailing lists