Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1696572
| Path | csiph.com!weretis.net!feeder4.news.weretis.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod |
|---|---|
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 26/60] xhci: Fix NULL pointer dereference when cleaning up streams for removed host |
| Date | Tue, 25 Jul 2017 23:40:01 +0200 |
| Message-ID | <u7fIB-8eE-7@gated-at.bofh.it> (permalink) |
| References | <u7dx7-6OD-3@gated-at.bofh.it> |
| X-Original-To | linux-kernel@vger.kernel.org |
| X-Mailer | git-send-email 2.13.3 |
| User-Agent | quilt/0.65 |
| MIME-Version | 1.0 |
| Content-Type | text/plain; charset=UTF-8 |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 50 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, rocko r <rockorequin@gmail.com>, Mathias Nyman <mathias.nyman@linux.intel.com> |
| X-Original-Date | Tue, 25 Jul 2017 12:16:17 -0700 |
| X-Original-Message-ID | <20170725191617.861448931@linuxfoundation.org> |
| X-Original-References | <20170725191614.043749784@linuxfoundation.org> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1696572 |
Show key headers only | View raw
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.
This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.
The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.
Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.
Reported-by: rocko r <rockorequin@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -782,13 +782,16 @@ static void xhci_kill_endpoint_urbs(stru
(ep->ep_state & EP_GETTING_NO_STREAMS)) {
int stream_id;
- for (stream_id = 0; stream_id < ep->stream_info->num_streams;
+ for (stream_id = 1; stream_id < ep->stream_info->num_streams;
stream_id++) {
+ ring = ep->stream_info->stream_rings[stream_id];
+ if (!ring)
+ continue;
+
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Killing URBs for slot ID %u, ep index %u, stream %u",
- slot_id, ep_index, stream_id + 1);
- xhci_kill_ring_urbs(xhci,
- ep->stream_info->stream_rings[stream_id]);
+ slot_id, ep_index, stream_id);
+ xhci_kill_ring_urbs(xhci, ring);
}
} else {
ring = ep->ring;
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH 3.18 26/60] xhci: Fix NULL pointer dereference when cleaning up streams for removed host Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 23:40 +0200
csiph-web