Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1321410

[PATCH v6 04/22] usb: dwc2: host: Avoid use of chan->qh after qh freed

From Douglas Anderson <dianders@chromium.org>
Newsgroups linux.kernel
Subject [PATCH v6 04/22] usb: dwc2: host: Avoid use of chan->qh after qh freed
Date 2016-01-29 03:30 +0100
Message-ID <qW6YX-4gM-29@gated-at.bofh.it> (permalink)
References <qW6YW-4gM-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

When poking around with USB devices with slub_debug enabled, I found
another obvious use after free.  Turns out that in dwc2_hc_n_intr() I
was in a state when the contents of chan->qh was filled with 0x6b,
indicating that chan->qh was freed but chan still had a reference to
it.

Let's make sure that whenever we free qh we also make sure we remove a
reference from its channel.

The bug fixed here doesn't appear to be new--I believe I just got lucky
and happened to see it while stress testing.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
---
Changes in v6:
- Add one more instance of check; kept Reviewed-by / Tested-by (OK?).
- Add Kever's Reviewed-by.
- Add Heiko's Tested-by.
- Add Stefan's Tested-by.

Changes in v5: None
Changes in v4:
- Avoid use of chan->qh after qh freed new for v4.

Changes in v3: None
Changes in v2: None

 drivers/usb/dwc2/hcd.c      | 10 ++++++++++
 drivers/usb/dwc2/hcd_intr.c | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index bc4bdbc1534e..e2d2e9be366e 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -164,6 +164,9 @@ static void dwc2_qh_list_free(struct dwc2_hsotg *hsotg,
 					 qtd_list_entry)
 			dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh);
 
+		if (qh->channel && qh->channel->qh == qh)
+			qh->channel->qh = NULL;
+
 		spin_unlock_irqrestore(&hsotg->lock, flags);
 		dwc2_hcd_qh_free(hsotg, qh);
 		spin_lock_irqsave(&hsotg->lock, flags);
@@ -554,7 +557,12 @@ static int dwc2_hcd_endpoint_disable(struct dwc2_hsotg *hsotg,
 		dwc2_hcd_qtd_unlink_and_free(hsotg, qtd, qh);
 
 	ep->hcpriv = NULL;
+
+	if (qh->channel && qh->channel->qh == qh)
+		qh->channel->qh = NULL;
+
 	spin_unlock_irqrestore(&hsotg->lock, flags);
+
 	dwc2_hcd_qh_free(hsotg, qh);
 
 	return 0;
@@ -2782,6 +2790,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
 fail3:
 	dwc2_urb->priv = NULL;
 	usb_hcd_unlink_urb_from_ep(hcd, urb);
+	if (qh_allocated && qh->channel && qh->channel->qh == qh)
+		qh->channel->qh = NULL;
 fail2:
 	spin_unlock_irqrestore(&hsotg->lock, flags);
 	urb->hcpriv = NULL;
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 352c98364317..99efc2bd1617 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1935,6 +1935,16 @@ static void dwc2_hc_n_intr(struct dwc2_hsotg *hsotg, int chnum)
 	}
 
 	dwc2_writel(hcint, hsotg->regs + HCINT(chnum));
+
+	/*
+	 * If we got an interrupt after someone called
+	 * dwc2_hcd_endpoint_disable() we don't want to crash below
+	 */
+	if (!chan->qh) {
+		dev_warn(hsotg->dev, "Interrupt on disabled channel\n");
+		return;
+	}
+
 	chan->hcint = hcint;
 	hcint &= hcintmsk;
 
