lkml.org 
[lkml]   [2019]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC PATCH] usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests
From
Date
On 2019-07-25 6:30 a.m., Guenter Roeck wrote:
> TCPM may receive PD messages associated with unknown or unsupported
> alternate modes. If that happens, calls to typec_match_altmode()
> will return NULL. The tcpm code does not currently take this into
> account. This results in crashes.
>
> Unable to handle kernel NULL pointer dereference at virtual address 000001f0
> pgd = 41dad9a1
> [000001f0] *pgd=00000000
> Internal error: Oops: 5 [#1] THUMB2
> Modules linked in: tcpci tcpm
> CPU: 0 PID: 2338 Comm: kworker/u2:0 Not tainted 5.1.18-sama5-armv7-r2 #6
> Hardware name: Atmel SAMA5
> Workqueue: 2-0050 tcpm_pd_rx_handler [tcpm]
> PC is at typec_altmode_attention+0x0/0x14
> LR is at tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm]
> ...
> [<c03fbee8>] (typec_altmode_attention) from [<bf8030fb>]
> (tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm])
> [<bf8030fb>] (tcpm_pd_rx_handler [tcpm]) from [<c012082b>]
> (process_one_work+0x123/0x2a8)
> [<c012082b>] (process_one_work) from [<c0120a6d>]
> (worker_thread+0xbd/0x3b0)
> [<c0120a6d>] (worker_thread) from [<c012431f>] (kthread+0xcf/0xf4)
> [<c012431f>] (kthread) from [<c01010f9>] (ret_from_fork+0x11/0x38)
>
> Ignore PD messages if the asociated alternate mode is not supported.
>
> Reported-by: Douglas Gilbert <dgilbert@interlog.com>
> Cc: Douglas Gilbert <dgilbert@interlog.com>
> Fixes: e9576fe8e605c ("usb: typec: tcpm: Support for Alternate Modes")
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> Taking a stab at the problem. I don't really know if this is the correct
> fix, or even if my understanding of the problem is correct, thus marking
> the patch as RFC.

Tested-by: Douglas Gilbert <dgilbert@interlog.com>

Tested on different hardware (Acme Arietta based on at91sam9g25) and
lk 5.2.5 . Without this patch the oops was at
PC is at typec_altmode_attention+0x0/0x24 [typec]

The DUT was a Arietta with a OM13588 attached acting as a PD sink.
At the other end of the type C cable was a KL27Z+OM13588 running
NXP's usb_pd_bm app and it was a PD source. The other end did a
"send attention" to cause the oops.

With this patch nothing happened. Notable there was no oops.
The other end (KL27Z+OM13588 reported "send attention result:
success" but it also did that in the previous "oops" case.

Is there something to replace "tail -f" that would make it
easier to monitor what is being sent to
/sys/kernel/debug/tcpm/1-0050
?

Doug Gilbert

> drivers/usb/typec/tcpm/tcpm.c | 38 ++++++++++++++++++++++++--------------
> 1 file changed, 24 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> index 77f71f602f73..1df2844469aa 100644
> --- a/drivers/usb/typec/tcpm/tcpm.c
> +++ b/drivers/usb/typec/tcpm/tcpm.c
> @@ -1096,7 +1096,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
> break;
> case CMD_ATTENTION:
> /* Attention command does not have response */
> - typec_altmode_attention(adev, p[1]);
> + if (adev)
> + typec_altmode_attention(adev, p[1]);
> return 0;
> default:
> break;
> @@ -1148,20 +1149,26 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
> }
> break;
> case CMD_ENTER_MODE:
> - typec_altmode_update_active(pdev, true);
> -
> - if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
> - response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE);
> - response[0] |= VDO_OPOS(adev->mode);
> - return 1;
> + if (adev && pdev) {
> + typec_altmode_update_active(pdev, true);
> +
> + if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
> + response[0] = VDO(adev->svid, 1,
> + CMD_EXIT_MODE);
> + response[0] |= VDO_OPOS(adev->mode);
> + return 1;
> + }
> }
> return 0;
> case CMD_EXIT_MODE:
> - typec_altmode_update_active(pdev, false);
> + if (adev && pdev) {
> + typec_altmode_update_active(pdev, false);
>
> - /* Back to USB Operation */
> - WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
> - NULL));
> + /* Back to USB Operation */
> + WARN_ON(typec_altmode_notify(adev,
> + TYPEC_STATE_USB,
> + NULL));
> + }
> break;
> default:
> break;
> @@ -1171,8 +1178,10 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
> switch (cmd) {
> case CMD_ENTER_MODE:
> /* Back to USB Operation */
> - WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
> - NULL));
> + if (adev)
> + WARN_ON(typec_altmode_notify(adev,
> + TYPEC_STATE_USB,
> + NULL));
> break;
> default:
> break;
> @@ -1183,7 +1192,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
> }
>
> /* Informing the alternate mode drivers about everything */
> - typec_altmode_vdm(adev, p[0], &p[1], cnt);
> + if (adev)
> + typec_altmode_vdm(adev, p[0], &p[1], cnt);
>
> return rlen;
> }
>

\
 
 \ /
  Last update: 2019-08-02 17:26    [W:0.077 / U:46.676 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site