Re: [PATCH] usb: xhci: Fix ep0 maxpacket update on enabled slots

[Mathias Nyman <mathias.nyman@linux.intel.com>]

On 11/9/26 12:28, Michal Pecio wrote:
> A slot in Enabled state has uninitialized output contexts;
> it doesn't need and cannot accept Evaluate Context command.
> Attempting the command only results in a (harmless) warning,
> observed when core uses "old scheme" on a full-speed device:
> 
>    WARN: invalid context state for evaluate context command.
> 
> This problem doesn't seem to have existed before ep0 update
> was moved from urb_enqueue() to endpoint_reset(). USB core
> doesn't use URBs before enable_device() or address_device(),
> but it may call endpoint_reset() on ep0.
> 
> A more serious bug has been identified by Sashiko review bot.
> Transaction Error of Address Device may cause the slot to be
> reallocated and left in Enabled state, but the input context
> is (needlessly) regenerated before actually being needed by
> the next Address Device. xhci_check_ep0_maxpacket() corrupts
> this context by copying uninitialized ep0 output context.
> 
> This matters when core resets a device and doesn't reallocate
> udev after address_device() errors. Some HCs reject the next
> Address Device with Parameter Error, some break. ASMedia HCs
> write a Setup Stage TRB to the event ring and stop working:
> 
>    ERROR unknown event type 2
>    INFO: task usbreset:4071 blocked for more than 122 seconds.
> 
> This exact case is a relatively recent regression, but even
> if xhci_setup_device() didn't regenerate the input context
> on Transaction Error, next iteration could regenerate it and
> keep it there when command timeout leaves the slot Enabled.
> 
> We can kill both bugs with one stone by checking slot state.
> If it's Enabled, do nothing and let next xhci_setup_device()
> configure ep0 later. It will actually ignore the packet size
> requested by core, but its defaults match core expectations
> at the time of address_device() and enable_device() calls.
> 
> Fixes: e34900f46cd6 ("xhci: Reconfigure endpoint 0 max packet size only during endpoint reset")
> Fixes: af8e119f52e9 ("xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration")
> Signed-off-by: Michal Pecio <michal.pecio@gmail.com>

Added to queue

Thanks
Mathias