* [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings
[not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com>
@ 2017-12-01 11:41 ` Mathias Nyman
2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman
1 sibling, 0 replies; 5+ messages in thread
From: Mathias Nyman @ 2017-12-01 11:41 UTC (permalink / raw)
To: gregkh; +Cc: linux-usb, Mathias Nyman, stable
xHC can generate two events for a short transfer if the short TRB and
last TRB in the TD are not the same TRB.
The driver will handle the TD after the first short event, and remove
it from its internal list. Driver then incorrectly prints a warning
for the second event:
"WARN Event TRB for slot x ep y with no TDs queued"
Fix this by not printing a warning if we get a event on a empty list
if the previous event was a short event.
Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
drivers/usb/host/xhci-ring.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c239c68..6eb87c6 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2477,12 +2477,16 @@ static int handle_tx_event(struct xhci_hcd *xhci,
*/
if (list_empty(&ep_ring->td_list)) {
/*
- * A stopped endpoint may generate an extra completion
- * event if the device was suspended. Don't print
- * warnings.
+ * Don't print wanings if it's due to a stopped endpoint
+ * generating an extra completion event if the device
+ * was suspended. Or, a event for the last TRB of a
+ * short TD we already got a short event for.
+ * The short TD is already removed from the TD list.
*/
+
if (!(trb_comp_code == COMP_STOPPED ||
- trb_comp_code == COMP_STOPPED_LENGTH_INVALID)) {
+ trb_comp_code == COMP_STOPPED_LENGTH_INVALID ||
+ ep_ring->last_td_was_short)) {
xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
ep_index);
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first
[not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com>
2017-12-01 11:41 ` [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings Mathias Nyman
@ 2017-12-01 11:41 ` Mathias Nyman
2017-12-01 14:38 ` Guenter Roeck
1 sibling, 1 reply; 5+ messages in thread
From: Mathias Nyman @ 2017-12-01 11:41 UTC (permalink / raw)
To: gregkh
Cc: linux-usb, Yu Chen, Guenter Roeck, # v4 . 10+, Fan Ning, Li Rui,
yangdi, Mathias Nyman
From: Yu Chen <chenyu56@huawei.com>
Check vdev->real_port 0 to avoid panic
[ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108
[ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570
[ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8
[ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0
[ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8
[ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70
[ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108
[ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40
[ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120
[ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210
[ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0
[ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488
[ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8
[ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490
[ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0
[ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100
[ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50
The problem can occur if xhci_plat_remove() is called shortly after
xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
called before the device has been setup and get real_port initialized.
The problem occurred on Hikey960 and was reproduced by Guenter Roeck
on Kevin with chromeos-4.4.
Cc: Guenter Roeck <groeck@google.com>
Cc: <stable@vger.kernel.org> # v4.10+
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Fan Ning <fanning4@hisilicon.com>
Signed-off-by: Li Rui <lirui39@hisilicon.com>
Signed-off-by: yangdi <yangdi10@hisilicon.com>
Signed-off-by: Yu Chen <chenyu56@huawei.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
drivers/usb/host/xhci-mem.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index e1fba46..15f7d42 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -934,6 +934,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
if (!vdev)
return;
+ if (vdev->real_port == 0 ||
+ vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
+ xhci_dbg(xhci, "Bad vdev->real_port.\n");
+ goto out;
+ }
+
tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
/* is this a hub device that added a tt_info to the tts list */
@@ -947,6 +953,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
}
}
}
+out:
/* we are now at a leaf device */
xhci_debugfs_remove_slot(xhci, slot_id);
xhci_free_virt_device(xhci, slot_id);
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first
2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman
@ 2017-12-01 14:38 ` Guenter Roeck
2017-12-01 15:23 ` Greg Kroah-Hartman
0 siblings, 1 reply; 5+ messages in thread
From: Guenter Roeck @ 2017-12-01 14:38 UTC (permalink / raw)
To: Mathias Nyman
Cc: Greg Kroah-Hartman, linux-usb, Yu Chen, # v4 . 10+, Fan Ning,
Li Rui, yangdi
On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman
<mathias.nyman@linux.intel.com> wrote:
> From: Yu Chen <chenyu56@huawei.com>
>
> Check vdev->real_port 0 to avoid panic
> [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108
> [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570
> [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8
> [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0
> [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8
> [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70
> [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108
> [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40
> [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120
> [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210
> [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0
> [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488
> [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8
> [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490
> [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0
> [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100
> [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50
>
> The problem can occur if xhci_plat_remove() is called shortly after
> xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
> called before the device has been setup and get real_port initialized.
> The problem occurred on Hikey960 and was reproduced by Guenter Roeck
> on Kevin with chromeos-4.4.
>
> Cc: Guenter Roeck <groeck@google.com>
> Cc: <stable@vger.kernel.org> # v4.10+
Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first")
would probably be better. That patch is in v4.4.y as well as in
v4.9.y, and thus both releases are affected.
