From patchwork Thu Dec 9 03:14:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chunfeng Yun X-Patchwork-Id: 12695434 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7349BC433F5 for ; Thu, 9 Dec 2021 03:20:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=FD+OCFkEBX4bxLPA96UioVGhtGDj1CZU5+E86flWvEw=; b=VwDBIXnAsi8TFc nDPLfwTi2rJrNYh3kFhAgWCMxi9d1O37H2CZqTDJrH0Lw0mFvg+oNy4biP/NqxE8ZcnqmeJ1wu4AN vOj4MKUt+rOgw9Z5Gw+Hp1yBD20JZrwcU9UhnlOHbMN8o5t3959vs+oXmpAy8bJTvhZTFCMA135Ph o2Qtv9dYONyCf0yuODIgyFGDPZYo3dg17qQFgGwh/EWioEVr6vBMhygQZO6I8uO1zrwVFH6xSWqgo FlQRSNPpun4dZ/k4rylCrEf4GKmskLg3bFpjsKWWWyaAGcdVBs+EPMnE+d6CgNANZn688av8EQBOA S/vo+6UqRNrie0lNFdEQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9xW-00Eoxc-9p; Thu, 09 Dec 2021 03:19:02 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9xS-00Eowy-HM; Thu, 09 Dec 2021 03:18:59 +0000 X-UUID: 77c206b1c4004dcbb02932ef2ae9c031-20211208 X-UUID: 77c206b1c4004dcbb02932ef2ae9c031-20211208 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 2096936; Wed, 08 Dec 2021 20:18:55 -0700 Received: from mtkmbs07n1.mediatek.inc (172.21.101.16) by MTKMBS62N2.mediatek.inc (172.29.193.42) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 8 Dec 2021 19:14:23 -0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n1.mediatek.inc (172.21.101.16) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 9 Dec 2021 11:14:26 +0800 Received: from mhfsdcap04.gcn.mediatek.inc (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 9 Dec 2021 11:14:25 +0800 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , Matthias Brugger , , , , , Eddie Hung , "Yuwen Ng" Subject: [PATCH 1/3] usb: mtu3: fix interval value for intr and isoc Date: Thu, 9 Dec 2021 11:14:22 +0800 Message-ID: <20211209031424.17842-1-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211208_191858_619680_D779EFD7 X-CRM114-Status: GOOD ( 11.01 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Use the Interval value from isoc/intr endpoint descriptor, no need minus one. But the original code doesn't cause transfer error for normal cases, due to the interval is less than the host request. Signed-off-by: Chunfeng Yun --- drivers/usb/mtu3/mtu3_gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index a9a65b4bbfed..c51be015345b 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -77,7 +77,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { interval = desc->bInterval; - interval = clamp_val(interval, 1, 16) - 1; + interval = clamp_val(interval, 1, 16); if (usb_endpoint_xfer_isoc(desc) && comp_desc) mult = comp_desc->bmAttributes; } @@ -89,7 +89,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_isoc(desc) || usb_endpoint_xfer_int(desc)) { interval = desc->bInterval; - interval = clamp_val(interval, 1, 16) - 1; + interval = clamp_val(interval, 1, 16); mult = usb_endpoint_maxp_mult(desc) - 1; } break; From patchwork Thu Dec 9 03:14:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chunfeng Yun X-Patchwork-Id: 12695433 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C2E4EC433F5 for ; Thu, 9 Dec 2021 03:16:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=FCtL+itrRw2EqzqYSiQrO8Wsmuqre7CbBJpxYwZvbQE=; b=VqAKkMUESESSf6 BICBVlgb3ZOKZgRslzhwUuNcwxEQ2rhsCGOkUsr7yk5Qj0neOtOlJ6xkO/YpY11qhuMMdtCQ7PJ0o TMRYbu5zevLDXrfzaohpGMbEkz4Y1yx4faLOv468ahcN4EvU6zpI8qhGEJRvZjjpkjMoVCZIhGyqO EZBii7Ng1gcj8AVkckqHWUm7hrQlHVV838YA//Vn1qbaTeSotC3jk0l09U6+WYFmHc2DWQpnZtxjX 9vZzEis/gOog3G0IFNQoD9M9v7sMzXDwd8sU0qe0FUq2PfWJj5IBi1GJOUWiCRl/B0iPwSMDZNLij fJu5+57szaxfAHCotpCQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9tE-00Eo7l-Cn; Thu, 09 Dec 2021 03:14:36 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9t9-00Eo6f-Rj; Thu, 09 Dec 2021 03:14:33 +0000 X-UUID: dca3811c7d8c49238c13c16fb6eec9cf-20211208 X-UUID: dca3811c7d8c49238c13c16fb6eec9cf-20211208 Received: from mtkcas67.mediatek.inc [(172.29.193.45)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1602197447; Wed, 08 Dec 2021 20:14:29 -0700 Received: from MTKMBS07N2.mediatek.inc (172.21.101.141) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 8 Dec 2021 19:14:28 -0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs07n2.mediatek.inc (172.21.101.141) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 9 Dec 2021 11:14:27 +0800 Received: from mhfsdcap04.gcn.mediatek.inc (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 9 Dec 2021 11:14:26 +0800 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , Matthias Brugger , , , , , Eddie Hung , "Yuwen Ng" , Subject: [PATCH 2/3] usb: mtu3: add memory barrier before set GPD's HWO Date: Thu, 9 Dec 2021 11:14:23 +0800 Message-ID: <20211209031424.17842-2-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211209031424.17842-1-chunfeng.yun@mediatek.com> References: <20211209031424.17842-1-chunfeng.yun@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211208_191431_926627_A9D5DE70 X-CRM114-Status: GOOD ( 10.46 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org There is a seldom issue that the controller access invalid address and trigger devapc or emimpu violation. That is due to memory access is out of order and cause gpd data is not correct. Make sure GPD is fully written before giving it to HW by setting its HWO. Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") Cc: stable@vger.kernel.org Reported-by: Eddie Hung Signed-off-by: Chunfeng Yun --- drivers/usb/mtu3/mtu3_qmu.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c index 3f414f91b589..34bb5ac67efe 100644 --- a/drivers/usb/mtu3/mtu3_qmu.c +++ b/drivers/usb/mtu3/mtu3_qmu.c @@ -273,6 +273,8 @@ static int mtu3_prepare_tx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) gpd->dw3_info |= cpu_to_le32(GPD_EXT_FLAG_ZLP); } + /* make sure GPD is fully written before giving it to HW */ + mb(); gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); mreq->gpd = gpd; @@ -306,6 +308,8 @@ static int mtu3_prepare_rx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) gpd->next_gpd = cpu_to_le32(lower_32_bits(enq_dma)); ext_addr |= GPD_EXT_NGP(mtu, upper_32_bits(enq_dma)); gpd->dw3_info = cpu_to_le32(ext_addr); + /* make sure GPD is fully written before giving it to HW */ + mb(); gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); mreq->gpd = gpd; @@ -445,7 +449,8 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) return; } mtu3_setbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_TXPKTRDY); - + /* make sure GPD is fully written before giving it to HW */ + mb(); /* by pass the current GDP */ gpd_current->dw0_info |= cpu_to_le32(GPD_FLAGS_BPS | GPD_FLAGS_HWO); From patchwork Thu Dec 9 03:14:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chunfeng Yun X-Patchwork-Id: 12695432 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2B3F3C433EF for ; Thu, 9 Dec 2021 03:16:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=usACrTAU+K2oNMMGetsevE0Q9XtStyG5zHM6OmGjx9s=; b=2xDylaXeoqz4ML KahaE5sp/pYLz+3SBBxIQN7ltvxes5MPS15HEkBQWhAhpKrUeH9Fr2jWt8TiH89wEpvtWBDKFXmaI +3REy1QXFSZIbQ7IJcH82xr1hIwZoW3NdmNXZkHGGlglMNYHDo3DJvWLOeC2z7I1v2uriQe22hTtV OTeHG+l2sBj5pkHg0nNh9J8+K7K0foWyzvPUcn3Gj3uaaQSwt21FLk1xHNJ5zr5AI7Gt0QhFd5R5M X4RPRF26IEtLN0DD4y3FzZh7Ah5ZBAfjHMitSsj+DbPP8rvitTg7oAUUcjzsjFcg6BJ+MKakWmqHg XWIOOQ90n6bLo9pl6zXA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9tO-00EoBF-El; Thu, 09 Dec 2021 03:14:46 +0000 Received: from mailgw01.mediatek.com ([216.200.240.184]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mv9tA-00Eo6u-Eo; Thu, 09 Dec 2021 03:14:33 +0000 X-UUID: ae6d3e17f4b94180bc665d6b78bdd026-20211208 X-UUID: ae6d3e17f4b94180bc665d6b78bdd026-20211208 Received: from mtkcas67.mediatek.inc [(172.29.193.45)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1940876414; Wed, 08 Dec 2021 20:14:29 -0700 Received: from mtkmbs10n1.mediatek.inc (172.21.101.34) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 8 Dec 2021 19:14:29 -0800 Received: from mtkcas10.mediatek.inc (172.21.101.39) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.15; Thu, 9 Dec 2021 11:14:27 +0800 Received: from mhfsdcap04.gcn.mediatek.inc (10.17.3.154) by mtkcas10.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 9 Dec 2021 11:14:26 +0800 From: Chunfeng Yun To: Greg Kroah-Hartman CC: Chunfeng Yun , Matthias Brugger , , , , , Eddie Hung , "Yuwen Ng" Subject: [PATCH 3/3] usb: mtu3: fix list_head check warning Date: Thu, 9 Dec 2021 11:14:24 +0800 Message-ID: <20211209031424.17842-3-chunfeng.yun@mediatek.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211209031424.17842-1-chunfeng.yun@mediatek.com> References: <20211209031424.17842-1-chunfeng.yun@mediatek.com> MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211208_191432_520901_510A8360 X-CRM114-Status: UNSURE ( 7.35 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org This is caused by uninitialization of list_head. BUG: KASAN: use-after-free in __list_del_entry_valid+0x34/0xe4 Call trace: dump_backtrace+0x0/0x298 show_stack+0x24/0x34 dump_stack+0x130/0x1a8 print_address_description+0x88/0x56c __kasan_report+0x1b8/0x2a0 kasan_report+0x14/0x20 __asan_load8+0x9c/0xa0 __list_del_entry_valid+0x34/0xe4 mtu3_req_complete+0x4c/0x300 [mtu3] mtu3_gadget_stop+0x168/0x448 [mtu3] usb_gadget_unregister_driver+0x204/0x3a0 unregister_gadget_item+0x44/0xa4 Reported-by: Yuwen Ng Signed-off-by: Chunfeng Yun --- drivers/usb/mtu3/mtu3_gadget.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index c51be015345b..b6c8a4a99c4d 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -235,6 +235,7 @@ struct usb_request *mtu3_alloc_request(struct usb_ep *ep, gfp_t gfp_flags) mreq->request.dma = DMA_ADDR_INVALID; mreq->epnum = mep->epnum; mreq->mep = mep; + INIT_LIST_HEAD(&mreq->list); trace_mtu3_alloc_request(mreq); return &mreq->request;