Commit 9530ba00 authored Oct 24, 2024 by Krishna Kurapati Committed by Lin Ruifeng Oct 24, 2024

usb: dwc3: core: Skip setting event buffers for host only controllers

stable inclusion
from stable-v4.19.321
commit 320bb9a5a6b79ba123d1e1f746edb52b41c7c1fb
bugzilla: https://gitee.com/src-openeuler/kernel/issues/
CVE: CVE-2024-46675

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=320bb9a5a6b79ba123d1e1f746edb52b41c7c1fb



--------------------------------

[ Upstream commit 89d7f962994604a3e3d480832788d06179abefc5 ]

On some SoC's like SA8295P where the tertiary controller is host-only
capable, GEVTADDRHI/LO, GEVTSIZ, GEVTCOUNT registers are not accessible.
Trying to access them leads to a crash.

For DRD/Peripheral supported controllers, event buffer setup is done
again in gadget_pullup. Skip setup or cleanup of event buffers if
controller is host-only capable.

Suggested-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20240420044901.884098-4-quic_kriskura@quicinc.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lin Ruifeng <linruifeng4@huawei.com>

parent fc5b1a61

drivers/usb/dwc3/core.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -388,6 +388,13 @@ static void dwc3_free_event_buffers(struct dwc3 *dwc)
		static int dwc3_alloc_event_buffers(struct dwc3 *dwc, unsigned length)
		{
		struct dwc3_event_buffer *evt;
		unsigned int hw_mode;

		hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
		if (hw_mode == DWC3_GHWPARAMS0_MODE_HOST) {
		dwc->ev_buf = NULL;
		return 0;
		}

		evt = dwc3_alloc_one_event_buffer(dwc, length);
		if (IS_ERR(evt)) {
		@@ -409,6 +416,9 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc)
		{
		struct dwc3_event_buffer *evt;

		if (!dwc->ev_buf)
		return 0;

		evt = dwc->ev_buf;
		evt->lpos = 0;
		dwc3_writel(dwc->regs, DWC3_GEVNTADRLO(0),
		@@ -426,6 +436,9 @@ void dwc3_event_buffers_cleanup(struct dwc3 *dwc)
		{
		struct dwc3_event_buffer *evt;

		if (!dwc->ev_buf)
		return;

		evt = dwc->ev_buf;

		evt->lpos = 0;