Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1742051 > unrolled thread
| Started by | Jeffy Chen <jeffy.chen@rock-chips.com> |
|---|---|
| First post | 2017-09-29 13:10 +0200 |
| Last post | 2017-10-02 13:50 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH v2] xhci: Cleanup current_cmd in xhci_cleanup_command_queue() Jeffy Chen <jeffy.chen@rock-chips.com> - 2017-09-29 13:10 +0200
Re: [PATCH v2] xhci: Cleanup current_cmd in xhci_cleanup_command_queue() Mathias Nyman <mathias.nyman@linux.intel.com> - 2017-10-02 13:50 +0200
| From | Jeffy Chen <jeffy.chen@rock-chips.com> |
|---|---|
| Date | 2017-09-29 13:10 +0200 |
| Subject | [PATCH v2] xhci: Cleanup current_cmd in xhci_cleanup_command_queue() |
| Message-ID | <uv1l7-5ng-1@gated-at.bofh.it> |
KASAN reported use-after-free bug when xhci host controller died:
[ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
[ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
...
[ 177.180644] Freed by task 0:
[ 177.183882] kasan_slab_free+0x90/0x15c
[ 177.188194] kfree+0x114/0x28c
[ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8
[ 177.196916] xhci_hc_died+0x84/0x358
Problem here is that when the cmd_timer fired, it would try to access
current_cmd while the command queue is already freed by xhci_hc_died().
Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that.
Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
---
Changes in v2:
We cannot cancel cmd_timer in xhci_hc_died(), which would cause
might_sleep warning.
drivers/usb/host/xhci-ring.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a9443651ce0f..48ae15afa59e 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1309,6 +1309,7 @@ static void xhci_complete_del_and_free_cmd(struct xhci_command *cmd, u32 status)
void xhci_cleanup_command_queue(struct xhci_hcd *xhci)
{
struct xhci_command *cur_cmd, *tmp_cmd;
+ xhci->current_cmd = NULL;
list_for_each_entry_safe(cur_cmd, tmp_cmd, &xhci->cmd_list, cmd_list)
xhci_complete_del_and_free_cmd(cur_cmd, COMP_COMMAND_ABORTED);
}
--
2.11.0
[toc] | [next] | [standalone]
| From | Mathias Nyman <mathias.nyman@linux.intel.com> |
|---|---|
| Date | 2017-10-02 13:50 +0200 |
| Subject | Re: [PATCH v2] xhci: Cleanup current_cmd in xhci_cleanup_command_queue() |
| Message-ID | <uw7ou-6Mk-17@gated-at.bofh.it> |
| In reply to | #1742051 |
On 29.09.2017 14:07, Jeffy Chen wrote:
> KASAN reported use-after-free bug when xhci host controller died:
> [ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
> [ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
> ...
> [ 177.180644] Freed by task 0:
> [ 177.183882] kasan_slab_free+0x90/0x15c
> [ 177.188194] kfree+0x114/0x28c
> [ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8
> [ 177.196916] xhci_hc_died+0x84/0x358
>
> Problem here is that when the cmd_timer fired, it would try to access
> current_cmd while the command queue is already freed by xhci_hc_died().
>
> Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that.
>
> Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
> Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
> ---
>
>
Thanks, adding patch to queue
-Mathias
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web