Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1330733

[PATCH 3.19.y-ckt 12/47] usb: hub: do not clear BOS field during reset device

Show all headers | View raw

3.19.8-ckt15 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Du, Changbin" <changbin.du@intel.com>

commit d8f00cd685f5c8e0def8593e520a7fef12c22407 upstream.

In function usb_reset_and_verify_device, the old BOS descriptor may
still be used before allocating a new one. (usb_unlocked_disable_lpm
function uses it under the situation that it fails to disable lpm.)
So we cannot set the udev->bos to NULL before that, just keep what it
was. It will be overwrite when allocating a new one.

Crash log:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000010
IP: [<ffffffff8171f98d>] usb_enable_link_state+0x2d/0x2f0
Call Trace:
[<ffffffff8171ed5b>] ? usb_set_lpm_timeout+0x12b/0x140
[<ffffffff8171fcd1>] usb_enable_lpm+0x81/0xa0
[<ffffffff8171fdd8>] usb_disable_lpm+0xa8/0xc0
[<ffffffff8171fe1c>] usb_unlocked_disable_lpm+0x2c/0x50
[<ffffffff81723933>] usb_reset_and_verify_device+0xc3/0x710
[<ffffffff8172c4ed>] ? usb_sg_wait+0x13d/0x190
[<ffffffff81724743>] usb_reset_device+0x133/0x280
[<ffffffff8179ccd1>] usb_stor_port_reset+0x61/0x70
[<ffffffff8179cd68>] usb_stor_invoke_transport+0x88/0x520

Signed-off-by: Du, Changbin <changbin.du@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/core/hub.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index fde1e10..5630198 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5361,7 +5361,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 	}
 
 	bos = udev->bos;
-	udev->bos = NULL;
 
 	for (i = 0; i < SET_CONFIG_TRIES; ++i) {
 
@@ -5454,8 +5453,11 @@ done:
 	usb_set_usb2_hardware_lpm(udev, 1);
 	usb_unlocked_enable_lpm(udev);
 	usb_enable_ltm(udev);
-	usb_release_bos_descriptor(udev);
-	udev->bos = bos;
+	/* release the new BOS descriptor allocated  by hub_port_init() */
+	if (udev->bos != bos) {
+		usb_release_bos_descriptor(udev);
+		udev->bos = bos;
+	}
 	return 0;
 
 re_enumerate:
-- 
1.9.1

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt15 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 47/47] KEYS: Fix keyring ref leak in join_session_keyring() Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 41/47] perf hists: Fix HISTC_MEM_DCACHELINE width setting Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 11/47] cdc-acm:exclude Samsung phone 04e8:685d Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 10/47] usb: cdc-acm: send zero packet for intel 7260 modem Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 17/47] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 35/47] ALSA: dummy: Disable switching timer backend via sysfs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 34/47] seccomp: always propagate NO_NEW_PRIVS on tsync Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 19/47] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 23/47] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 16/47] USB: serial: option: Adding support for Telit LE922 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 36/47] drm/vmwgfx: respect 'nomodeset' Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 24/47] ALSA: bebob: Use a signed return type for get_formation_index Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 12/47] usb: hub: do not clear BOS field during reset device Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 09/47] usb: cdc-acm: handle unlinked urb in acm read callback Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 30/47] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 21/47] USB: option: fix Cinterion AHxx enumeration Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 28/47] powerpc/eeh: Fix PE location code Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 15/47] USB: serial: visor: fix crash on detecting device without write_urbs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 32/47] staging/speakup: Use tty_ldisc_ref() for paste kworker Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 22/47] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 14/47] USB: visor: fix null-deref at probe Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 26/47] arm64: mm: avoid calling apply_to_page_range on empty range Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 27/47] x86/mm: Fix types used in pgprot cacheability flags translations Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 20/47] arm64: kernel: fix architected PMU registers unconditional access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 08/47] ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 29/47] SCSI: fix crashes in sd and sr runtime PM Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 25/47] arm64: errata: Add -mpc-relative-literal-loads to build flags Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 07/47] ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist" Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 03/47] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 06/47] powerpc: Simplify module TOC handling Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 04/47] KVM: PPC: Fix ONE_REG AltiVec support Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 02/47] iio: adis_buffer: Fix out-of-bounds memory access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100

csiph-web