xhci: Fix commad ring abort, write all 64 bits to CRCR register.

stable inclusion
from stable-v4.19.220
commit abba418a9c73dcffecbe19ef93c7ae5d2e8e38d3
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RB55
CVE: CVE-2021-47434

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=abba418a9c73dcffecbe19ef93c7ae5d2e8e38d3



--------------------------------

commit 09f736aa upstream.

Turns out some xHC controllers require all 64 bits in the CRCR register
to be written to execute a command abort.

The lower 32 bits containing the command abort bit is written first.
In case the command ring stops before we write the upper 32 bits then
hardware may use these upper bits to set the commnd ring dequeue pointer.

Solve this by making sure the upper 32 bits contain a valid command
ring dequeue pointer.

The original patch that only wrote the first 32 to stop the ring went
to stable, so this fix should go there as well.

Fixes: ff0e50d3 ("xhci: Fix command ring pointer corruption while aborting a command")
Cc: stable@vger.kernel.org
Tested-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211126122340.1193239-2-mathias.nyman@linux.intel.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Yuan Can <yuancan@huawei.com>