On Wed, May 01, 2024 at 09:10:42PM +0200, Christian A. Ehrhardt wrote:
>
> Hi Greg,
>
> On Tue, Apr 02, 2024 at 09:52:47AM +0200, Greg Kroah-Hartman wrote:
> > On Tue, Apr 02, 2024 at 08:06:52AM +0200, Christian A. Ehrhardt wrote:
> > >
> > > Hi Greg,
> > >
> > > On Tue, Apr 02, 2024 at 07:40:43AM +0200, Greg Kroah-Hartman wrote:
> > > > On Mon, Apr 01, 2024 at 10:16:45PM +0200, Christian A. Ehrhardt wrote:
> > > > >
> > > > > Hi Greg,
> > > > >
> > > > > On Mon, Apr 01, 2024 at 05:47:21PM +0200, Greg Kroah-Hartman wrote:
> > > > > > 6.1-stable review patch. If anyone has any objections, please let me know.
> > > > > >
> > > > > > ------------------
> > > > > >
> > > > > > From: Christian A. Ehrhardt <lk@xxxxxxx>
> > > > > >
> > > > > > commit 808a8b9e0b87bbc72bcc1f7ddfe5d04746e7ce56 upstream.
> > > > > >
> > > > > > The completion notification for the final SET_NOTIFICATION_ENABLE
> > > > > > command during initialization can include a connector change
> > > > > > notification. However, at the time this completion notification is
> > > > > > processed, the ucsi struct is not ready to handle this notification.
> > > > > > As a result the notification is ignored and the controller
> > > > > > never sends an interrupt again.
> > > > > >
> > > > > > Re-check CCI for a pending connector state change after
> > > > > > initialization is complete. Adjust the corresponding debug
> > > > > > message accordingly.
> > > > > >
> > > > > > Fixes: 71a1fa0df2a3 ("usb: typec: ucsi: Store the notification mask")
> > > > > > Cc: stable@xxxxxxxxxxxxxxx
> > > > > > Signed-off-by: Christian A. Ehrhardt <lk@xxxxxxx>
> > > > > > Reviewed-by: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
> > > > > > Tested-by: Neil Armstrong <neil.armstrong@xxxxxxxxxx> # on SM8550-QRD
> > > > > > Link: https://lore.kernel.org/r/20240320073927.1641788-3-lk@xxxxxxx
> > > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > > > > > ---
> > > > > > drivers/usb/typec/ucsi/ucsi.c | 10 +++++++++-
> > > > > > 1 file changed, 9 insertions(+), 1 deletion(-)
> > > > >
> > > > > This change has an out of bounds memory access. Please drop it from
> > > > > the stable trees until a fix is available.
> > > >
> > > > Shouldn't we get a fix for Linus's tree too? Have I missed that
> > > > somewhere? Or should this just be reverted now?
> > >
> > > I posted the fix a few hours after sending this mail. It is here:
> > > https://lore.kernel.org/all/20240401210515.1902048-1-lk@xxxxxxx/
> > >
> > > Either this should be fast tracked to Linus or the original change
> > > reverted, yes.
> >
> > I've dropped the offending commit from the stable queues now. Once this
> > fix gets into Linus's tree, let us know and I will add both in then.
>
> The fix for
> 808a8b9e0b87 ("usb: typec: ucsi: Check for notifications after init")
> has hit Linus's tree as
> ce4c8d21054a ("usb: typec: ucsi: Fix connector check on init")
>
> There is no urgency but this is to let you know that the original commit
> is eligible for -stable again, provided that the follow up commit is
> backported, too.
Thanks, all now queued up.
greg k-h
