Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1313682
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.1 11/43] usb: core : hub: Fix BOS NULL pointer kernel panic |
| Date | 2016-01-21 00:30 +0100 |
| Message-ID | <qTamm-53Q-5@gated-at.bofh.it> (permalink) |
| References | <qTacF-4ZC-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Yang <hansy@nvidia.com>
commit 464ad8c43a9ead98c2b0eaed86bea727f2ad106e upstream.
When a USB 3.0 mass storage device is disconnected in transporting
state, storage device driver may handle it as a transport error and
reset the device by invoking usb_reset_and_verify_device()
and following could happen:
in usb_reset_and_verify_device():
udev->bos = NULL;
For U1/U2 enabled devices, driver will disable LPM, and in some
conditions:
from usb_unlocked_disable_lpm()
--> usb_disable_lpm()
--> usb_enable_lpm()
udev->bos->ss_cap->bU1devExitLat;
And it causes 'NULL pointer' and 'kernel panic':
[ 157.976257] Unable to handle kernel NULL pointer dereference
at virtual address 00000010
...
[ 158.026400] PC is at usb_enable_link_state+0x34/0x2e0
[ 158.031442] LR is at usb_enable_lpm+0x98/0xac
...
[ 158.137368] [<ffffffc0006a1cac>] usb_enable_link_state+0x34/0x2e0
[ 158.143451] [<ffffffc0006a1fec>] usb_enable_lpm+0x94/0xac
[ 158.148840] [<ffffffc0006a20e8>] usb_disable_lpm+0xa8/0xb4
...
[ 158.214954] Kernel panic - not syncing: Fatal exception
This commit moves 'udev->bos = NULL' behind usb_unlocked_disable_lpm()
to prevent from NULL pointer access.
Issue can be reproduced by following setup:
1) A SS pen drive behind a SS hub connected to the host.
2) Transporting data between the pen drive and the host.
3) Abruptly disconnect hub and pen drive from host.
4) With a chance it crashes.
Signed-off-by: Hans Yang <hansy@nvidia.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5312,9 +5312,6 @@ static int usb_reset_and_verify_device(s
if (udev->usb2_hw_lpm_enabled == 1)
usb_set_usb2_hardware_lpm(udev, 0);
- bos = udev->bos;
- udev->bos = NULL;
-
/* Disable LPM and LTM while we reset the device and reinstall the alt
* settings. Device-initiated LPM settings, and system exit latency
* settings are cleared when the device is reset, so we have to set
@@ -5323,15 +5320,18 @@ static int usb_reset_and_verify_device(s
ret = usb_unlocked_disable_lpm(udev);
if (ret) {
dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
- goto re_enumerate;
+ goto re_enumerate_no_bos;
}
ret = usb_disable_ltm(udev);
if (ret) {
dev_err(&udev->dev, "%s Failed to disable LTM\n.",
__func__);
- goto re_enumerate;
+ goto re_enumerate_no_bos;
}
+ bos = udev->bos;
+ udev->bos = NULL;
+
for (i = 0; i < SET_CONFIG_TRIES; ++i) {
/* ep0 maxpacket size may change; let the HCD know about it.
@@ -5428,10 +5428,11 @@ done:
return 0;
re_enumerate:
- /* LPM state doesn't matter when we're about to destroy the device. */
- hub_port_logical_disconnect(parent_hub, port1);
usb_release_bos_descriptor(udev);
udev->bos = bos;
+re_enumerate_no_bos:
+ /* LPM state doesn't matter when we're about to destroy the device. */
+ hub_port_logical_disconnect(parent_hub, port1);
return -ENODEV;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.1 00/43] 4.1.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 40/43] KEYS: Fix race between key destruction and finding a keyring by name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 25/43] sh_eth: fix kernel oops in skb_put() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 39/43] rhashtable: Fix walker list corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 31/43] net_sched: make qdisc_tree_decrease_qlen() work for non mq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 37/43] af_unix: Revert lock_interruptible in stream receive code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 20/43] sctp: also copy sk_tsflags when copying the socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100 [PATCH 4.1 11/43] usb: core : hub: Fix BOS NULL pointer kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 05/43] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 15/43] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 10/43] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 04/43] USB: serial: Another Infineon flash loader USB ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 01/43] tpm, tpm_tis: fix tpm_tis ACPI detection issue with TPM 2.0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 07/43] USB: add quirk for devices with broken LPM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 12/43] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 13/43] pppoe: fix memory corruption in padt work structure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 06/43] USB: cp210x: Remove CP2110 ID from compatibility list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 17/43] vxlan: fix incorrect RCO bit in VXLAN header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 14/43] gre6: allow to update all parameters via rtnl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 [PATCH 4.1 03/43] USB: cdc_acm: Ignore Infineon Flash Loader utility Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100 Re: [PATCH 4.1 00/43] 4.1.16-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-21 01:00 +0100 Re: [PATCH 4.1 00/43] 4.1.16-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-21 13:30 +0100
csiph-web