kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Sebastian Reichel 8887a1d1f8 usb: typec: fusb302: cache PD RX state 
[ Upstream commit 1e61f6ab08 ]

This patch fixes a race condition communication error, which ends up in
PD hard resets when losing the race. Some systems, like the Radxa ROCK
5B are powered through USB-C without any backup power source and use a
FUSB302 chip to do the PD negotiation. This means it is quite important
to avoid hard resets, since that effectively kills the system's
power-supply.

I've found the following race condition while debugging unplanned power
loss during booting the board every now and then:

1. lots of TCPM/FUSB302/PD initialization stuff
2. TCPM ends up in SNK_WAIT_CAPABILITIES (tcpm_set_pd_rx is enabled here)
3. the remote PD source does not send anything, so TCPM does a SOFT RESET
4. TCPM ends up in SNK_WAIT_CAPABILITIES for the second time
   (tcpm_set_pd_rx is enabled again, even though it is still on)

At this point I've seen broken CRC good messages being send by the
FUSB302 with a logic analyzer sniffing the CC lines. Also it looks like
messages are being lost and things generally going haywire with one of
the two sides doing a hard reset once a broken CRC good message was send
to the bus.

I think the system is running into a race condition, that the FIFOs are
being cleared and/or the automatic good CRC message generation flag is
being updated while a message is already arriving.

Let's avoid this by caching the PD RX enabled state, as we have already
processed anything in the FIFOs and are in a good state. As a side
effect that this also optimizes I2C bus usage :)

As far as I can tell the problem theoretically also exists when TCPM
enters SNK_WAIT_CAPABILITIES the first time, but I believe this is less
critical for the following reason:

On devices like the ROCK 5B, which are powered through a TCPM backed
USB-C port, the bootloader must have done some prior PD communication
(initial communication must happen within 5 seconds after plugging the
USB-C plug). This means the first time the kernel TCPM state machine
reaches SNK_WAIT_CAPABILITIES, the remote side is not sending messages
actively. On other devices a hard reset simply adds some extra delay and
things should be good afterwards.