Thanks,
Guenter
> Reviewed-by: Guenter Roeck <groeck@chromium.org>
> Tested-by: Guenter Roeck <linux@roeck-us.net>
> Signed-off-by: Fan Ning <fanning4@hisilicon.com>
> Signed-off-by: Li Rui <lirui39@hisilicon.com>
> Signed-off-by: yangdi <yangdi10@hisilicon.com>
> Signed-off-by: Yu Chen <chenyu56@huawei.com>
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
> ---
> drivers/usb/host/xhci-mem.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index e1fba46..15f7d42 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -934,6 +934,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
> if (!vdev)
> return;
>
> + if (vdev->real_port == 0 ||
> + vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
> + xhci_dbg(xhci, "Bad vdev->real_port.\n");
> + goto out;
> + }
> +
> tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
> list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
> /* is this a hub device that added a tt_info to the tts list */
> @@ -947,6 +953,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
> }
> }
> }
> +out:
> /* we are now at a leaf device */
> xhci_debugfs_remove_slot(xhci, slot_id);
> xhci_free_virt_device(xhci, slot_id);
> --
> 2.7.4
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first
2017-12-01 14:38 ` Guenter Roeck
@ 2017-12-01 15:23 ` Greg Kroah-Hartman
2017-12-04 9:16 ` Mathias Nyman
0 siblings, 1 reply; 5+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-01 15:23 UTC (permalink / raw)
To: Guenter Roeck
Cc: Mathias Nyman, linux-usb, Yu Chen, # v4 . 10+, Fan Ning, Li Rui,
yangdi
On Fri, Dec 01, 2017 at 06:38:16AM -0800, Guenter Roeck wrote:
> On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman
> <mathias.nyman@linux.intel.com> wrote:
> > From: Yu Chen <chenyu56@huawei.com>
> >
> > Check vdev->real_port 0 to avoid panic
> > [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108
> > [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570
> > [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8
> > [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0
> > [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8
> > [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70
> > [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108
> > [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40
> > [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120
> > [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210
> > [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0
> > [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488
> > [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8
> > [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490
> > [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0
> > [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100
> > [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50
> >
> > The problem can occur if xhci_plat_remove() is called shortly after
> > xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
> > called before the device has been setup and get real_port initialized.
> > The problem occurred on Hikey960 and was reproduced by Guenter Roeck
> > on Kevin with chromeos-4.4.
> >
> > Cc: Guenter Roeck <groeck@google.com>
> > Cc: <stable@vger.kernel.org> # v4.10+
>
> Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first")
>
> would probably be better. That patch is in v4.4.y as well as in
> v4.9.y, and thus both releases are affected.
I've added this fixes line, thanks.
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first
2017-12-01 15:23 ` Greg Kroah-Hartman
@ 2017-12-04 9:16 ` Mathias Nyman
0 siblings, 0 replies; 5+ messages in thread
From: Mathias Nyman @ 2017-12-04 9:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, Guenter Roeck
Cc: linux-usb, Yu Chen, # v4 . 10+, Fan Ning, Li Rui, yangdi
On 01.12.2017 17:23, Greg Kroah-Hartman wrote:
> On Fri, Dec 01, 2017 at 06:38:16AM -0800, Guenter Roeck wrote:
>> On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman
>> <mathias.nyman@linux.intel.com> wrote:
>>> From: Yu Chen <chenyu56@huawei.com>
>>>
>>> Check vdev->real_port 0 to avoid panic
>>> [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108
>>> [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570
>>> [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8
>>> [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0
>>> [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8
>>> [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70
>>> [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108
>>> [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40
>>> [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120
>>> [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210
>>> [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0
>>> [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488
>>> [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8
>>> [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490
>>> [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0
>>> [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100
>>> [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50
>>>
>>> The problem can occur if xhci_plat_remove() is called shortly after
>>> xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
>>> called before the device has been setup and get real_port initialized.
>>> The problem occurred on Hikey960 and was reproduced by Guenter Roeck
>>> on Kevin with chromeos-4.4.
>>>
>>> Cc: Guenter Roeck <groeck@google.com>
>>> Cc: <stable@vger.kernel.org> # v4.10+
>>
>> Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first")
>>
>> would probably be better. That patch is in v4.4.y as well as in
>> v4.9.y, and thus both releases are affected.
>
> I've added this fixes line, thanks.
>
Thanks
-Mathias
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-12-04 9:14 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com>
2017-12-01 11:41 ` [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings Mathias Nyman
2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman
2017-12-01 14:38 ` Guenter Roeck
2017-12-01 15:23 ` Greg Kroah-Hartman
2017-12-04 9:16 ` Mathias Nyman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).