linux/drivers/usb/core
Alan Stern 0f663729bb USB: core: Fix bug in resuming hub's handling of wakeup requests
Bugzilla #213839 reports a 7-port hub that doesn't work properly when
devices are plugged into some of the ports; the kernel goes into an
unending disconnect/reinitialize loop as shown in the bug report.

This "7-port hub" comprises two four-port hubs with one plugged into
the other; the failures occur when a device is plugged into one of the
downstream hub's ports.  (These hubs have other problems too.  For
example, they bill themselves as USB-2.0 compliant but they only run
at full speed.)

It turns out that the failures are caused by bugs in both the kernel
and the hub.  The hub's bug is that it reports a different
bmAttributes value in its configuration descriptor following a remote
wakeup (0xe0 before, 0xc0 after -- the wakeup-support bit has
changed).

The kernel's bug is inside the hub driver's resume handler.  When
hub_activate() sees that one of the hub's downstream ports got a
wakeup request from a child device, it notes this fact by setting the
corresponding bit in the hub->change_bits variable.  But this variable
is meant for connection changes, not wakeup events; setting it causes
the driver to believe the downstream port has been disconnected and
then connected again (in addition to having received a wakeup
request).

Because of this, the hub driver then tries to check whether the device
currently plugged into the downstream port is the same as the device
that had been attached there before.  Normally this check succeeds and
wakeup handling continues with no harm done (which is why the bug
remained undetected until now).  But with these dodgy hubs, the check
fails because the config descriptor has changed.  This causes the hub
driver to reinitialize the child device, leading to the
disconnect/reinitialize loop described in the bug report.

The proper way to note reception of a downstream wakeup request is
to set a bit in the hub->event_bits variable instead of
hub->change_bits.  That way the hub driver will realize that something
has happened to the port but will not think the port and child device
have been disconnected.  This patch makes that change.

Cc: <stable@vger.kernel.org>
Tested-by: Jonathan McDowell <noodles@earth.li>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/YdCw7nSfWYPKWQoD@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-03 14:40:39 +01:00
..
buffer.c usb: core: Replace in_interrupt() in comments 2020-10-28 12:32:59 +01:00
config.c usb: core: config: using bit mask instead of individual bits 2021-12-12 13:06:39 +01:00
devices.c usb: common: add function to get interval expressed in us unit 2021-03-10 09:37:17 +01:00
devio.c USB: core: Make do_proc_control() and do_proc_bulk() killable 2021-09-14 11:55:22 +02:00
driver.c usb: core: Export usb_device_match_id 2021-12-17 17:02:04 +01:00
endpoint.c usb: common: add function to get interval expressed in us unit 2021-03-10 09:37:17 +01:00
file.c USB: core: Fix races in character device registration and deregistraion 2019-08-12 22:47:24 +02:00
generic.c usb: core: Fix file path that does not exist 2021-12-05 14:24:19 +01:00
hcd-pci.c usb: core: Replace in_interrupt() in comments 2020-10-28 12:32:59 +01:00
hcd.c USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status 2022-01-03 14:38:34 +01:00
hub.c USB: core: Fix bug in resuming hub's handling of wakeup requests 2022-01-03 14:40:39 +01:00
hub.h usb: core: reduce power-on-good delay time of root hub 2021-04-10 10:45:48 +02:00
Kconfig USB: hub: Add Kconfig option to reduce number of port initialization retries 2020-10-02 11:29:02 +02:00
ledtrig-usbport.c usb: core: ledtrig-usbport: Demote obvious misuse of kerneldoc to standard comment blocks 2020-07-09 16:46:57 +02:00
Makefile usb: core: add a wrapper for the USB PHYs on the HCD 2018-03-09 09:43:53 -08:00
message.c USB: core: Avoid WARNings for 0-length descriptor requests 2021-06-09 11:11:39 +02:00
notify.c USB: core: Remove usbfs_mutex 2019-06-26 10:28:09 +08:00
of.c drivers: usb: Fix trivial spelling 2020-06-18 10:13:16 +02:00
otg_productlist.h USB: OTG: rename product list of devices 2020-06-19 08:58:55 +02:00
phy.c usb: core: phy: add support for PHY calibration 2019-09-03 15:54:55 +02:00
phy.h usb: core: phy: add support for PHY calibration 2019-09-03 15:54:55 +02:00
port.c usb: Link the ports to the connectors they are attached to 2021-12-30 12:13:04 +01:00
quirks.c USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) 2021-12-15 23:42:33 +01:00
sysfs.c driver core: Move the "removable" attribute from USB to core 2021-05-27 09:36:31 +02:00
urb.c USB: core: Check buffer length matches wLength for control transfers 2021-05-27 13:46:21 +02:00
usb-acpi.c usb: core: Use ACPI_SUCCESS() at appropriate places 2020-02-19 11:08:52 +01:00
usb.c usb: Remove usb_for_each_port() 2021-12-30 12:13:04 +01:00
usb.h usbcore: Check both id_table and match() when both available 2020-10-28 13:24:58 +01:00