Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1743141

Re: [PATCH v2] xhci: Cleanup current_cmd in xhci_cleanup_command_queue()

Show all headers | View raw

On 29.09.2017 14:07, Jeffy Chen wrote:
> KASAN reported use-after-free bug when xhci host controller died:
> [  176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
> [  176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
> ...
> [  177.180644] Freed by task 0:
> [  177.183882]  kasan_slab_free+0x90/0x15c
> [  177.188194]  kfree+0x114/0x28c
> [  177.191630]  xhci_cleanup_command_queue+0xc8/0xf8
> [  177.196916]  xhci_hc_died+0x84/0x358
>
> Problem here is that when the cmd_timer fired, it would try to access
> current_cmd while the command queue is already freed by xhci_hc_died().
>
> Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that.
>
> Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
> Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
> ---
>
>

Thanks, adding patch to queue

-Mathias

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v2] xhci: Cleanup current_cmd in xhci_cleanup_command_queue() Jeffy Chen <jeffy.chen@rock-chips.com> - 2017-09-29 13:10 +0200
  Re: [PATCH v2] xhci: Cleanup current_cmd in  xhci_cleanup_command_queue() Mathias Nyman <mathias.nyman@linux.intel.com> - 2017-10-02 13:50 +0200

csiph-web