Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1320268

Re: [PATCH v5 05/21] usb: dwc2: host: Avoid use of chan->qh after qh freed

Show all headers | View raw

Hi Doug,

The NULL pointer bug is one of the most frequent issue we met
during hot plug stress test, thanks for this bug fix.

Reviewed-by: Kever Yang <kever.yang@rock-chips.com>

Thanks,
- Kever
On 01/23/2016 02:18 AM, Douglas Anderson wrote:
> When poking around with USB devices with slub_debug enabled, I found
> another obvious use after free.  Turns out that in dwc2_hc_n_intr() I
> was in a state when the contents of chan->qh was filled with 0x6b,
> indicating that chan->qh was freed but chan still had a reference to
> it.
>
> Let's make sure that whenever we free qh we also make sure we remove a
> reference from its channel.
>
> The bug fixed here doesn't appear to be new--I believe I just got lucky
> and happened to see it while stress testing.
>
> Signed-off-by: Douglas Anderson <dianders@chromium.org>
> ---
> Changes in v5: None
> Changes in v4:
> - Avoid use of chan->qh after qh freed new for v4.
>
> Changes in v3: None
> Changes in v2: None
>
>   drivers/usb/dwc2/hcd.c      |  8 ++++++++
>   drivers/usb/dwc2/hcd_intr.c | 10 ++++++++++
>   2 files changed, 18 insertions(+)
>
> diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
> index bc4bdbc1534e..7783c8ba0173 100644
> --- a/drivers/usb/dwc2/hcd.c
> +++ b/drivers/usb/dwc2/hcd.c
> @@ -164,6 +164,9 @@ static void dwc2_qh_list_free(struct dwc2_hsotg *hsotg,
>   					 qtd_list_entry)
>   			dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh);
>   
> +		if (qh->channel && qh->channel->qh == qh)
> +			qh->channel->qh = NULL;
> +
>   		spin_unlock_irqrestore(&hsotg->lock, flags);
>   		dwc2_hcd_qh_free(hsotg, qh);
>   		spin_lock_irqsave(&hsotg->lock, flags);
> @@ -554,7 +557,12 @@ static int dwc2_hcd_endpoint_disable(struct dwc2_hsotg *hsotg,
>   		dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh);
>   
>   	ep->hcpriv = NULL;
> +
> +	if (qh->channel && qh->channel->qh == qh)
> +		qh->channel->qh = NULL;
> +
>   	spin_unlock_irqrestore(&hsotg->lock, flags);
> +
>   	dwc2_hcd_qh_free(hsotg, qh);
>   
>   	return 0;
> diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
> index 352c98364317..99efc2bd1617 100644
> --- a/drivers/usb/dwc2/hcd_intr.c
> +++ b/drivers/usb/dwc2/hcd_intr.c
> @@ -1935,6 +1935,16 @@ static void dwc2_hc_n_intr(struct dwc2_hsotg *hsotg, int chnum)
>   	}
>   
>   	dwc2_writel(hcint, hsotg->regs + HCINT(chnum));
> +
> +	/*
> +	 * If we got an interrupt after someone called
> +	 * dwc2_hcd_endpoint_disable() we don't want to crash below
> +	 */
> +	if (!chan->qh) {
> +		dev_warn(hsotg->dev, "Interrupt on disabled channel\n");
> +		return;
> +	}
> +
>   	chan->hcint = hcint;
>   	hcint &= hcintmsk;
>   

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v5 0/21] usb: dwc2: host: Fix and speed up all the stuff, especially with splits Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
  [PATCH v5 18/21] usb: dwc2: host: Add dwc2_hcd_get_future_frame_number() call Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
  [PATCH v5 03/21] usb: dwc2: host: Set host_rx_fifo_size to 528 for rk3066 Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
    Re: [PATCH v5 03/21] usb: dwc2: host: Set host_rx_fifo_size to 528  for rk3066 Kever Yang <kever.yang@rock-chips.com> - 2016-01-27 11:20 +0100
      Re: [PATCH v5 03/21] usb: dwc2: host: Set host_rx_fifo_size to 528  for rk3066 Doug Anderson <dianders@chromium.org> - 2016-01-27 20:50 +0100
        Re: [PATCH v5 03/21] usb: dwc2: host: Set host_rx_fifo_size to 528  for rk3066 Kever Yang <kever.yang@rock-chips.com> - 2016-01-28 09:30 +0100
  [PATCH v5 14/21] usb: dwc2: host: Split code out to make dwc2_do_reserve() Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
  [PATCH v5 16/21] usb: dwc2: host: Manage frame nums better in scheduler Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
    Re: [PATCH v5 16/21] usb: dwc2: host: Manage frame nums better in scheduler Doug Anderson <dianders@chromium.org> - 2016-01-27 21:50 +0100
  [PATCH v5 11/21] usb: dwc2: host: Use periodic interrupt even with DMA Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
  [PATCH v5 05/21] usb: dwc2: host: Avoid use of chan->qh after qh freed Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
    Re: [PATCH v5 05/21] usb: dwc2: host: Avoid use of chan->qh after  qh freed Kever Yang <kever.yang@rock-chips.com> - 2016-01-28 04:30 +0100
      Re: [PATCH v5 05/21] usb: dwc2: host: Avoid use of chan->qh after qh freed Doug Anderson <dianders@chromium.org> - 2016-01-29 00:30 +0100
  [PATCH v5 15/21] usb: dwc2: host: Add scheduler logging for missed SOFs Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
  [PATCH v5 21/21] usb: dwc2: host: If using uframe scheduler, end splits better Douglas Anderson <dianders@chromium.org> - 2016-01-22 19:30 +0100
  Re: [PATCH v5 0/21] usb: dwc2: host: Fix and speed up all the stuff, especially with splits Heiko Stuebner <heiko@sntech.de> - 2016-01-23 19:00 +0100
    Re: [PATCH v5 0/21] usb: dwc2: host: Fix and speed up all the stuff,  especially with splits Doug Anderson <dianders@chromium.org> - 2016-01-24 00:20 +0100
      Re: [PATCH v5 0/21] usb: dwc2: host: Fix and speed up all the stuff,  especially with splits Doug Anderson <dianders@chromium.org> - 2016-01-24 06:40 +0100
  Re: [PATCH v5 20/21] usb: dwc2: host: Totally redo the microframe scheduler Doug Anderson <dianders@chromium.org> - 2016-01-24 06:50 +0100

csiph-web