-- 
2.7.0.rc3.207.g0ac5344

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v6 0/22] usb: dwc2: host: Fix and speed up all the stuff, especially with splits Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 09/22] usb: dwc2: host: Giveback URB in tasklet context Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 06/22] usb: dwc2: host: fix split transfer schedule sequence Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 15/22] usb: dwc2: host: Split code out to make dwc2_do_reserve() Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 22/22] usb: dwc2: host: If using uframe scheduler, end splits better Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 11/22] usb: dwc2: host: There's not really a TT for the root hub Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
    Re: [PATCH v6 11/22] usb: dwc2: host: There's not really a TT for  the root hub Kever Yang <kever.yang@rock-chips.com> - 2016-01-31 10:30 +0100
  [PATCH v6 02/22] usb: dwc2: host: Get aligned DMA in a more supported way Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 10/22] usb: dwc2: host: Properly set the HFIR Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
    Re: [PATCH v6 10/22] usb: dwc2: host: Properly set the HFIR Kever Yang <kever.yang@rock-chips.com> - 2016-01-31 10:30 +0100
      Re: [PATCH v6 10/22] usb: dwc2: host: Properly set the HFIR Doug Anderson <dianders@chromium.org> - 2016-01-31 23:20 +0100
  [PATCH v6 13/22] usb: dwc2: host: Rename some fields in struct dwc2_qh Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 04/22] usb: dwc2: host: Avoid use of chan->qh after qh freed Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 16/22] usb: dwc2: host: Add scheduler logging for missed SOFs Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 01/22] usb: dwc2: rockchip: Make the max_transfer_size automatic Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 17/22] usb: dwc2: host: Manage frame nums better in scheduler Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
    Re: [PATCH v6 17/22] usb: dwc2: host: Manage frame nums better in scheduler Doug Anderson <dianders@chromium.org> - 2016-02-03 21:40 +0100
  [PATCH v6 05/22] usb: dwc2: host: Always add to the tail of queues Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 19/22] usb: dwc2: host: Add dwc2_hcd_get_future_frame_number() call Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 03/22] usb: dwc2: host: Set host_rx_fifo_size to 525 for rk3066 Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 07/22] usb: dwc2: host: Add scheduler tracing Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 08/22] usb: dwc2: host: Add a delay before releasing periodic bandwidth Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 20/22] usb: dwc2: host: Properly set even/odd frame Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
    Re: [PATCH v6 20/22] usb: dwc2: host: Properly set even/odd frame Kever Yang <kever.yang@rock-chips.com> - 2016-02-02 08:50 +0100
      Re: [PATCH v6 20/22] usb: dwc2: host: Properly set even/odd frame Doug Anderson <dianders@chromium.org> - 2016-02-02 23:50 +0100
        Re: [PATCH v6 20/22] usb: dwc2: host: Properly set even/odd frame Kever Yang <kever.yang@rock-chips.com> - 2016-02-03 08:50 +0100
  [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away if it's time Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
    Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away  if it's time Kever Yang <kever.yang@rock-chips.com> - 2016-01-31 10:40 +0100
      Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away if  it's time Doug Anderson <dianders@chromium.org> - 2016-01-31 23:10 +0100
        Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away  if it's time Kever Yang <kever.yang@rock-chips.com> - 2016-02-01 04:40 +0100
          Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away if  it's time Doug Anderson <dianders@chromium.org> - 2016-02-01 05:40 +0100
            Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away if  it's time Doug Anderson <dianders@chromium.org> - 2016-02-02 01:40 +0100
              Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away  if it's time Kever Yang <kever.yang@rock-chips.com> - 2016-02-02 08:10 +0100
                Re: [PATCH v6 18/22] usb: dwc2: host: Schedule periodic right away if  it's time Doug Anderson <dianders@chromium.org> - 2016-02-03 00:40 +0100
  [PATCH v6 14/22] usb: dwc2: host: Reorder things in hcd_queue.c Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  [PATCH v6 12/22] usb: dwc2: host: Use periodic interrupt even with DMA Douglas Anderson <dianders@chromium.org> - 2016-01-29 03:30 +0100
  Re: [PATCH v6 0/22] usb: dwc2: host: Fix and speed up all the  stuff, especially with splits John Youn <John.Youn@synopsys.com> - 2016-02-03 01:00 +0100
    Re: [PATCH v6 0/22] usb: dwc2: host: Fix and speed up all the stuff,  especially with splits Doug Anderson <dianders@chromium.org> - 2016-02-03 19:30 +0100

csiph-web