linux-kernel - Re: [PATCH RFC 08/22] usb: typec: tipd: Clear interrupts first

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aLF00zGWg2MPUlyJ@kuha.fi.intel.com>
Date: Fri, 29 Aug 2025 12:37:23 +0300
From: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
To: Sven Peter <sven@...nel.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Rob Herring <robh@...nel.org>,
	Krzysztof Kozlowski <krzk+dt@...nel.org>,
	Conor Dooley <conor+dt@...nel.org>, Felipe Balbi <balbi@...nel.org>,
	Janne Grunau <j@...nau.net>,
	Alyssa Rosenzweig <alyssa@...enzweig.io>,
	Neal Gompa <neal@...pa.dev>, Vinod Koul <vkoul@...nel.org>,
	Kishon Vijay Abraham I <kishon@...nel.org>,
	Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
	Philipp Zabel <p.zabel@...gutronix.de>, linux-usb@...r.kernel.org,
	devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
	asahi@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org,
	linux-phy@...ts.infradead.org, stable@...nel.org
Subject: Re: [PATCH RFC 08/22] usb: typec: tipd: Clear interrupts first

On Thu, Aug 21, 2025 at 03:39:00PM +0000, Sven Peter wrote:
> Right now the interrupt handler first reads all updated status registers
> and only then clears the interrupts. It's possible that a duplicate
> interrupt for a changed register or plug state comes in after the
> interrupts have been processed but before they have been cleared:
> 
> * plug is inserted, TPS_REG_INT_PLUG_EVENT is set
> * TPS_REG_INT_EVENT1 is read
> * tps6598x_handle_plug_event() has run and registered the plug
> * plug is removed again, TPS_REG_INT_PLUG_EVENT is set (again)
> * TPS_REG_INT_CLEAR1 is written, TPS_REG_INT_PLUG_EVENT is cleared
> 
> We then have no plug connected and no pending interrupt but the tipd
> core still thinks there is a plug. It's possible to trigger this with
> e.g. a slightly broken Type-C to USB A converter.
> 
> Fix this by first clearing the interrupts and only then reading the
> updated registers.
> 
> Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X")
> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
> Cc: stable@...nel.org
> Signed-off-by: Sven Peter <sven@...nel.org>

Reviewed-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>

> ---
>  drivers/usb/typec/tipd/core.c | 24 +++++++++++-------------
>  1 file changed, 11 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index dcf141ada07812295a6f07e41d77f95f98116010..1c80296c3b273e24ceacb3feff432c4f6e6835cc 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -545,24 +545,23 @@ static irqreturn_t cd321x_interrupt(int irq, void *data)
>  	if (!event)
>  		goto err_unlock;
>  
> +	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
> +
>  	if (!tps6598x_read_status(tps, &status))
> -		goto err_clear_ints;
> +		goto err_unlock;
>  
>  	if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE)
>  		if (!tps6598x_read_power_status(tps))
> -			goto err_clear_ints;
> +			goto err_unlock;
>  
>  	if (event & APPLE_CD_REG_INT_DATA_STATUS_UPDATE)
>  		if (!tps6598x_read_data_status(tps))
> -			goto err_clear_ints;
> +			goto err_unlock;
>  
>  	/* Handle plug insert or removal */
>  	if (event & APPLE_CD_REG_INT_PLUG_EVENT)
>  		tps6598x_handle_plug_event(tps, status);
>  
> -err_clear_ints:
> -	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
> -
>  err_unlock:
>  	mutex_unlock(&tps->lock);
>  
> @@ -668,25 +667,24 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
>  	if (!(event1[0] | event1[1] | event2[0] | event2[1]))
>  		goto err_unlock;
>  
> +	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
> +	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
> +
>  	if (!tps6598x_read_status(tps, &status))
> -		goto err_clear_ints;
> +		goto err_unlock;
>  
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
>  		if (!tps6598x_read_power_status(tps))
> -			goto err_clear_ints;
> +			goto err_unlock;
>  
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
>  		if (!tps6598x_read_data_status(tps))
> -			goto err_clear_ints;
> +			goto err_unlock;
>  
>  	/* Handle plug insert or removal */
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
>  		tps6598x_handle_plug_event(tps, status);
>  
> -err_clear_ints:
> -	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
> -	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
> -
>  err_unlock:
>  	mutex_unlock(&tps->lock);
>  
> 
> -- 
> 2.34.1
> 

-- 
heikki