On 06.06.23 13:58, Heikki Krogerus wrote: > The Cancel command was passed to the write callback as the > offset instead of as the actual command which caused NULL > pointer dereference. > > Reported-by: Stephan Bolten <stephan.bolten@xxxxxxx> > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217517 > Fixes: 094902bc6a3c ("usb: typec: ucsi: Always cancel the command if PPM reports BUSY condition") > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx> Gentle reminder that this made no progress for a week now. Or was there and I just missed it? Then apologies in advance. I'm asking, as it afaics would be nice to have this (or some other fix for the regression linked above) mainlined before the next -rc. That would be ideal, as then it can get at least one week of testing before the final is released. Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat) -- Everything you wanna know about Linux kernel regression tracking: https://linux-regtracking.leemhuis.info/about/#tldr If I did something stupid, please tell me, as explained on that page. > drivers/usb/typec/ucsi/ucsi.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c > index 2b472ec01dc42..b664ecbb798be 100644 > --- a/drivers/usb/typec/ucsi/ucsi.c > +++ b/drivers/usb/typec/ucsi/ucsi.c > @@ -132,10 +132,8 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd) > if (ret) > return ret; > > - if (cci & UCSI_CCI_BUSY) { > - ucsi->ops->async_write(ucsi, UCSI_CANCEL, NULL, 0); > - return -EBUSY; > - } > + if (cmd != UCSI_CANCEL && cci & UCSI_CCI_BUSY) > + return ucsi_exec_command(ucsi, UCSI_CANCEL); > > if (!(cci & UCSI_CCI_COMMAND_COMPLETE)) > return -EIO; > @@ -149,6 +147,11 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd) > return ucsi_read_error(ucsi); > } > > + if (cmd == UCSI_CANCEL && cci & UCSI_CCI_CANCEL_COMPLETE) { > + ret = ucsi_acknowledge_command(ucsi); > + return ret ? ret : -EBUSY; > + } > + > return UCSI_CCI_LENGTH(cci); > } >
