[PATCH] usb: xhci: Fix ep0 maxpacket update on enabled slots

[PATCH] usb: xhci: Fix ep0 maxpacket update on enabled slots

[Michal Pecio]

A slot in Enabled state has uninitialized output contexts;
it doesn't need and cannot accept Evaluate Context command.
Attempting the command only results in a (harmless) warning,
observed when core uses "old scheme" on a full-speed device:

  WARN: invalid context state for evaluate context command.

This problem doesn't seem to have existed before ep0 update
was moved from urb_enqueue() to endpoint_reset(). USB core
doesn't use URBs before enable_device() or address_device(),
but it may call endpoint_reset() on ep0.

A more serious bug has been identified by Sashiko review bot.
Transaction Error of Address Device may cause the slot to be
reallocated and left in Enabled state, but the input context
is (needlessly) regenerated before actually being needed by
the next Address Device. xhci_check_ep0_maxpacket() corrupts
this context by copying uninitialized ep0 output context.

This matters when core resets a device and doesn't reallocate
udev after address_device() errors. Some HCs reject the next
Address Device with Parameter Error, some break. ASMedia HCs
write a Setup Stage TRB to the event ring and stop working:

  ERROR unknown event type 2
  INFO: task usbreset:4071 blocked for more than 122 seconds.

This exact case is a relatively recent regression, but even
if xhci_setup_device() didn't regenerate the input context
on Transaction Error, next iteration could regenerate it and
keep it there when command timeout leaves the slot Enabled.

We can kill both bugs with one stone by checking slot state.
If it's Enabled, do nothing and let next xhci_setup_device()
configure ep0 later. It will actually ignore the packet size
requested by core, but its defaults match core expectations
at the time of address_device() and enable_device() calls.

Fixes: e34900f46cd6 ("xhci: Reconfigure endpoint 0 max packet size only during endpoint reset")
Fixes: af8e119f52e9 ("xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration")
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
---
 drivers/usb/host/xhci.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e5c8b3a945a6..fa367d6cd21f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1566,6 +1566,11 @@ static int xhci_check_ep0_maxpacket(struct xhci_hcd *xhci, struct xhci_virt_devi
 	int hw_max_packet_size;
 	int ret = 0;
 
+	/* Only slots initialized by successful Address Device command need updating */
+	if (GET_SLOT_STATE(le32_to_cpu(xhci_get_slot_ctx(xhci, vdev->out_ctx)->dev_state))
+	    == SLOT_STATE_ENABLED)
+		return 0;
+
 	ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, 0);
 	hw_max_packet_size = MAX_PACKET_DECODED(le32_to_cpu(ep_ctx->ep_info2));
 	max_packet_size = usb_endpoint_maxp(&vdev->udev->ep0.desc);
-- 
2.48.1