From: Jimmy Hu <hhhuuu(a)google.com>
When the host controller is not responding, all URBs queued to all
endpoints need to be killed. This can cause a kernel panic if we
dereference an invalid endpoint.
Fix this by using xhci_get_virt_ep() helper to find the endpoint and
checking if the endpoint is valid before dereferencing it.
[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead
[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8
[233311.853964] pc : xhci_hc_died+0x10c/0x270
[233311.853971] lr : xhci_hc_died+0x1ac/0x270
[233311.854077] Call trace:
[233311.854085] xhci_hc_died+0x10c/0x270
[233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4
[233311.854105] call_timer_fn+0x50/0x2d4
[233311.854112] expire_timers+0xac/0x2e4
[233311.854118] run_timer_softirq+0x300/0xabc
[233311.854127] __do_softirq+0x148/0x528
[233311.854135] irq_exit+0x194/0x1a8
[233311.854143] __handle_domain_irq+0x164/0x1d0
[233311.854149] gic_handle_irq.22273+0x10c/0x188
[233311.854156] el1_irq+0xfc/0x1a8
[233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm]
[233311.854185] cpuidle_enter_state+0x1f0/0x764
[233311.854194] do_idle+0x594/0x6ac
[233311.854201] cpu_startup_entry+0x7c/0x80
[233311.854209] secondary_start_kernel+0x170/0x198
Fixes: 50e8725e7c42 ("xhci: Refactor command watchdog and fix split string.")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jimmy Hu <hhhuuu(a)google.com>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
---
drivers/usb/host/xhci-ring.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index ddc30037f9ce..f5b0e1ce22af 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1169,7 +1169,10 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,
struct xhci_virt_ep *ep;
struct xhci_ring *ring;
- ep = &xhci->devs[slot_id]->eps[ep_index];
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep)
+ return;
+
if ((ep->ep_state & EP_HAS_STREAMS) ||
(ep->ep_state & EP_GETTING_NO_STREAMS)) {
int stream_id;
--
2.25.1
This is the start of the stable review cycle for the 4.19.274 release.
There are 12 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 25 Feb 2023 14:15:30 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.274-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.274-rc2
Linus Torvalds <torvalds(a)linux-foundation.org>
bpf: add missing header file include
Kees Cook <keescook(a)chromium.org>
ext4: Fix function prototype mismatch for ext4_feat_ktype
Lukas Wunner <lukas(a)wunner.de>
wifi: mwifiex: Add missing compatible string for SD8787
Dave Hansen <dave.hansen(a)linux.intel.com>
uaccess: Add speculation barrier to copy_from_user()
Pavel Skripkin <paskripkin(a)gmail.com>
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
Zheng Wang <zyytlz.wz(a)163.com>
drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Thomas Gleixner <tglx(a)linutronix.de>
alarmtimer: Prevent starvation by small intervals and SIG_IGN
Sean Anderson <sean.anderson(a)seco.com>
powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
Jason A. Donenfeld <Jason(a)zx2c4.com>
random: always mix cycle counter in add_latent_entropy()
Sean Anderson <sean.anderson(a)seco.com>
powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
Bitterblue Smith <rtl8821cerfe2(a)gmail.com>
wifi: rtl8xxxu: gen2: Turn on the rate control
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++++
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++++
arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 20 ++++-
drivers/gpu/drm/i915/gvt/gtt.c | 17 ++++-
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 +++++---
drivers/net/wireless/marvell/mwifiex/sdio.c | 1 +
.../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 +-
fs/ext4/sysfs.c | 7 +-
include/linux/nospec.h | 4 +
include/linux/random.h | 6 +-
kernel/bpf/core.c | 3 +-
kernel/time/alarmtimer.c | 33 +++++++-
lib/usercopy.c | 7 ++
net/mac80211/ieee80211_i.h | 24 +++++-
net/mac80211/mesh.h | 22 +-----
net/mac80211/mesh_pathtbl.c | 89 ++++++++--------------
17 files changed, 252 insertions(+), 114 deletions(-)
This is the start of the stable review cycle for the 5.4.233 release.
There are 19 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 25 Feb 2023 14:15:30 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.233-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.233-rc2
Linus Torvalds <torvalds(a)linux-foundation.org>
bpf: add missing header file include
Vladimir Oltean <vladimir.oltean(a)nxp.com>
Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs"
Kees Cook <keescook(a)chromium.org>
ext4: Fix function prototype mismatch for ext4_feat_ktype
Lukas Wunner <lukas(a)wunner.de>
wifi: mwifiex: Add missing compatible string for SD8787
Dave Hansen <dave.hansen(a)linux.intel.com>
uaccess: Add speculation barrier to copy_from_user()
Pavel Skripkin <paskripkin(a)gmail.com>
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
Zheng Wang <zyytlz.wz(a)163.com>
drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Thomas Gleixner <tglx(a)linutronix.de>
alarmtimer: Prevent starvation by small intervals and SIG_IGN
Sean Anderson <sean.anderson(a)seco.com>
powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
Marc Kleine-Budde <mkl(a)pengutronix.de>
can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
Jim Mattson <jmattson(a)google.com>
KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
Sean Christopherson <seanjc(a)google.com>
KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
Jason A. Donenfeld <Jason(a)zx2c4.com>
random: always mix cycle counter in add_latent_entropy()
Sean Anderson <sean.anderson(a)seco.com>
powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
Bitterblue Smith <rtl8821cerfe2(a)gmail.com>
wifi: rtl8xxxu: gen2: Turn on the rate control
Lucas Stach <l.stach(a)pengutronix.de>
drm/etnaviv: don't truncate physical page address
Marek Szyprowski <m.szyprowski(a)samsung.com>
drm: etnaviv: fix common struct sg_table related issues
Marek Szyprowski <m.szyprowski(a)samsung.com>
scatterlist: add generic wrappers for iterating over sgtable objects
Marek Szyprowski <m.szyprowski(a)samsung.com>
dma-mapping: add generic helpers for mapping sgtable objects
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++++
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++++
arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 20 ++++-
arch/x86/kvm/vmx/nested.c | 11 +++
arch/x86/kvm/vmx/vmx.c | 6 +-
arch/x86/kvm/x86.c | 4 +-
drivers/gpu/drm/etnaviv/etnaviv_gem.c | 12 ++-
drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 19 ++---
drivers/gpu/drm/i915/gvt/gtt.c | 17 ++++-
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 +++++---
drivers/net/wireless/marvell/mwifiex/sdio.c | 1 +
.../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 +-
fs/ext4/sysfs.c | 7 +-
include/linux/dma-mapping.h | 80 +++++++++++++++++++
include/linux/nospec.h | 4 +
include/linux/random.h | 6 +-
include/linux/scatterlist.h | 50 +++++++++++-
kernel/bpf/core.c | 3 +-
kernel/time/alarmtimer.c | 33 +++++++-
lib/usercopy.c | 7 ++
net/mac80211/ieee80211_i.h | 24 +++++-
net/mac80211/mesh.h | 22 +-----
net/mac80211/mesh_pathtbl.c | 89 ++++++++--------------
net/sched/sch_taprio.c | 8 +-
25 files changed, 411 insertions(+), 145 deletions(-)