Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()

xHCI hardware maintains its endpoint state between add_endpoint()
and drop_endpoint() calls followed by successful check_bandwidth().
So does the driver.

Core may call endpoint_disable() during xHCI endpoint life, so don't
clear host_ep->hcpriv then, because this breaks endpoint_reset().

If a driver calls usb_set_interface(), submits URBs which make host
sequence state non-zero and calls usb_clear_halt(), the device clears
its sequence state but xhci_endpoint_reset() bails out. The next URB
malfunctions: USB2 loses one packet, USB3 gets Transaction Error or
may not complete at all on some (buggy?) HCs from ASMedia and AMD.
This is triggered by uvcvideo on bulk video devices.

The code was copied from ehci_endpoint_disable() but it isn't needed
here - hcpriv should only be NULL on emulated root hub endpoints.
It might prevent resetting and inadvertently enabling a disabled and
dropped endpoint, but core shouldn't try to reset dropped endpoints.

Document xhci requirements regarding hcpriv. They are currently met.

Fixes: 18b74067ac78 ("xhci: Fix use-after-free regression in xhci clear hub TT implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260402131342.2628648-26-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Michal Pecio and committed by
Greg Kroah-Hartman
25e531b4 dad6711b

+2 -2
-1
drivers/usb/host/xhci.c
··· 3292 3292 xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n", 3293 3293 ep->ep_state); 3294 3294 done: 3295 - host_ep->hcpriv = NULL; 3296 3295 spin_unlock_irqrestore(&xhci->lock, flags); 3297 3296 } 3298 3297
+2 -1
include/linux/usb.h
··· 54 54 * @eusb2_isoc_ep_comp: eUSB2 isoc companion descriptor for this endpoint 55 55 * @urb_list: urbs queued to this endpoint; maintained by usbcore 56 56 * @hcpriv: for use by HCD; typically holds hardware dma queue head (QH) 57 - * with one or more transfer descriptors (TDs) per urb 57 + * with one or more transfer descriptors (TDs) per urb; must be preserved 58 + * by core while BW is allocated for the endpoint 58 59 * @ep_dev: ep_device for sysfs info 59 60 * @extra: descriptors following this endpoint in the configuration 60 61 * @extralen: how many bytes of "extra" are valid