2021-05-11 10:24:00

by Chunfeng Yun

Subject: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume

This may happen if the port becomes resume status exactly
when usb_port_resume() gets port status, it still need provide
a TRSMCRY time before access the device.

Reported-by: Tianping Fang <[email protected]>
Signed-off-by: Chunfeng Yun <[email protected]>
---
drivers/usb/core/hub.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index b2bc4b7c4289..fc7d6cdacf16 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3642,9 +3642,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
* sequence.
*/
status = hub_port_status(hub, port1, &portstatus, &portchange);
-
- /* TRSMRCY = 10 msec */
- msleep(10);
}

SuspendCleared:
@@ -3659,6 +3656,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
usb_clear_port_feature(hub->hdev, port1,
USB_PORT_FEAT_C_SUSPEND);
}
+
+ /* TRSMRCY = 10 msec */
+ msleep(10);
}

if (udev->persist_enabled)
--
2.18.0

2021-05-11 11:29:29

by Greg Kroah-Hartman

Subject: Re: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume

On Tue, May 11, 2021 at 06:15:22PM +0800, Chunfeng Yun wrote:
> This may happen if the port becomes resume status exactly
> when usb_port_resume() gets port status, it still need provide
> a TRSMCRY time before access the device.
>
> Reported-by: Tianping Fang <[email protected]>
> Signed-off-by: Chunfeng Yun <[email protected]>
> ---
> drivers/usb/core/hub.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)

Does this need to go to any older/stable kernels? If so, how far back?

thanks,

greg k-h

2021-05-11 16:42:42

by Alan Stern

Subject: Re: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume

On Tue, May 11, 2021 at 06:15:22PM +0800, Chunfeng Yun wrote:
> This may happen if the port becomes resume status exactly
> when usb_port_resume() gets port status, it still need provide
> a TRSMCRY time before access the device.
>
> Reported-by: Tianping Fang <[email protected]>
> Signed-off-by: Chunfeng Yun <[email protected]>

This should also say:

CC: <[email protected]>

> ---
> drivers/usb/core/hub.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> index b2bc4b7c4289..fc7d6cdacf16 100644
> --- a/drivers/usb/core/hub.c
> +++ b/drivers/usb/core/hub.c
> @@ -3642,9 +3642,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
> * sequence.
> */
> status = hub_port_status(hub, port1, &portstatus, &portchange);
> -
> - /* TRSMRCY = 10 msec */
> - msleep(10);
> }
>
> SuspendCleared:
> @@ -3659,6 +3656,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
> usb_clear_port_feature(hub->hdev, port1,
> USB_PORT_FEAT_C_SUSPEND);
> }
> +
> + /* TRSMRCY = 10 msec */
> + msleep(10);
> }
>
> if (udev->persist_enabled)

Acked-by: Alan Stern <[email protected]>

2021-05-12 02:04:29

by Chunfeng Yun

Subject: Re: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume

On Tue, 2021-05-11 at 13:27 +0200, Greg Kroah-Hartman wrote:
> On Tue, May 11, 2021 at 06:15:22PM +0800, Chunfeng Yun wrote:
> > This may happen if the port becomes resume status exactly
> > when usb_port_resume() gets port status, it still need provide
> > a TRSMCRY time before access the device.
> >
> > Reported-by: Tianping Fang <[email protected]>
> > Signed-off-by: Chunfeng Yun <[email protected]>
> > ---
> > drivers/usb/core/hub.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
>
> Does this need to go to any older/stable kernels? If so, how far back?

The flow is changed by
"b01b03f3ad82 USB: add new routine for checking port-resume type", but
it will cause conflict with
"ad493e5e5805 usb: add usb port auto power off mechanism"

>
> thanks,
>
> greg k-h

2021-05-12 02:07:02

by Chunfeng Yun

Subject: Re: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume

On Tue, 2021-05-11 at 12:39 -0400, Alan Stern wrote:
> On Tue, May 11, 2021 at 06:15:22PM +0800, Chunfeng Yun wrote:
> > This may happen if the port becomes resume status exactly
> > when usb_port_resume() gets port status, it still need provide
> > a TRSMCRY time before access the device.
> >
> > Reported-by: Tianping Fang <[email protected]>
> > Signed-off-by: Chunfeng Yun <[email protected]>
>
> This should also say:
>
> CC: <[email protected]>

OK, thanks

>
> > ---
> > drivers/usb/core/hub.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> > index b2bc4b7c4289..fc7d6cdacf16 100644
> > --- a/drivers/usb/core/hub.c
> > +++ b/drivers/usb/core/hub.c
> > @@ -3642,9 +3642,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
> > * sequence.
> > */
> > status = hub_port_status(hub, port1, &portstatus, &portchange);
> > -
> > - /* TRSMRCY = 10 msec */
> > - msleep(10);
> > }
> >
> > SuspendCleared:
> > @@ -3659,6 +3656,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
> > usb_clear_port_feature(hub->hdev, port1,
> > USB_PORT_FEAT_C_SUSPEND);
> > }
> > +
> > + /* TRSMRCY = 10 msec */
> > + msleep(10);
> > }
> >
> > if (udev->persist_enabled)
>
> Acked-by: Alan Stern <[email protected]>