linux_dsm_epyc7002/drivers/usb
Dmitry Osipenko a56ab23974 usb: otg-fsm: Fix hrtimer list corruption
commit bf88fef0b6f1488abeca594d377991171c00e52a upstream.

The HNP work can be re-scheduled while it's still in-fly. This results in
re-initialization of the busy work, resetting the hrtimer's list node of
the work and crashing kernel with null dereference within kernel/timer
once work's timer is expired. It's very easy to trigger this problem by
re-plugging USB cable quickly. Initialize HNP work only once to fix this
trouble.

 Unable to handle kernel NULL pointer dereference at virtual address 00000126)
 ...
 PC is at __run_timers.part.0+0x150/0x228
 LR is at __next_timer_interrupt+0x51/0x9c
 ...
 (__run_timers.part.0) from [<c0187a2b>] (run_timer_softirq+0x2f/0x50)
 (run_timer_softirq) from [<c01013ad>] (__do_softirq+0xd5/0x2f0)
 (__do_softirq) from [<c012589b>] (irq_exit+0xab/0xb8)
 (irq_exit) from [<c0170341>] (handle_domain_irq+0x45/0x60)
 (handle_domain_irq) from [<c04c4a43>] (gic_handle_irq+0x6b/0x7c)
 (gic_handle_irq) from [<c0100b65>] (__irq_svc+0x65/0xac)

Cc: stable@vger.kernel.org
Acked-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-07-05 18:52:27 +02:00
..
atm usb: atm: don't use snprintf() for sysfs attrs 2020-08-25 19:11:18 +02:00
c67x00 Linux 5.9-rc3 2020-08-31 07:11:45 +02:00
cdns3 usb: cdns3: Fixed incorrect gadget state 2024-07-05 18:52:27 +02:00
chipidea usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection 2021-06-23 14:42:50 +02:00
class USB: usbtmc: Fix RCU stall warning 2024-07-05 18:52:09 +02:00
common usb: otg-fsm: Fix hrtimer list corruption 2024-07-05 18:52:27 +02:00
core init: add dsm gpl source 2024-07-05 18:00:04 +02:00
dwc2 usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. 2021-07-28 14:35:44 +02:00
dwc3 usb: dwc3: gadget: Avoid runtime resume if disabling pullup 2024-07-05 18:52:27 +02:00
early usb: early: ehci-dbgp: convert to readl_poll_timeout_atomic() 2020-09-25 16:29:09 +02:00
gadget usb: gadget: f_hid: idle uses the highest byte for duration 2024-07-05 18:52:27 +02:00
host usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses 2024-07-05 18:52:27 +02:00
image USB: microtek: use set_host_byte() 2020-09-16 12:42:10 +02:00
isp1760 usb: isp1760-hcd: convert to readl_poll_timeout_atomic() 2020-09-25 16:30:05 +02:00
misc USB: trancevibrator: fix control-request direction 2021-06-03 09:00:34 +02:00
mon USB: mon: Use scnprintf() for avoiding potential buffer overflow 2020-03-12 09:49:28 +01:00
mtu3 usb: mtu3: fix memory corruption in mtu3_debugfs_regset() 2020-12-26 16:02:38 +01:00
musb usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling 2021-06-16 12:01:41 +02:00
phy init: add dsm gpl source 2024-07-05 18:00:04 +02:00
renesas_usbhs usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() 2021-07-28 14:35:44 +02:00
roles usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() 2021-05-14 09:49:55 +02:00
serial USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 2024-07-05 18:52:10 +02:00
storage init: add dsm gpl source 2024-07-05 18:00:04 +02:00
typec usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events 2024-07-05 18:52:27 +02:00
usbip usbip: vudc: fix missing unlock on error in usbip_sockfd_store() 2021-05-14 09:50:19 +02:00
Kconfig init: add dsm gpl source 2024-07-05 18:00:04 +02:00
Makefile USB: Changes for v5.4 merge window 2019-09-02 19:20:57 +02:00
usb-skeleton.c USB: usb-skeleton: drop redundant in-urb check 2019-10-10 12:41:19 +02:00