关于Beta3版本使用的Linux kernel 6.1.32存在UCSI问题导致无法开机- Community

[Suggestions for Improvement] 关于Beta3版本使用的Linux kernel 6.1.32存在UCSI问题导致无法开机

deepin 23 631 views · 10 replies ·

136******61

deepin

2024-03-26 15:08

Author

**OS版本：**deepin-desktop-community-23-Beta3-amd64

问题描述：安装上述版本OS，一直卡在开机界面，无法正常进入系统

问题定位步骤：

1、获取上述问题发生时Linux kernel log，发现下面代码处发生空指针异常

/drivers/usb/typec/ucsi/ucsi_acpi.c中ua->cmd = *(u64 *)val;处

static int ucsi_acpi_async_write(struct ucsi *ucsi, unsigned int offset,
                 const void *val, size_t val_len)
{
    ……
    ua->cmd = *(u64 *)val;
    ……
}

2、分析发现ucsi NULL pointer问题是在写cmd 6 UCSI_GET_CAPABILITY时出现了UCSI_CCI_BUSY，然后在async_write_(ucsi, UCSI_CANCEL, NULL,0)时候直接传递的NULL参数。代码位置/drivers/usb/typec/ucsi/ucsi.c，具体位置如下：

static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd)
{
    ……

    if (cci & UCSI_CCI_BUSY) {
        ucsi->ops->async_write(ucsi, UCSI_CANCEL, NULL, 0);
        return -EBUSY;
    }

    ……
}

修正patch：

Linux kernel 6.4有修正patch处理了空指针问题，commit如下

commit c4a8bfabefed706bb9150867db528ceefd5cb5fe
Author: Heikki Krogerus
Date: Tue Jun 6 14:58:02 2023 +0300

    usb: typec: ucsi: Fix command cancellation

    The Cancel command was passed to the write callback as the
    offset instead of as the actual command which caused NULL
    pointer dereference.

    Reported-by: Stephan Bolten
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217517
    Fixes: 094902bc6a3c ("usb: typec: ucsi: Always cancel the command if PPM reports BUSY condition")
    Cc: [email protected]
    Signed-off-by: Heikki Krogerus
    Message-ID: <[email protected]>
    Signed-off-by: Greg Kroah-Hartman

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 2b472ec01dc4..b664ecbb798b 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -132,10 +132,8 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd)
        if (ret)
                return ret;

-       if (cci & UCSI_CCI_BUSY) {
-               ucsi->ops->async_write(ucsi, UCSI_CANCEL, NULL, 0);
-               return -EBUSY;
-       }
+       if (cmd != UCSI_CANCEL && cci & UCSI_CCI_BUSY)
+               return ucsi_exec_command(ucsi, UCSI_CANCEL);

        if (!(cci & UCSI_CCI_COMMAND_COMPLETE))
                return -EIO;
@@ -149,6 +147,11 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd)
                return ucsi_read_error(ucsi);
        }

+       if (cmd == UCSI_CANCEL && cci & UCSI_CCI_CANCEL_COMPLETE) {
+               ret = ucsi_acknowledge_command(ucsi);
+               return ret ? ret : -EBUSY;
+       }
+
        return UCSI_CCI_LENGTH(cci);
}