No description
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Michal Pecio f781297745 usb: xhci: Assume that endpoints halt as specified
xHCI 4.8.3 recommends that software should simply assume endpoints to
halt after certain events, without looking at the Endpoint Context for
confirmation, because HCs may be slow to update that.

While no cases of such "slowness" appear to be known, different problem
exists on AMD Promontory chipsets: they may halt and generate a transfer
event, but fail to ever update the Endpoint Context at all, at least not
until some command is queued and fails with Context State Error. This is
easily triggered by disconnecting D- of a full speed serial device.

Possibly similar bug in non-AMD hardware has been reported to linux-usb.

In such case, failed TD is given back without erasing from the ring and
endpoint isn't reset. If some URB is unlinked later, Stop Endpoint fails
and its handler resets the endpoint. On next submission it will restart
on the stale TD. Outcome is UAF on success, or another halt on error and
then Dequeue doesn't move and URBs are stuck. Unlinking and resubmitting
the URBs causes unlimited ring expansion if the situation repeats.

This can be solved by ignoring Endpoint Context State and trusting that
endpoints halt when required, except one known case in ancient hardware.
The check for "Already resolving halted ep" becomes redundant, because
for these completion codes we now jump to xhci_handle_halted_endpoint()
which deals with pending EP_HALTED internally.

Link: https://lore.kernel.org/linux-usb/20250311234139.0e73e138@foxbook/
Link: https://lore.kernel.org/linux-usb/20250918055527.4157212-1-zhangjinpeng@kylinos.cn/
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20251119142417.2820519-10-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-11-21 14:53:00 +01:00
arch - Remove dead code leftovers after a recent mitigations cleanup which fail 2025-10-26 09:57:18 -07:00
block block-6.18-20251023 2025-10-24 12:48:19 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto This push contains the following changes: 2025-10-10 08:56:16 -07:00
Documentation dt-bindings: usb: Support MediaTek MT8189 xhci 2025-11-21 14:52:52 +01:00
drivers usb: xhci: Assume that endpoints halt as specified 2025-11-21 14:53:00 +01:00
fs - Remove dead code leftovers after a recent mitigations cleanup which fail 2025-10-26 09:57:18 -07:00
include Merge 6.18-rc3 into usb-next 2025-10-27 08:33:01 +01:00
init printk changes for 6.18 2025-10-04 11:13:11 -07:00
io_uring io_uring: fix buffer auto-commit for multishot uring_cmd 2025-10-23 19:41:31 -06:00
ipc namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
kernel - Restore the original buslock locking in a couple of places in the irq core 2025-10-26 09:54:36 -07:00
lib lib/crypto: poly1305: Restore dependency of arch code on !KMSAN 2025-10-22 10:52:10 -07:00
LICENSES LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 2025-07-24 11:15:39 +02:00
mm slab fixes for 6.18-rc3 2025-10-24 12:40:51 -07:00
net Including fixes from can. Slim pickings, I'm guessing people haven't 2025-10-23 07:03:18 -10:00
rust rust: usb: fix formatting 2025-10-28 10:04:04 +01:00
samples Revert "USB: disable rust bindings from the build for now" 2025-10-13 09:34:44 +02:00
scripts Kbuild fixes for 6.18 #1 2025-10-11 15:47:12 -07:00
security integrity-v6.18 2025-10-05 10:48:33 -07:00
sound ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx 2025-10-17 16:37:21 +02:00
tools - Fix x32 build due to wrong format specifier on that sub-arch 2025-10-26 09:44:36 -07:00
usr gen_init_cpio: Ignore fsync() returning EINVAL on pipes 2025-10-07 09:53:05 -07:00
virt KVM x86 fixes for 6.18: 2025-10-18 10:25:43 +02:00
.clang-format memblock: drop for_each_free_mem_pfn_range_in_zone_from() 2025-09-14 08:49:03 +03:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: remove Alyssa Rosenzweig 2025-09-18 21:17:31 +02:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: ignore compile_commands.json globally 2025-08-12 15:53:55 -07:00
.mailmap MAINTAINERS: Update Alex Williamson's email address 2025-10-20 15:45:03 -06:00
.pylintrc tools: docs: parse-headers.py: move it from sphinx dir 2025-08-29 15:54:42 -06:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS USB/Thunderbolt changes for 6.18-rc1 2025-10-04 16:07:08 -07:00
Kbuild sched: Make migrate_{en,dis}able() inline 2025-09-25 09:57:16 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS Merge 6.18-rc3 into usb-next 2025-10-27 08:33:01 +01:00
Makefile Linux 6.18-rc3 2025-10-26 15:59:49 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.