From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Mathias Nyman <mathias.nyman@linux.intel.com>,
Carsten Schmid <carsten_schmid@mentor.com>
Subject: [PATCH 4.14 82/82] xhci: add xhci_get_virt_ep() helper
Date: Mon, 26 Jul 2021 17:39:22 +0200 [thread overview]
Message-ID: <20210726153830.844177432@linuxfoundation.org> (raw)
In-Reply-To: <20210726153828.144714469@linuxfoundation.org>
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[commit b1adc42d440df3233255e313a45ab7e9b2b74096 upstream]
In several event handlers we need to find the right endpoint
structure from slot_id and ep_index in the event.
Add a helper for this, check that slot_id and ep_index are valid.
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210129130044.206855-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Carsten Schmid <carsten_schmid@mentor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 58 +++++++++++++++++++++++++++++++++----------
drivers/usb/host/xhci.h | 3 +-
2 files changed, 47 insertions(+), 14 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -444,6 +444,26 @@ static void ring_doorbell_for_active_rin
}
}
+static struct xhci_virt_ep *xhci_get_virt_ep(struct xhci_hcd *xhci,
+ unsigned int slot_id,
+ unsigned int ep_index)
+{
+ if (slot_id == 0 || slot_id >= MAX_HC_SLOTS) {
+ xhci_warn(xhci, "Invalid slot_id %u\n", slot_id);
+ return NULL;
+ }
+ if (ep_index >= EP_CTX_PER_DEV) {
+ xhci_warn(xhci, "Invalid endpoint index %u\n", ep_index);
+ return NULL;
+ }
+ if (!xhci->devs[slot_id]) {
+ xhci_warn(xhci, "No xhci virt device for slot_id %u\n", slot_id);
+ return NULL;
+ }
+
+ return &xhci->devs[slot_id]->eps[ep_index];
+}
+
/* Get the right ring for the given slot_id, ep_index and stream_id.
* If the endpoint supports streams, boundary check the URB's stream ID.
* If the endpoint doesn't support streams, return the singular endpoint ring.
@@ -454,7 +474,10 @@ struct xhci_ring *xhci_triad_to_transfer
{
struct xhci_virt_ep *ep;
- ep = &xhci->devs[slot_id]->eps[ep_index];
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep)
+ return NULL;
+
/* Common case: no streams */
if (!(ep->ep_state & EP_HAS_STREAMS))
return ep->ring;
@@ -729,11 +752,14 @@ static void xhci_handle_cmd_stop_ep(stru
memset(&deq_state, 0, sizeof(deq_state));
ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep)
+ return;
+
vdev = xhci->devs[slot_id];
ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
trace_xhci_handle_cmd_stop_ep(ep_ctx);
- ep = &xhci->devs[slot_id]->eps[ep_index];
last_unlinked_td = list_last_entry(&ep->cancelled_td_list,
struct xhci_td, cancelled_td_list);
@@ -1057,9 +1083,11 @@ static void xhci_handle_cmd_set_deq(stru
ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
stream_id = TRB_TO_STREAM_ID(le32_to_cpu(trb->generic.field[2]));
- dev = xhci->devs[slot_id];
- ep = &dev->eps[ep_index];
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep)
+ return;
+ dev = xhci->devs[slot_id];
ep_ring = xhci_stream_id_to_ring(dev, ep_index, stream_id);
if (!ep_ring) {
xhci_warn(xhci, "WARN Set TR deq ptr command for freed stream ID %u\n",
@@ -1132,9 +1160,9 @@ static void xhci_handle_cmd_set_deq(stru
}
cleanup:
- dev->eps[ep_index].ep_state &= ~SET_DEQ_PENDING;
- dev->eps[ep_index].queued_deq_seg = NULL;
- dev->eps[ep_index].queued_deq_ptr = NULL;
+ ep->ep_state &= ~SET_DEQ_PENDING;
+ ep->queued_deq_seg = NULL;
+ ep->queued_deq_ptr = NULL;
/* Restart any rings with pending URBs */
ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
}
@@ -1143,10 +1171,15 @@ static void xhci_handle_cmd_reset_ep(str
union xhci_trb *trb, u32 cmd_comp_code)
{
struct xhci_virt_device *vdev;
+ struct xhci_virt_ep *ep;
struct xhci_ep_ctx *ep_ctx;
unsigned int ep_index;
ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep)
+ return;
+
vdev = xhci->devs[slot_id];
ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
trace_xhci_handle_cmd_reset_ep(ep_ctx);
@@ -1176,7 +1209,7 @@ static void xhci_handle_cmd_reset_ep(str
xhci_ring_cmd_db(xhci);
} else {
/* Clear our internal halted state */
- xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
+ ep->ep_state &= ~EP_HALTED;
}
}
@@ -2352,14 +2385,13 @@ static int handle_tx_event(struct xhci_h
trb_comp_code = GET_COMP_CODE(le32_to_cpu(event->transfer_len));
ep_trb_dma = le64_to_cpu(event->buffer);
- xdev = xhci->devs[slot_id];
- if (!xdev) {
- xhci_err(xhci, "ERROR Transfer event pointed to bad slot %u\n",
- slot_id);
+ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
+ if (!ep) {
+ xhci_err(xhci, "ERROR Invalid Transfer event\n");
goto err_out;
}
- ep = &xdev->eps[ep_index];
+ xdev = xhci->devs[slot_id];
ep_ring = xhci_dma_to_transfer_ring(ep, ep_trb_dma);
ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -991,6 +991,7 @@ struct xhci_interval_bw_table {
unsigned int ss_bw_out;
};
+#define EP_CTX_PER_DEV 31
struct xhci_virt_device {
struct usb_device *udev;
@@ -1005,7 +1006,7 @@ struct xhci_virt_device {
struct xhci_container_ctx *out_ctx;
/* Used for addressing devices and configuration changes */
struct xhci_container_ctx *in_ctx;
- struct xhci_virt_ep eps[31];
+ struct xhci_virt_ep eps[EP_CTX_PER_DEV];
u8 fake_port;
u8 real_port;
struct xhci_interval_bw_table *bw_table;
next prev parent reply other threads:[~2021-07-26 15:51 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-26 15:38 [PATCH 4.14 00/82] 4.14.241-rc1 review Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 01/82] ARM: dts: gemini: add device_type on pci Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 02/82] ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 03/82] arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 04/82] ARM: dts: rockchip: Fix the timer clocks order Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 05/82] ARM: dts: rockchip: Fix power-controller node names for rk3288 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 06/82] arm64: dts: rockchip: Fix power-controller node names for rk3328 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 07/82] reset: ti-syscon: fix to_ti_syscon_reset_data macro Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 08/82] ARM: brcmstb: dts: fix NAND nodes names Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 09/82] ARM: Cygnus: " Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 10/82] ARM: NSP: " Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 11/82] ARM: dts: BCM63xx: Fix " Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 12/82] ARM: dts: imx6: phyFLEX: Fix UART hardware flow control Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 13/82] ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 14/82] ARM: dts: stm32: fix RCC node name on stm32f429 MCU Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 15/82] arm64: dts: juno: Update SCPI nodes as per the YAML schema Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 16/82] arm64: dts: ls208xa: remove bus-num from dspi node Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 17/82] thermal/core: Correct function name thermal_zone_device_unregister() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 18/82] kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 19/82] rtc: max77686: Do not enforce (incorrect) interrupt trigger type Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 20/82] scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 21/82] scsi: libfc: Fix array index out of bound exception Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 22/82] sched/fair: Fix CFS bandwidth hrtimer expiry type Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 23/82] net: ipv6: fix return value of ip6_skb_dst_mtu Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 24/82] netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 25/82] net: bridge: sync fdb to new unicast-filtering ports Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 26/82] net: bcmgenet: Ensure all TX/RX queues DMAs are disabled Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 27/82] net: moxa: fix UAF in moxart_mac_probe Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 28/82] net: qcom/emac: fix UAF in emac_remove Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 29/82] net: ti: fix UAF in tlan_remove_one Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 30/82] net: send SYNACK packet with accepted fwmark Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 31/82] net: validate lwtstate->data before returning from skb_tunnel_info() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 32/82] dma-buf/sync_file: Dont leak fences on merge failure Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 33/82] tcp: annotate data races around tp->mtu_info Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 34/82] ipv6: tcp: drop silly ICMPv6 packet too big messages Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 35/82] igb: Fix use-after-free error during reset Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 36/82] ixgbe: Fix an error handling path in ixgbe_probe() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 37/82] igb: Fix an error handling path in igb_probe() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 38/82] fm10k: Fix an error handling path in fm10k_probe() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 39/82] e1000e: Fix an error handling path in e1000_probe() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 40/82] iavf: Fix an error handling path in iavf_probe() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 41/82] igb: Check if num of q_vectors is smaller than max before array access Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 42/82] perf map: Fix dso->nsinfo refcounting Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 43/82] perf probe: " Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 44/82] perf test session_topology: Delete session->evlist Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 45/82] perf lzma: Close lzma stream on exit Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 46/82] perf test bpf: Free obj_buf Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 47/82] perf probe-file: Delete namelist in del_events() on the error path Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 48/82] spi: mediatek: fix fifo rx mode Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 49/82] liquidio: Fix unintentional sign extension issue on left shift of u16 Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 50/82] s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 51/82] net: fix uninit-value in caif_seqpkt_sendmsg Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 52/82] net: decnet: Fix sleeping inside in af_decnet Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 53/82] netrom: Decrease sock refcount when sock timers expire Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 54/82] scsi: iscsi: Fix iface sysfs attr detection Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 55/82] scsi: target: Fix protect handling in WRITE SAME(32) Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 56/82] spi: cadence: Correct initialisation of runtime PM again Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 57/82] Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 58/82] proc: Avoid mixing integer types in mem_rw() Greg Kroah-Hartman
2021-07-26 15:38 ` [PATCH 4.14 59/82] [PATCH] Revert "MIPS: add PMD table accounting into MIPSpmd_alloc_one" Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 60/82] s390/ftrace: fix ftrace_update_ftrace_func implementation Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 61/82] ALSA: sb: Fix potential ABBA deadlock in CSP driver Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 62/82] xhci: Fix lost USB 2 remote wake Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 63/82] KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 64/82] usb: hub: Disable USB 3 device initiated lpm if exit latency is too high Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 65/82] USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 66/82] usb: max-3421: Prevent corruption of freed memory Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 67/82] usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 68/82] USB: serial: option: add support for u-blox LARA-R6 family Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 69/82] USB: serial: cp210x: fix comments for GE CS1000 Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 70/82] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 71/82] usb: dwc2: gadget: Fix sending zero length packet in DDMA mode Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 72/82] tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 73/82] media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 74/82] ixgbe: Fix packet corruption due to missing DMA sync Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 75/82] selftest: use mmap instead of posix_memalign to allocate memory Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 76/82] drm: Return -ENOTTY for non-drm ioctls Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 77/82] net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 78/82] iio: accel: bma180: Use explicit member assignment Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 79/82] iio: accel: bma180: Fix BMA25x bandwidth register values Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 80/82] btrfs: compression: dont try to compress if we dont have enough pages Greg Kroah-Hartman
2021-07-26 15:39 ` [PATCH 4.14 81/82] spi: spi-fsl-dspi: Fix a resource leak in an error handling path Greg Kroah-Hartman
2021-07-26 15:39 ` Greg Kroah-Hartman [this message]
2021-07-26 19:34 ` [PATCH 4.14 00/82] 4.14.241-rc1 review Guenter Roeck
2021-07-27 3:59 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210726153830.844177432@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=carsten_schmid@mentor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mathias.nyman@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).