lkml.org 
[lkml]   [2016]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 037/107] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
    Date
    From: AMAN DEEP <aman.deep@samsung.com>

    3.4.111-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    commit 3496810663922617d4b706ef2780c279252ddd6a upstream.

    virt_dev->num_cached_rings counts on freed ring and is not updated
    correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring
    is added into cache and then num_rings_cache is incremented as below:
    virt_dev->ring_cache[rings_cached] =
    virt_dev->eps[ep_index].ring;
    virt_dev->num_rings_cached++;
    here, free ring pointer is added to a current index and then
    index is incremented.
    So current index always points to empty location in the ring cache.
    For getting available free ring, current index should be decremented
    first and then corresponding ring buffer value should be taken from ring
    cache.

    But In function xhci_endpoint_init(), the num_rings_cached index is
    accessed before decrement.
    virt_dev->eps[ep_index].new_ring =
    virt_dev->ring_cache[virt_dev->num_rings_cached];
    virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
    virt_dev->num_rings_cached--;
    This is bug in manipulating the index of ring cache.
    And it should be as below:
    virt_dev->num_rings_cached--;
    virt_dev->eps[ep_index].new_ring =
    virt_dev->ring_cache[virt_dev->num_rings_cached];
    virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;

    Signed-off-by: Aman Deep <aman.deep@samsung.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    drivers/usb/host/xhci-mem.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
    index aa38b1f..048cc38 100644
    --- a/drivers/usb/host/xhci-mem.c
    +++ b/drivers/usb/host/xhci-mem.c
    @@ -1420,10 +1420,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
    /* Attempt to use the ring cache */
    if (virt_dev->num_rings_cached == 0)
    return -ENOMEM;
    + virt_dev->num_rings_cached--;
    virt_dev->eps[ep_index].new_ring =
    virt_dev->ring_cache[virt_dev->num_rings_cached];
    virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
    - virt_dev->num_rings_cached--;
    xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
    1, type);
    }
    --
    1.9.1
    \
     
     \ /
      Last update: 2016-03-16 10:21    [W:4.058 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site