From patchwork Thu Dec 9 03:14:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?Q2h1bmZlbmcgWXVuICjkupHmmKXls7Ap?= X-Patchwork-Id: 12665727 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1F76BC433EF for ; Thu, 9 Dec 2021 03:19:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=jTYVgjd33qP4A9NgtBmgy+kFctBxycCbn97FSpI4aFQ=; b=2K0AiHGH9WlIRZ 1y9JpRr6gtftzIWv6l/Nuspv7nkNEvGaLuHqJYwjIPtuJjHHpiq8N8VVpUW6VZ/HKTHP+4Xq0ZG6p Yx2rXN5NbX9RDKrys3j1rmjNYc2iXPf85UHMiakR0vhJaOleT99pTzR0C6HgQMA+qQh4XqqCdDj0X LgImRP9s2JRXucpyAjqhM0y93ZZru1vI0P2Y6ToJHuE1WHldwwlGrw3Lb7TLs4o4xcj7pgTlCEr/C 5gd/DD6GI1DyBsydVn82D9KQle0DYqfhVvq+5R1geZHEGd2bhFPkMYPn9tlYfpQOIwBvDLNVQBk+1 JA9o17PSPazIblU0leWA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9xU-00EoxR-BZ; Thu, 09 Dec 2021 03:19:00 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9xS-00Eowy-HM; Thu, 09 Dec 2021 03:18:59 +0000 X-UUID: 77c206b1c4004dcbb02932ef2ae9c031-20211208 X-UUID: 77c206b1c4004dcbb02932ef2ae9c031-20211208 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 2096936; Wed, 08 Dec 2021 20:18:55 -0700 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by MTKMBS62N2.mediatek.inc (172.29.193.42) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 8 Dec 2021 19:14:23 -0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 9 Dec 2021 11:14:26 +0800 Received: from mhfsdcap04.gcn.mediatek.inc (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 9 Dec 2021 11:14:25 +0800 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , Matthias Brugger , , , , , Eddie Hung , "Yuwen Ng" Subject: [PATCH 1/3] usb: mtu3: fix interval value for intr and isoc Date: Thu, 9 Dec 2021 11:14:22 +0800 Message-ID: <20211209031424.17842-1-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211208_191858_619680_D779EFD7 X-CRM114-Status: GOOD ( 11.01 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org Use the Interval value from isoc/intr endpoint descriptor, no need minus one. But the original code doesn't cause transfer error for normal cases, due to the interval is less than the host request. Signed-off-by: Chunfeng Yun --- drivers/usb/mtu3/mtu3_gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index a9a65b4bbfed..c51be015345b 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -77,7 +77,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { interval = desc->bInterval; - interval = clamp_val(interval, 1, 16) - 1; + interval = clamp_val(interval, 1, 16); if (usb_endpoint_xfer_isoc(desc) && comp_desc) mult = comp_desc->bmAttributes; } @@ -89,7 +89,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_isoc(desc) || usb_endpoint_xfer_int(desc)) { interval = desc->bInterval; - interval = clamp_val(interval, 1, 16) - 1; + interval = clamp_val(interval, 1, 16); mult = usb_endpoint_maxp_mult(desc) - 1; } break; From patchwork Thu Dec 9 03:14:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?Q2h1bmZlbmcgWXVuICjkupHmmKXls7Ap?= X-Patchwork-Id: 12665719 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8A96AC433EF for ; Thu, 9 Dec 2021 03:14:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=cbEIwkgNoeM+dmwZTuA3kacbRm1Q6C9TIYffx2AKLpg=; b=C6YMxQlq2EocRD OxaafXj5t6Zd2h9dbRbRTMc770ZNNfYSy5QMJT5rlvXTrDM2TB0xnk1xGIRpSpAApG+PEuegF30Qj WsXYpT0LWN/rTIpvMB7YBq8Gd+QDiqpHAoqLC6GnwFUWJnKhIuZ/dR8TWQoFeAiZcwAlpBqoUHgB5 sR7xl6aQmLnaGaBulTedrYsD+jwvav3Rb7U2cr9cABWF/6aAsLCy8fZHvvAa0yRMFpJlsPQaHC7q7 IaForb2xKkb6GW0VaVgT1vB8RHK5s8Hao509M8JzvCnt2hg48aDVCRroC+bYCcayC0XrtK2U1Zpf8 UhLt6Yl9sa3WkLOo9rBA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9tC-00Eo7b-El; Thu, 09 Dec 2021 03:14:34 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9t9-00Eo6f-Rj; Thu, 09 Dec 2021 03:14:33 +0000 X-UUID: dca3811c7d8c49238c13c16fb6eec9cf-20211208 X-UUID: dca3811c7d8c49238c13c16fb6eec9cf-20211208 Received: from mtkcas67.mediatek.inc [(172.29.193.45)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1602197447; Wed, 08 Dec 2021 20:14:29 -0700 Received: from MTKMBS07N2.mediatek.inc (172.21.101.141) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 8 Dec 2021 19:14:28 -0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n2.mediatek.inc (172.21.101.141) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 9 Dec 2021 11:14:27 +0800 Received: from mhfsdcap04.gcn.mediatek.inc (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 9 Dec 2021 11:14:26 +0800 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , Matthias Brugger , , , , , Eddie Hung , "Yuwen Ng" , Subject: [PATCH 2/3] usb: mtu3: add memory barrier before set GPD's HWO Date: Thu, 9 Dec 2021 11:14:23 +0800 Message-ID: <20211209031424.17842-2-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211209031424.17842-1-chunfeng.yun@mediatek.com> References: <20211209031424.17842-1-chunfeng.yun@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211208_191431_926627_A9D5DE70 X-CRM114-Status: GOOD ( 10.46 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org There is a seldom issue that the controller access invalid address and trigger devapc or emimpu violation. That is due to memory access is out of order and cause gpd data is not correct. Make sure GPD is fully written before giving it to HW by setting its HWO. Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") Cc: stable@vger.kernel.org Reported-by: Eddie Hung Signed-off-by: Chunfeng Yun --- drivers/usb/mtu3/mtu3_qmu.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c index 3f414f91b589..34bb5ac67efe 100644 --- a/drivers/usb/mtu3/mtu3_qmu.c +++ b/drivers/usb/mtu3/mtu3_qmu.c @@ -273,6 +273,8 @@ static int mtu3_prepare_tx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) gpd->dw3_info |= cpu_to_le32(GPD_EXT_FLAG_ZLP); } + /* make sure GPD is fully written before giving it to HW */ + mb(); gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); mreq->gpd = gpd; @@ -306,6 +308,8 @@ static int mtu3_prepare_rx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) gpd->next_gpd = cpu_to_le32(lower_32_bits(enq_dma)); ext_addr |= GPD_EXT_NGP(mtu, upper_32_bits(enq_dma)); gpd->dw3_info = cpu_to_le32(ext_addr); + /* make sure GPD is fully written before giving it to HW */ + mb(); gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); mreq->gpd = gpd; @@ -445,7 +449,8 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) return; } mtu3_setbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_TXPKTRDY); - + /* make sure GPD is fully written before giving it to HW */ + mb(); /* by pass the current GDP */ gpd_current->dw0_info |= cpu_to_le32(GPD_FLAGS_BPS | GPD_FLAGS_HWO); From patchwork Thu Dec 9 03:14:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?Q2h1bmZlbmcgWXVuICjkupHmmKXls7Ap?= X-Patchwork-Id: 12665721 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 98C0CC433EF for ; Thu, 9 Dec 2021 03:15:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=IqW58ZHy4g7P9u3/YOU76LTc9H0D7jAQtp00SdpX9k8=; b=RQzY/dnugSlhDa m46zSnzW5DmTBVXcnl3Wia+uFsi6BOoaJNKXKpNsUWSgelcIHMfhO9tnCDLPfJIlkluZJFCXH5bD/ 02S+NB6XhywLhmqWu6eTZo8O8JTLEEfA9153KJQtr+fO3Wk5EDC/1ad3YQ7KxiZYgmclXEPuxS0Du LnmJzL6xRjY3Kd43LoQZdCkMuRHkCR4rCIbqtH5D3AYrzgNnImoQa9TIhkXic90dpbxer0uJb3xbs nqcWqtepGgk4f607BSH0Ii6tJ4AllnzbKPeAtLQWsSPsPEO9J9vURIZmjAY/fbvI+I7M36LsKVRz6 zwKP6zpvyLu6+xZbzh2A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9tX-00EoDH-Bm; Thu, 09 Dec 2021 03:14:55 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9tA-00Eo6u-Eo; Thu, 09 Dec 2021 03:14:33 +0000 X-UUID: ae6d3e17f4b94180bc665d6b78bdd026-20211208 X-UUID: ae6d3e17f4b94180bc665d6b78bdd026-20211208 Received: from mtkcas67.mediatek.inc [(172.29.193.45)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1940876414; Wed, 08 Dec 2021 20:14:29 -0700 Received: from mtkmbs10n1.mediatek.inc (172.21.101.34) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 8 Dec 2021 19:14:29 -0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.15; Thu, 9 Dec 2021 11:14:27 +0800 Received: from mhfsdcap04.gcn.mediatek.inc (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 9 Dec 2021 11:14:26 +0800 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , Matthias Brugger , , , , , Eddie Hung , "Yuwen Ng" Subject: [PATCH 3/3] usb: mtu3: fix list_head check warning Date: Thu, 9 Dec 2021 11:14:24 +0800 Message-ID: <20211209031424.17842-3-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211209031424.17842-1-chunfeng.yun@mediatek.com> References: <20211209031424.17842-1-chunfeng.yun@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211208_191432_520901_510A8360 X-CRM114-Status: UNSURE ( 7.35 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org This is caused by uninitialization of list_head. BUG: KASAN: use-after-free in __list_del_entry_valid+0x34/0xe4 Call trace: dump_backtrace+0x0/0x298 show_stack+0x24/0x34 dump_stack+0x130/0x1a8 print_address_description+0x88/0x56c __kasan_report+0x1b8/0x2a0 kasan_report+0x14/0x20 __asan_load8+0x9c/0xa0 __list_del_entry_valid+0x34/0xe4 mtu3_req_complete+0x4c/0x300 [mtu3] mtu3_gadget_stop+0x168/0x448 [mtu3] usb_gadget_unregister_driver+0x204/0x3a0 unregister_gadget_item+0x44/0xa4 Reported-by: Yuwen Ng Signed-off-by: Chunfeng Yun --- drivers/usb/mtu3/mtu3_gadget.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index c51be015345b..b6c8a4a99c4d 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -235,6 +235,7 @@ struct usb_request *mtu3_alloc_request(struct usb_ep *ep, gfp_t gfp_flags) mreq->request.dma = DMA_ADDR_INVALID; mreq->epnum = mep->epnum; mreq->mep = mep; + INIT_LIST_HEAD(&mreq->list); trace_mtu3_alloc_request(mreq); return &mreq->request;