lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 039/294] xhci: Fix NULL pointer dereference when cleaning up streams for removed host
    3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mathias Nyman <mathias.nyman@linux.intel.com>

    commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.

    This off by one in stream_id indexing caused NULL pointer dereference and
    soft lockup on machines with USB attached SCSI devices connected to a
    hotpluggable xhci controller.

    The code that cleans up pending URBs for dead hosts tried to dereference
    a stream ring at the invalid stream_id 0.
    ep->stream_info->stream_rings[0] doesn't point to a ring.

    Start looping stream_id from 1 like in all the other places in the driver,
    and check that the ring exists before trying to kill URBs on it.

    Reported-by: rocko r <rockorequin@gmail.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/host/xhci-ring.c | 11 +++++++----
    1 file changed, 7 insertions(+), 4 deletions(-)

    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -821,13 +821,16 @@ static void xhci_kill_endpoint_urbs(stru
    (ep->ep_state & EP_GETTING_NO_STREAMS)) {
    int stream_id;

    - for (stream_id = 0; stream_id < ep->stream_info->num_streams;
    + for (stream_id = 1; stream_id < ep->stream_info->num_streams;
    stream_id++) {
    + ring = ep->stream_info->stream_rings[stream_id];
    + if (!ring)
    + continue;
    +
    xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
    "Killing URBs for slot ID %u, ep index %u, stream %u",
    - slot_id, ep_index, stream_id + 1);
    - xhci_kill_ring_urbs(xhci,
    - ep->stream_info->stream_rings[stream_id]);
    + slot_id, ep_index, stream_id);
    + xhci_kill_ring_urbs(xhci, ring);
    }
    } else {
    ring = ep->ring;
    \
     
     \ /
      Last update: 2017-11-08 20:58    [W:4.060 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site