From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga14.intel.com ([192.55.52.115]:9556 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727212AbeI0Wug (ORCPT ); Thu, 27 Sep 2018 18:50:36 -0400 Subject: Re: [RFT PATCH 2/2] xhci: handle port status events for removed USB3 hcd To: jackp@codeaurora.org Cc: peter.chen@nxp.com, linux-imx@nxp.com, linux-usb@vger.kernel.org, jun.li@nxp.com, joel@jms.id.au, mrana@codeaurora.org, stable@vger.kernel.org References: <20180927013948.GB17520@jackp-linux.qualcomm.com> <1538065587-22997-1-git-send-email-mathias.nyman@linux.intel.com> <1538065587-22997-2-git-send-email-mathias.nyman@linux.intel.com> From: Mathias Nyman Message-ID: <43b03dcc-6cae-07b1-402e-f17b63e2f564@linux.intel.com> Date: Thu, 27 Sep 2018 19:34:32 +0300 MIME-Version: 1.0 In-Reply-To: <1538065587-22997-2-git-send-email-mathias.nyman@linux.intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: On 27.09.2018 19:26, Mathias Nyman wrote: > At xhci removal the USB3 hcd (shared_hcd) is removed before the primary > USB2 hcd. Interrupts for port status changes may still occur for USB3 > ports after the shared_hcd is freed, causing NULL pointer dereference. > > Check if xhci->shared_hcd is still valid before handing USB3 port events > > Cc: > Reported-by: Peter Chen > Signed-off-by: Mathias Nyman > --- > drivers/usb/host/xhci-ring.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c > index f0a99aa..3d314b8 100644 > --- a/drivers/usb/host/xhci-ring.c > +++ b/drivers/usb/host/xhci-ring.c > @@ -1552,6 +1552,13 @@ static void handle_port_status(struct xhci_hcd *xhci, > goto cleanup; > } > > + /* We might get interrupts after shared_hcd is removed */ > + if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) { > + xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n"); > + bogus_port_status = true; > + goto cleanup; > + } > + > hcd = port->rhub->hcd; > bus_state = &xhci->bus_state[hcd_index(hcd)]; > hcd_portnum = port->hcd_portnum; > This probably only applies from 4.18 onwards, to test on older kernel try something like this instead: diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 6996235..7925da9 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1606,7 +1606,11 @@ static void handle_port_status(struct xhci_hcd *xhci, hcd = xhci_to_hcd(xhci); if ((major_revision == 0x03) != (hcd->speed >= HCD_USB3)) hcd = xhci->shared_hcd; - + if (!hcd) { + bogus_port_status = true; + goto cleanup; + } if (major_revision == 0) { xhci_warn(xhci, "Event for port %u not in " "Extended Capabilities, ignoring.\n", Jack, Peter, do these patches solve the remove issues you are seeing? Thanks -Mathias