Hi Greg,
On Tue, Apr 02, 2024 at 09:52:47AM +0200, Greg Kroah-Hartman wrote:
On Tue, Apr 02, 2024 at 08:06:52AM +0200, Christian A. Ehrhardt wrote:
Hi Greg,
On Tue, Apr 02, 2024 at 07:40:43AM +0200, Greg Kroah-Hartman wrote:
On Mon, Apr 01, 2024 at 10:16:45PM +0200, Christian A. Ehrhardt wrote:
Hi Greg,
On Mon, Apr 01, 2024 at 05:47:21PM +0200, Greg Kroah-Hartman wrote:
6.1-stable review patch. If anyone has any objections, please let me know.
From: Christian A. Ehrhardt lk@c--e.de
commit 808a8b9e0b87bbc72bcc1f7ddfe5d04746e7ce56 upstream.
The completion notification for the final SET_NOTIFICATION_ENABLE command during initialization can include a connector change notification. However, at the time this completion notification is processed, the ucsi struct is not ready to handle this notification. As a result the notification is ignored and the controller never sends an interrupt again.
Re-check CCI for a pending connector state change after initialization is complete. Adjust the corresponding debug message accordingly.
Fixes: 71a1fa0df2a3 ("usb: typec: ucsi: Store the notification mask") Cc: stable@vger.kernel.org Signed-off-by: Christian A. Ehrhardt lk@c--e.de Reviewed-by: Heikki Krogerus heikki.krogerus@linux.intel.com Tested-by: Neil Armstrong neil.armstrong@linaro.org # on SM8550-QRD Link: https://lore.kernel.org/r/20240320073927.1641788-3-lk@c--e.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
drivers/usb/typec/ucsi/ucsi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
This change has an out of bounds memory access. Please drop it from the stable trees until a fix is available.
Shouldn't we get a fix for Linus's tree too? Have I missed that somewhere? Or should this just be reverted now?
I posted the fix a few hours after sending this mail. It is here: https://lore.kernel.org/all/20240401210515.1902048-1-lk@c--e.de/
Either this should be fast tracked to Linus or the original change reverted, yes.
I've dropped the offending commit from the stable queues now. Once this fix gets into Linus's tree, let us know and I will add both in then.
The fix for 808a8b9e0b87 ("usb: typec: ucsi: Check for notifications after init") has hit Linus's tree as ce4c8d21054a ("usb: typec: ucsi: Fix connector check on init")
There is no urgency but this is to let you know that the original commit is eligible for -stable again, provided that the follow up commit is backported, too.
Best regards, Christian