Fixes: c034a43e72 ("staging: typec: Fairchild FUSB302 Type-c chip driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20250704-fusb302-race-condition-fix-v1-1-239012c0e27a@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-08-28 16:26:11 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:02:55 +02:00
acpi ACPI: pfr_update: Fix the driver update version check 2025-08-28 16:26:09 +02:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:10:26 +02:00
ata ata: libata-scsi: Fix ata_to_sense_error() status handling 2025-08-28 16:26:06 +02:00
atm atm: idt77252: Add missing dma_map_error() 2025-07-17 18:32:13 +02:00
auxdisplay auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" 2025-06-04 14:40:07 +02:00
base PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() 2025-08-28 16:25:53 +02:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block drbd: add missing kref_get in handle_write_conflicts 2025-08-28 16:25:51 +02:00
bluetooth Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID 2025-07-24 08:51:52 +02:00
bus bus: mhi: host: Detect events pointing to unexpected TREs 2025-08-28 16:26:05 +02:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:47:10 +02:00
char ipmi: Fix strcpy source and destination the same 2025-08-28 16:26:02 +02:00
clk clk: sunxi-ng: v3s: Fix de clock definition 2025-08-15 12:05:03 +02:00
clocksource clocksource: mips-gic-timer: Enable counter when CPUs start 2025-06-04 14:40:12 +02:00
comedi comedi: fix race between polling and detaching 2025-08-28 16:26:04 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: interrupt-cnt: Protect enable/disable OPs with mutex 2025-06-27 11:07:16 +01:00
cpufreq cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() 2025-08-28 16:26:05 +02:00
cpuidle cpuidle: menu: Avoid discarding useful information 2025-06-04 14:40:11 +02:00
crypto crypto: octeontx2 - add timeout for load_fvc completion poll 2025-08-28 16:26:01 +02:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:52:53 +01:00
dax dax: delete a stale directory pmem 2024-12-14 19:53:41 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:25:52 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs 2025-08-28 16:26:00 +02:00
dma-buf dma-buf: fix timeout handling in dma_resv_wait_timeout v2 2025-07-10 15:59:53 +02:00
edac EDAC/synopsys: Clear the ECC counters on init 2025-08-28 16:25:52 +02:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:03:41 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:56:16 +02:00
firmware firmware: arm_scmi: Ensure that the message-id supports fastchannel 2025-07-06 10:58:04 +02:00
fpga zynq_fpga: use sgtable-based scatterlist wrappers 2025-08-28 16:26:06 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: tps65912: check the return value of regmap_update_bits() 2025-08-28 16:25:53 +02:00
gpu drm/sched: Remove optimization that causes hang when killing dependent jobs 2025-08-28 16:26:10 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:36:00 +02:00
hid HID: apple: avoid setting up battery timer for devices without battery 2025-08-28 16:26:05 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-04-25 10:43:47 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-06 10:57:58 +02:00
hwmon hwmon: (gsc-hwmon) fix fan pwm setpoint show functions 2025-08-28 16:26:07 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:53:09 +02:00
hwtracing coresight: Only check bottom two claim bits 2025-07-06 10:57:55 +02:00
i2c i2c: Force DLL0945 touchpad i2c freq to 100khz 2025-08-28 16:26:01 +02:00
i3c i3c: master: Initialize ret in i3c_i2c_notifier_call() 2025-08-28 16:26:01 +02:00
idle cpuidle, intel_idle: Fix CPUIDLE_FLAG_IBRS 2025-03-13 12:53:11 +01:00
iio iio: hid-sensor-prox: Fix incorrect OFFSET calculation 2025-08-28 16:26:10 +02:00
infiniband RDMA/core: reduce stack using in nldev_stat_get_doit() 2025-08-28 16:26:00 +02:00
input Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT 2025-08-15 12:04:45 +02:00
interconnect interconnect: qcom: sc8180x: specify num_nodes 2025-08-15 12:04:55 +02:00
iommu iommu/amd: Ensure GA log notifier callbacks finish running before module unload 2025-06-27 11:07:34 +01:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip: Build IMX_MU_MSI only on ARM 2025-08-15 12:05:10 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-03 08:49:50 +02:00
leds leds: leds-lp50xx: Handle reg to get correct multi_index 2025-08-28 16:26:00 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:49:22 +02:00
mailbox mailbox: Not protect module_put with spin_lock_irqsave 2025-07-06 10:57:54 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:46:57 +02:00
md dm-table: fix checking for rq stackable devices 2025-08-28 16:26:01 +02:00
media media: venus: venc: Clamp param smaller than 1fps and bigger than 240 2025-08-28 16:26:09 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:33:39 +02:00
memstick memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() 2025-07-24 08:51:49 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:53:40 +01:00
mfd mfd: max14577: Fix wakeup source leaks on device unbind 2025-07-06 10:57:54 +02:00
misc misc: rtsx: usb: Ensure mmc child device is active when card is present 2025-08-28 16:26:03 +02:00
mmc mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() 2025-08-28 16:25:54 +02:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd mtd: rawnand: renesas: Add missing check after DMA map 2025-08-28 16:26:07 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net net: enetc: fix device and OF node leak at probe 2025-08-28 16:26:10 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:25:02 +02:00
ntb ntb_hw_amd: Add NTB PCI ID for new gen CPU 2025-05-02 07:47:04 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm libnvdimm/labels: Fix divide error in nd_label_data_init() 2025-06-04 14:40:04 +02:00
nvme nvme: fix misaccounting of nvme-mpath inflight I/O 2025-07-24 08:51:52 +02:00
nvmem nvmem: layouts: u-boot-env: remove crc32 endianness conversion 2025-07-24 08:51:55 +02:00
of of: module: add buffer overflow check in of_modalias() 2025-05-02 07:47:08 +02:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-21 13:49:02 +01:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport parport_pc: add support for ASIX AX99100 2025-02-21 13:50:11 +01:00
pci PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports 2025-08-28 16:26:10 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:10:20 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf perf/arm-cmn: Initialise cmn->cpu earlier 2025-06-04 14:40:25 +02:00
phy phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode 2025-07-24 08:51:47 +02:00
pinctrl pinctrl: stm32: Manage irq affinity settings 2025-08-28 16:26:00 +02:00
platform platform/chrome: cros_ec_typec: Defer probe on missing EC parent 2025-08-28 16:25:54 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set 2025-08-15 12:05:01 +02:00
powercap powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() 2025-08-15 12:04:54 +02:00
pps pps: clients: gpio: fix interrupt handling order in remove path 2025-08-28 16:25:53 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Use ratelimite for freerun error message 2025-08-28 16:25:58 +02:00
pwm pwm: mediatek: Fix duty and period setting 2025-08-28 16:26:07 +02:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-27 11:07:36 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: core: fix NULL dereference on unbind due to stale coupling data 2025-08-15 12:04:45 +02:00
remoteproc remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU 2025-08-28 16:25:52 +02:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-28 16:25:53 +02:00
rpmsg rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() 2025-06-27 11:07:15 +01:00
rtc rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe 2025-08-28 16:26:03 +02:00
s390 s390/pkey: Prevent overflow in size calculation for memdup_user() 2025-07-06 10:57:59 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: mpi3mr: Fix race between config read submit and interrupt completion 2025-08-28 16:26:06 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2024-12-27 13:52:58 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:53:22 +01:00
soc soc/tegra: pmc: Ensure power-domains are in a known state 2025-08-28 16:26:08 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-15 12:05:04 +02:00
spi spi: spi-fsl-dspi: Clear completion counter before initiating transfer 2025-07-10 15:59:47 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:35:55 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:30:27 +02:00
staging media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() 2025-08-28 16:26:08 +02:00
target scsi: target: core: Generate correct identifiers for PR OUT transport IDs 2025-08-28 16:26:02 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: Prevent size calculation wraparound on 32-bit kernels 2025-06-27 11:07:36 +01:00
thermal thermal: sysfs: Return ENODATA instead of EAGAIN for reads 2025-08-28 16:25:53 +02:00
thunderbolt thunderbolt: Fix copy+paste error in match_service_id() 2025-08-28 16:26:04 +02:00
tty vt: defkeymap: Map keycodes above 127 to K_HOLE 2025-08-28 16:26:05 +02:00
ufs scsi: ufs: ufs-pci: Fix default runtime and system PM levels 2025-08-28 16:26:06 +02:00
uio uio_hv_generic: Align ring size to system page 2025-07-06 10:57:58 +02:00
usb usb: typec: fusb302: cache PD RX state 2025-08-28 16:26:11 +02:00
vdpa vdpa/mlx5: Fix oversized null mkey longer than 32bit 2025-04-25 10:43:40 +02:00
vfio vfio/mlx5: fix possible overflow in tracking max message size 2025-08-28 16:26:02 +02:00
vhost vhost/vsock: Avoid allocating arbitrarily-sized SKBs 2025-08-28 16:26:07 +02:00
video Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" 2025-08-28 16:26:05 +02:00
virt fix locking in efi_secret_unlink() 2025-08-28 16:25:51 +02:00
virtio virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN 2025-06-04 14:40:01 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: iTCO_wdt: Report error if timeout configuration fails 2025-08-28 16:25:59 +02:00
xen xen/gntdev: remove struct gntdev_copy_batch from stack 2025-08-15 12:04:58 +02:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00