From patchwork Fri Jan 17 07:41:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Macpaul Lin X-Patchwork-Id: 11338461 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 49377109A for ; Fri, 17 Jan 2020 07:42:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2450D2082F for ; Fri, 17 Jan 2020 07:42:17 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="izdTNWFq" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729207AbgAQHmN (ORCPT ); Fri, 17 Jan 2020 02:42:13 -0500 Received: from mailgw01.mediatek.com ([210.61.82.183]:42877 "EHLO mailgw01.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1729159AbgAQHmN (ORCPT ); Fri, 17 Jan 2020 02:42:13 -0500 X-UUID: 91eeb4d187c7412cb5fc19a8ebfeeb86-20200117 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=XlVHRJUiQa0Jm/lTprpguXiXjS3b7Bht7uRo2za199k=; b=izdTNWFqdjMNAZtC4TMrjRJqR7uydOUzTwPTMWwgbMNFRRdhKsruhxQ8XqwdwQ4H8QCQqE5VeuCoCE3HFk+Ph51sqchHrDhIXo1LRH24121x0aoe/J6YDu29INUT94yIJAtVCrgS7TCTgU4DcYzk5IvilT4rA7hFFswPLfzAvHA=; X-UUID: 91eeb4d187c7412cb5fc19a8ebfeeb86-20200117 Received: from mtkexhb01.mediatek.inc [(172.21.101.102)] by mailgw01.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.10 Build 0809 with TLS) with ESMTP id 17940661; Fri, 17 Jan 2020 15:42:06 +0800 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs07n2.mediatek.inc (172.21.101.141) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 17 Jan 2020 15:41:33 +0800 Received: from mtkswgap22.mediatek.inc (172.21.77.33) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Fri, 17 Jan 2020 15:41:10 +0800 From: Macpaul Lin To: Mathias Nyman , Greg Kroah-Hartman , Matthias Brugger , , , , , Chunfeng Yun CC: Mediatek WSD Upstream , Macpaul Lin , Sriharsha Allenki Subject: [PATCH] xhci-mtk: Fix NULL pointer dereference with xhci_irq() for shared_hcd Date: Fri, 17 Jan 2020 15:41:50 +0800 Message-ID: <1579246910-22736-1-git-send-email-macpaul.lin@mediatek.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 X-MTK: N Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org According to NULL pointer fix: https://tinyurl.com/uqft5ra xhci: Fix NULL pointer dereference with xhci_irq() for shared_hcd The similar issue has also been found in QC activities in Mediatek. Here quote the description from the referenced patch as follows. "Commit ("f068090426ea xhci: Fix leaking USB3 shared_hcd at xhci removal") sets xhci_shared_hcd to NULL without stopping xhci host. This results into a race condition where shared_hcd (super speed roothub) related interrupts are being handled with xhci_irq happens when the xhci_plat_remove is called and shared_hcd is set to NULL. Fix this by setting the shared_hcd to NULL only after the controller is halted and no interrupts are generated." Signed-off-by: Sriharsha Allenki Signed-off-by: Macpaul Lin --- drivers/usb/host/xhci-mtk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c index b18a6baef204..c227c67f5dc5 100644 --- a/drivers/usb/host/xhci-mtk.c +++ b/drivers/usb/host/xhci-mtk.c @@ -593,11 +593,11 @@ static int xhci_mtk_remove(struct platform_device *dev) struct usb_hcd *shared_hcd = xhci->shared_hcd; usb_remove_hcd(shared_hcd); - xhci->shared_hcd = NULL; device_init_wakeup(&dev->dev, false); usb_remove_hcd(hcd); usb_put_hcd(shared_hcd); + xhci->shared_hcd = NULL; usb_put_hcd(hcd); xhci_mtk_sch_exit(mtk); xhci_mtk_clks_disable(mtk);