Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/usb/typec
History
Johan Hovold e7a9f66001 Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" 
This reverts commit 3e082978c3.

The new buffer management code has not been tested or reviewed properly
and breaks boot of machines like the Lenovo ThinkPad X13s:

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000000

    CPU: 0 UID: 0 PID: 813 Comm: kworker/0:3 Not tainted 6.19.0-rc2 #26 PREEMPT
    Hardware name: LENOVO 21BYZ9SRUS/21BYZ9SRUS, BIOS N3HET87W (1.59 ) 12/05/2023
    Workqueue: events ucsi_handle_connector_change [typec_ucsi]

    Call trace:
     ucsi_sync_control_common+0xe4/0x1ec [typec_ucsi] (P)
     ucsi_run_command+0xcc/0x194 [typec_ucsi]
     ucsi_send_command_common+0x84/0x2a0 [typec_ucsi]
     ucsi_get_connector_status+0x48/0x78 [typec_ucsi]
     ucsi_handle_connector_change+0x5c/0x4f4 [typec_ucsi]
     process_one_work+0x208/0x60c
     worker_thread+0x244/0x388

The new code completely ignores concurrency so that the message length
can be updated while a transaction is ongoing. In the above case, the
length ends up being modified by another thread while processing an ack
so that the NULL cci pointer is dereferenced.

Fixing this will require designing a proper interface for managing these
transactions, something which most likely involves reverting most of the
offending commit anyway.

Revert the broken code to fix the regression and let Intel come up with
a properly tested implementation for a later kernel.

Fixes: 3e082978c3 ("usb: typec: ucsi: Update UCSI structure to have message in and message out fields")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20251222152204.2846-5-johan@kernel.org
 		2025-12-23 15:59:01 +01:00
..
altmodes usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() 2025-12-17 14:53:16 +01:00
mux usb: typec: ps883x: Fix missing mutex_unlock() 2025-10-23 10:42:27 +02:00
tcpm Merge 6.18-rc3 into usb-next 2025-10-27 08:33:01 +01:00
tipd usb: typec: tipd: mark as orientation aware 2025-11-21 15:10:58 +01:00
ucsi Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" 2025-12-23 15:59:01 +01:00
Kconfig
…
Makefile
…
anx7411.c usb: typec: anx7411: add WQ_PERCPU to alloc_workqueue users 2025-11-21 15:17:36 +01:00
bus.c USB: typec: fix const issue in typec_match() 2025-05-23 12:36:40 +02:00
bus.h
…
class.c usb: typec: class: add typec_get_data_role symbol 2025-10-13 09:11:50 +02:00
class.h
…
hd3ss3220.c usb: typec: hd3ss3220: Enable VBUS based on ID pin state 2025-11-21 15:17:40 +01:00
mux.c
…
mux.h
…
pd.c usb: typec: pd: Register SPR AVS caps with usb_power_delivery class 2025-10-22 10:58:31 +02:00
pd.h
…
port-mapper.c
…
retimer.c
…
retimer.h
…
rt1719.c
…
stusb160x.c
…
wusb3801.c
…