Linux USB
 help / color / mirror / Atom feed
From: Michal Pecio <michal.pecio@gmail.com>
To: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: yiyu@yiyuzhou.io, <linux-usb@vger.kernel.org>,
	regressions@lists.linux.dev, diogochaves@me.com,
	raoxu@uniontech.com, dennis@dsine.de, gregkh@linuxfoundation.org
Subject: [PATCH 1/4] usb: xhci: Fix TD invalidation on disconnected endpoints
Date: Thu, 29 Oct 2026 07:54:59 +0100	[thread overview]
Message-ID: <20261029075459.64108477.michal.pecio@gmail.com> (raw)
In-Reply-To: <20261029075409.4b203658.michal.pecio@gmail.com>

This code prevents queuing Set TR Dequeue commands to endpoints of
disconnected devices. Turns out, USB core may "resuscitate" these
devices if a reset is requested before disconnection and completed
after reconnection, leading to reuse of the default endpoint.

Make sure that the default endpoint is cleaned up properly - TRBs
are erased (just in case, as usual) and Dequeue is set to Enqueue.
And don't overwrite TD_HALTED status, we may need it when resetting
of halted disconnected control endpoints is implemented later to
further prepare them for resuscitation.

Reported-by: Dennis Wissel <dennis@dsine.de>
Link: https://lore.kernel.org/linux-usb/SrQQcLIwRWyg9PdEIpc0eg@dsine.de/
Fixes: 7e0ef4332ed9 ("xhci: avoid xHC endpoint changes after disconnect or link error.")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
---
 drivers/usb/host/xhci-ring.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index fa6684746305..7049787725fb 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1061,12 +1061,6 @@ static int xhci_invalidate_cancelled_tds(struct xhci_hcd *xhci, struct xhci_virt
 			continue;
 		}
 
-		/* device disconnected or link error, ep will be dropped */
-		if (ep->ep_state & EP_DROP_PENDING) {
-			td->cancel_status = TD_CLEARED;
-			continue;
-		}
-
 		/*
 		 * If a ring stopped on the TD we need to cancel then we have to
 		 * move the xHC endpoint ring dequeue pointer past this TD.
@@ -1118,6 +1112,12 @@ static int xhci_invalidate_cancelled_tds(struct xhci_hcd *xhci, struct xhci_virt
 	if (!cached_td)
 		return 0;
 
+	/* Don't bother fixing disconnected endpoints except EP0 */
+	if (ep->ep_state & EP_DROP_PENDING && ep->ep_index != 0) {
+		cached_td->cancel_status = TD_CLEARED;
+		return 0;
+	}
+
 	err = xhci_move_deq_to_next_td(xhci, ep, cached_td->urb->stream_id);
 
 	if (err) {
-- 
2.48.1

  reply	other threads:[~2026-10-29  6:55 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-24 17:47 [REGRESSION] usbhid -110 timeouts and reset loop for Keychron M5 (3434:d068) at boot since v7.3 Dennis Wissel
2026-10-24 20:34 ` Yiyu Zhou
2026-10-24 20:35 ` Yiyu Zhou
2026-10-24 23:10   ` Dennis Wissel
2026-10-25  8:59     ` Thorsten Leemhuis
2026-10-26  9:28       ` Mathias Nyman
2026-10-26  9:49         ` Thorsten Leemhuis
2026-10-26 10:47         ` Greg KH
2026-10-25 10:14     ` Michal Pecio
2026-10-25 11:11       ` Dennis Wissel
2026-10-26 11:15         ` Michal Pecio
2026-10-26 20:39           ` Yiyu Zhou
2026-10-27  7:29             ` Dennis Wissel
2026-10-27  8:48               ` [PATCH] xhci: keep ep0 blocked after disconnect until Address Device reloads it Yiyu Zhou
2026-10-27  9:10                 ` sashiko-bot
2026-10-27 10:36                 ` Mathias Nyman
2026-10-27 11:27                   ` Michal Pecio
2026-10-27 18:40                   ` Yiyu Zhou
2026-10-27 19:21                     ` [RFT PATCH 0/2] xhci: clean up endpoint rings after disconnect detect Mathias Nyman
2026-10-27 19:21                       ` [RFT PATCH 1/2] xhci: give back all TDs when skipping endpoint reset after disconnect Mathias Nyman
2026-10-27 19:21                       ` [RFT PATCH 2/2] xhci: clean up ep0 ring after disconnect instead of leaving stale TRBs Mathias Nyman
2026-10-27 23:05                       ` [RFT PATCH 0/2] xhci: clean up endpoint rings after disconnect detect Dennis Wissel
2026-10-28  7:07                       ` Michal Pecio
2026-10-29  6:54                         ` [PATCH 0/4] Fix problems on disconnected devices in 7.3 Michal Pecio
2026-10-29  6:54                           ` Michal Pecio [this message]
2026-10-29  7:12                             ` [PATCH 1/4] usb: xhci: Fix TD invalidation on disconnected endpoints sashiko-bot
2026-10-29  6:55                           ` [PATCH 2/4] usb: xhci: Give back stranded URBs " Michal Pecio
2026-10-29  6:56                           ` [PATCH 3/4] usb: xhci: Give back URBs on halted " Michal Pecio
2026-10-29  6:57                           ` [PATCH 4/4] usb: xhci: Reject URBs to disconnected devices Michal Pecio
2026-10-29  4:18                       ` [RFT PATCH 0/2] xhci: clean up endpoint rings after disconnect detect Yiyu Zhou
2026-10-27 10:58             ` [REGRESSION] usbhid -110 timeouts and reset loop for Keychron M5 (3434:d068) at boot since v7.3 Michal Pecio
2026-10-26  9:18       ` Mathias Nyman
2026-10-26  9:51         ` Michal Pecio
2026-10-26 11:38           ` Michal Pecio
2026-10-26 11:54             ` Mathias Nyman
2026-10-26 18:56           ` Alan Stern
2026-10-26 18:58             ` Alan Stern
2026-10-25  6:28 ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261029075459.64108477.michal.pecio@gmail.com \
    --to=michal.pecio@gmail.com \
    --cc=dennis@dsine.de \
    --cc=diogochaves@me.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=mathias.nyman@linux.intel.com \
    --cc=raoxu@uniontech.com \
    --cc=regressions@lists.linux.dev \
    --cc=yiyu@yiyuzhou.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox