* [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings [not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com> @ 2017-12-01 11:41 ` Mathias Nyman 2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman 1 sibling, 0 replies; 5+ messages in thread From: Mathias Nyman @ 2017-12-01 11:41 UTC (permalink / raw) To: gregkh; +Cc: linux-usb, Mathias Nyman, stable xHC can generate two events for a short transfer if the short TRB and last TRB in the TD are not the same TRB. The driver will handle the TD after the first short event, and remove it from its internal list. Driver then incorrectly prints a warning for the second event: "WARN Event TRB for slot x ep y with no TDs queued" Fix this by not printing a warning if we get a event on a empty list if the previous event was a short event. Cc: <stable@vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> --- drivers/usb/host/xhci-ring.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index c239c68..6eb87c6 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2477,12 +2477,16 @@ static int handle_tx_event(struct xhci_hcd *xhci, */ if (list_empty(&ep_ring->td_list)) { /* - * A stopped endpoint may generate an extra completion - * event if the device was suspended. Don't print - * warnings. + * Don't print wanings if it's due to a stopped endpoint + * generating an extra completion event if the device + * was suspended. Or, a event for the last TRB of a + * short TD we already got a short event for. + * The short TD is already removed from the TD list. */ + if (!(trb_comp_code == COMP_STOPPED || - trb_comp_code == COMP_STOPPED_LENGTH_INVALID)) { + trb_comp_code == COMP_STOPPED_LENGTH_INVALID || + ep_ring->last_td_was_short)) { xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n", TRB_TO_SLOT_ID(le32_to_cpu(event->flags)), ep_index); -- 2.7.4 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first [not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com> 2017-12-01 11:41 ` [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings Mathias Nyman @ 2017-12-01 11:41 ` Mathias Nyman 2017-12-01 14:38 ` Guenter Roeck 1 sibling, 1 reply; 5+ messages in thread From: Mathias Nyman @ 2017-12-01 11:41 UTC (permalink / raw) To: gregkh Cc: linux-usb, Yu Chen, Guenter Roeck, # v4 . 10+, Fan Ning, Li Rui, yangdi, Mathias Nyman From: Yu Chen <chenyu56@huawei.com> Check vdev->real_port 0 to avoid panic [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108 [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570 [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8 [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0 [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8 [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70 [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108 [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40 [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120 [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210 [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0 [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488 [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8 [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490 [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0 [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100 [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50 The problem can occur if xhci_plat_remove() is called shortly after xhci_plat_probe(). While xhci_free_virt_devices_depth_first been called before the device has been setup and get real_port initialized. The problem occurred on Hikey960 and was reproduced by Guenter Roeck on Kevin with chromeos-4.4. Cc: Guenter Roeck <groeck@google.com> Cc: <stable@vger.kernel.org> # v4.10+ Reviewed-by: Guenter Roeck <groeck@chromium.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Fan Ning <fanning4@hisilicon.com> Signed-off-by: Li Rui <lirui39@hisilicon.com> Signed-off-by: yangdi <yangdi10@hisilicon.com> Signed-off-by: Yu Chen <chenyu56@huawei.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> --- drivers/usb/host/xhci-mem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index e1fba46..15f7d42 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -934,6 +934,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id) if (!vdev) return; + if (vdev->real_port == 0 || + vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) { + xhci_dbg(xhci, "Bad vdev->real_port.\n"); + goto out; + } + tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts); list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) { /* is this a hub device that added a tt_info to the tts list */ @@ -947,6 +953,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id) } } } +out: /* we are now at a leaf device */ xhci_debugfs_remove_slot(xhci, slot_id); xhci_free_virt_device(xhci, slot_id); -- 2.7.4 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first 2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman @ 2017-12-01 14:38 ` Guenter Roeck 2017-12-01 15:23 ` Greg Kroah-Hartman 0 siblings, 1 reply; 5+ messages in thread From: Guenter Roeck @ 2017-12-01 14:38 UTC (permalink / raw) To: Mathias Nyman Cc: Greg Kroah-Hartman, linux-usb, Yu Chen, # v4 . 10+, Fan Ning, Li Rui, yangdi On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman <mathias.nyman@linux.intel.com> wrote: > From: Yu Chen <chenyu56@huawei.com> > > Check vdev->real_port 0 to avoid panic > [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108 > [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570 > [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8 > [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0 > [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8 > [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70 > [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108 > [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40 > [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120 > [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210 > [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0 > [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488 > [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8 > [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490 > [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0 > [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100 > [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50 > > The problem can occur if xhci_plat_remove() is called shortly after > xhci_plat_probe(). While xhci_free_virt_devices_depth_first been > called before the device has been setup and get real_port initialized. > The problem occurred on Hikey960 and was reproduced by Guenter Roeck > on Kevin with chromeos-4.4. > > Cc: Guenter Roeck <groeck@google.com> > Cc: <stable@vger.kernel.org> # v4.10+ Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first") would probably be better. That patch is in v4.4.y as well as in v4.9.y, and thus both releases are affected. Thanks, Guenter > Reviewed-by: Guenter Roeck <groeck@chromium.org> > Tested-by: Guenter Roeck <linux@roeck-us.net> > Signed-off-by: Fan Ning <fanning4@hisilicon.com> > Signed-off-by: Li Rui <lirui39@hisilicon.com> > Signed-off-by: yangdi <yangdi10@hisilicon.com> > Signed-off-by: Yu Chen <chenyu56@huawei.com> > Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> > --- > drivers/usb/host/xhci-mem.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c > index e1fba46..15f7d42 100644 > --- a/drivers/usb/host/xhci-mem.c > +++ b/drivers/usb/host/xhci-mem.c > @@ -934,6 +934,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id) > if (!vdev) > return; > > + if (vdev->real_port == 0 || > + vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) { > + xhci_dbg(xhci, "Bad vdev->real_port.\n"); > + goto out; > + } > + > tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts); > list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) { > /* is this a hub device that added a tt_info to the tts list */ > @@ -947,6 +953,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id) > } > } > } > +out: > /* we are now at a leaf device */ > xhci_debugfs_remove_slot(xhci, slot_id); > xhci_free_virt_device(xhci, slot_id); > -- > 2.7.4 > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first 2017-12-01 14:38 ` Guenter Roeck @ 2017-12-01 15:23 ` Greg Kroah-Hartman 2017-12-04 9:16 ` Mathias Nyman 0 siblings, 1 reply; 5+ messages in thread From: Greg Kroah-Hartman @ 2017-12-01 15:23 UTC (permalink / raw) To: Guenter Roeck Cc: Mathias Nyman, linux-usb, Yu Chen, # v4 . 10+, Fan Ning, Li Rui, yangdi On Fri, Dec 01, 2017 at 06:38:16AM -0800, Guenter Roeck wrote: > On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman > <mathias.nyman@linux.intel.com> wrote: > > From: Yu Chen <chenyu56@huawei.com> > > > > Check vdev->real_port 0 to avoid panic > > [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108 > > [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570 > > [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8 > > [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0 > > [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8 > > [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70 > > [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108 > > [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40 > > [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120 > > [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210 > > [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0 > > [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488 > > [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8 > > [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490 > > [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0 > > [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100 > > [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50 > > > > The problem can occur if xhci_plat_remove() is called shortly after > > xhci_plat_probe(). While xhci_free_virt_devices_depth_first been > > called before the device has been setup and get real_port initialized. > > The problem occurred on Hikey960 and was reproduced by Guenter Roeck > > on Kevin with chromeos-4.4. > > > > Cc: Guenter Roeck <groeck@google.com> > > Cc: <stable@vger.kernel.org> # v4.10+ > > Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first") > > would probably be better. That patch is in v4.4.y as well as in > v4.9.y, and thus both releases are affected. I've added this fixes line, thanks. greg k-h ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first 2017-12-01 15:23 ` Greg Kroah-Hartman @ 2017-12-04 9:16 ` Mathias Nyman 0 siblings, 0 replies; 5+ messages in thread From: Mathias Nyman @ 2017-12-04 9:16 UTC (permalink / raw) To: Greg Kroah-Hartman, Guenter Roeck Cc: linux-usb, Yu Chen, # v4 . 10+, Fan Ning, Li Rui, yangdi On 01.12.2017 17:23, Greg Kroah-Hartman wrote: > On Fri, Dec 01, 2017 at 06:38:16AM -0800, Guenter Roeck wrote: >> On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman >> <mathias.nyman@linux.intel.com> wrote: >>> From: Yu Chen <chenyu56@huawei.com> >>> >>> Check vdev->real_port 0 to avoid panic >>> [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108 >>> [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570 >>> [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8 >>> [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0 >>> [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8 >>> [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70 >>> [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108 >>> [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40 >>> [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120 >>> [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210 >>> [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0 >>> [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488 >>> [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8 >>> [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490 >>> [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0 >>> [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100 >>> [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50 >>> >>> The problem can occur if xhci_plat_remove() is called shortly after >>> xhci_plat_probe(). While xhci_free_virt_devices_depth_first been >>> called before the device has been setup and get real_port initialized. >>> The problem occurred on Hikey960 and was reproduced by Guenter Roeck >>> on Kevin with chromeos-4.4. >>> >>> Cc: Guenter Roeck <groeck@google.com> >>> Cc: <stable@vger.kernel.org> # v4.10+ >> >> Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first") >> >> would probably be better. That patch is in v4.4.y as well as in >> v4.9.y, and thus both releases are affected. > > I've added this fixes line, thanks. > Thanks -Mathias ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-12-04 9:14 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com>
2017-12-01 11:41 ` [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings Mathias Nyman
2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman
2017-12-01 14:38 ` Guenter Roeck
2017-12-01 15:23 ` Greg Kroah-Hartman
2017-12-04 9:16 ` Mathias Nyman
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).