Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1696378
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 050/125] xhci: Fix NULL pointer dereference when cleaning up streams for removed host |
| Date | 2017-07-25 22:40 +0200 |
| Message-ID | <u7eMB-7zW-81@gated-at.bofh.it> (permalink) |
| References | <u7dGN-6Sz-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.
This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.
The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.
Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.
Reported-by: rocko r <rockorequin@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -860,13 +860,16 @@ static void xhci_kill_endpoint_urbs(stru
(ep->ep_state & EP_GETTING_NO_STREAMS)) {
int stream_id;
- for (stream_id = 0; stream_id < ep->stream_info->num_streams;
+ for (stream_id = 1; stream_id < ep->stream_info->num_streams;
stream_id++) {
+ ring = ep->stream_info->stream_rings[stream_id];
+ if (!ring)
+ continue;
+
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Killing URBs for slot ID %u, ep index %u, stream %u",
- slot_id, ep_index, stream_id + 1);
- xhci_kill_ring_urbs(xhci,
- ep->stream_info->stream_rings[stream_id]);
+ slot_id, ep_index, stream_id);
+ xhci_kill_ring_urbs(xhci, ring);
}
} else {
ring = ep->ring;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 000/125] 4.9.40-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 068/125] ipmi: use rcu lock around call to intf->handlers->sender() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 046/125] PCI: rockchip: Use normal register bank for config accessors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 042/125] powerpc/asm: Mark cr0 as clobbered in mftb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 035/125] scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 044/125] af_key: Fix sadb_x_ipsecrequest parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 037/125] xen/scsiback: Fix a TMR related use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 053/125] usb: storage: return on error to avoid a null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 030/125] ASoC: compress: Derive substream from stream based on direction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 008/125] ath9k: fix tx99 bus error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 027/125] wlcore: fix 64K page support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 056/125] usb: renesas_usbhs: gadget: disable all eps when the driver stops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 047/125] PCI/PM: Restore the status of PCI devices across hibernation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 049/125] xhci: fix 20000ms port resume timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 028/125] btrfs: Dont clear SGID when inheriting ACLs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 033/125] PM / Domains: Fix unsafe iteration over modified list of domains Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 052/125] [media] mxl111sf: Fix driver to use heap allocate buffers for USB messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 009/125] ath9k: fix an invalid pointer dereference in ath9k_rng_stop() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 041/125] powerpc: Fix emulation of mfocrf in emulate_step() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 043/125] powerpc/mm/radix: Properly clear process table entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 039/125] powerpc/64: Fix atomic64_inc_not_zero() to return an int Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 034/125] scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 029/125] igb: Explicitly select page 0 at initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 032/125] PM / Domains: Fix unsafe iteration over modified list of domain providers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 036/125] iscsi-target: Add login_keys_workaround attribute for non RFC initiators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 054/125] USB: cdc-acm: add device-id for quirky printer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 071/125] f2fs: sanity check size of nat and sit cache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 050/125] xhci: Fix NULL pointer dereference when cleaning up streams for removed host Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 069/125] ipmi:ssif: Add missing unlock in error branch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 026/125] Bluetooth: use constant time memory comparison for secret values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 031/125] PM / Domains: Fix unsafe iteration over modified list of device links Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 040/125] powerpc: Fix emulation of mcrf in emulate_step() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 023/125] perf intel-pt: Ensure never to set last_ip when packet count is zero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 003/125] dm mpath: cleanup -Wbool-operation warning in choose_pgpath() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 017/125] NFC: Add sockaddr length checks before accessing sa_family in bind handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 018/125] perf intel-pt: Move decoder error setting into one condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 005/125] thermal: max77620: fix device-node reference imbalance Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 006/125] thermal: cpu_cooling: Avoid accessing potentially freed structures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 004/125] [media] s5p-jpeg: dont return a random width/height Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 001/125] disable new gcc-7.1.1 warnings for now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 015/125] nfc: Ensure presence of required attributes in the activate_target handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 020/125] perf intel-pt: Fix missing stack clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 002/125] [media] ir-core: fix gcc-7 warning on bool arithmetic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 012/125] NFC: nfcmrvl: do not use device-managed resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 007/125] ath9k: fix tx99 use after free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 021/125] perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 011/125] NFC: nfcmrvl_uart: add missing tty-device sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 014/125] NFC: nfcmrvl: fix firmware-management initialisation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 016/125] nfc: Fix the sockaddr length sanitization in llcp_sock_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 019/125] perf intel-pt: Improve sample timestamp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 010/125] NFC: fix broken device allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 013/125] NFC: nfcmrvl: use nfc-device for firmware download Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-26 05:00 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Sumit Semwal <sumit.semwal@linaro.org> - 2017-07-26 16:20 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-26 22:00 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-26 16:30 +0200
csiph-web