lkml.org 
[lkml]   [2020]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] USB:Fix kernel NULL pointer when unbind UHCI form vfio-pci
On Wed, Jul 22, 2020 at 02:44:14PM +0200, Greg KH wrote:
> On Wed, Jul 22, 2020 at 07:57:48PM +0800, WeitaoWangoc wrote:
> > This bug is found in Zhaoxin platform, but it's a commom code bug.
> > Fail sequence:
> > step1: Unbind UHCI controller from native driver;
> > step2: Bind UHCI controller to vfio-pci, which will put UHCI controller in one vfio
> > group's device list and set UHCI's dev->driver_data to struct vfio-pci(for UHCI)
>
> Hah, that works? How do you do that properly? What code does that?

Yeah, that can't possibly work. The USB core expects that any host
controller device (or at least, any PCI host controller device) has its
driver_data set to point to a struct usb_hcd. It doesn't expect a host
controller to be bound to anything other than a host controller driver.

Things could easily go very wrong here. For example, suppose at this
point the ehci-hcd driver just happens to bind to the EHCI controller.
When this happens, the EHCI controller hardware takes over all the USB
connections that were routed to the UHCI controller. How will vfio-pci
deal with that? Pretty ungracefully, I imagine.

The only way to make this work at all is to unbind both uhci-hcd and
ehci-hcd first. Then after both are finished you can safely bind
vfio-pci to the EHCI controller and the UHCI controllers (in that
order).

Alan Stern

\
 
 \ /
  Last update: 2020-07-22 17:00    [W:0.093 / U:0.892 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site