Messages in this thread | | | Date | Fri, 17 Nov 2023 15:32:24 +0200 | From | Mathias Nyman <> | Subject | Re: [PATCH] xhci: fix null pointer deref for xhci_urb_enqueue |
| |
On 17.11.2023 9.21, Kuen-Han Tsai wrote: > The null pointer dereference happens when xhci_free_dev() frees the > xhci->devs[slot_id] virtual device while xhci_urb_enqueue() is > processing a urb and checking the max packet size. > > [106913.850735][ T2068] usb 2-1: USB disconnect, device number 2 > [106913.856999][ T4618] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 > [106913.857488][ T4618] Call trace: > [106913.857491][ T4618] xhci_check_maxpacket+0x30/0x2dc > [106913.857494][ T4618] xhci_urb_enqueue+0x24c/0x47c > [106913.857498][ T4618] usb_hcd_submit_urb+0x1f4/0xf34 > [106913.857501][ T4618] usb_submit_urb+0x4b8/0x4fc > [106913.857503][ T4618] usb_control_msg+0x144/0x238 > [106913.857507][ T4618] do_proc_control+0x1f0/0x5bc > [106913.857509][ T4618] usbdev_ioctl+0xdd8/0x15a8 > > This patch adds a spinlock to the xhci_urb_enqueue function to make sure > xhci_free_dev() and xhci_urb_enqueue() do not race and cause null > pointer dereference.
Thanks, nice catch
This patch does however need some additional tuning
> > Signed-off-by: Kuen-Han Tsai <khtsai@google.com> > --- > drivers/usb/host/xhci.c | 38 ++++++++++++++++++++++++-------------- > 1 file changed, 24 insertions(+), 14 deletions(-) > > diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c > index 884b0898d9c9..e0766ebeff0e 100644 > --- a/drivers/usb/host/xhci.c > +++ b/drivers/usb/host/xhci.c > @@ -1522,23 +1522,32 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag > struct urb_priv *urb_priv; > int num_tds; > > - if (!urb) > - return -EINVAL; > - ret = xhci_check_args(hcd, urb->dev, urb->ep, > - true, true, __func__); > - if (ret <= 0) > - return ret ? ret : -EINVAL; > + spin_lock_irqsave(&xhci->lock, flags); > + > + if (!urb) { > + ret = -EINVAL; > + goto done; > + } > + > + ret = xhci_check_args(hcd, urb->dev, urb->ep, true, true, __func__); > + if (ret <= 0) { > + ret = ret ? ret : -EINVAL; > + goto done; > + } > > slot_id = urb->dev->slot_id; > ep_index = xhci_get_endpoint_index(&urb->ep->desc); > ep_state = &xhci->devs[slot_id]->eps[ep_index].ep_state; > > - if (!HCD_HW_ACCESSIBLE(hcd)) > - return -ESHUTDOWN; > + if (!HCD_HW_ACCESSIBLE(hcd)) { > + ret = -ESHUTDOWN; > + goto done; > + } > > if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) { > xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n"); > - return -ENODEV; > + ret = -ENODEV; > + goto done; > } > > if (usb_endpoint_xfer_isoc(&urb->ep->desc)) > @@ -1552,8 +1561,10 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag > num_tds = 1; > > urb_priv = kzalloc(struct_size(urb_priv, td, num_tds), mem_flags);
kzalloc with spinlock held, should preferably be moved outside lock, otherwise should use GFP_ATOMIC
> - if (!urb_priv) > - return -ENOMEM; > + if (!urb_priv) { > + ret = -ENOMEM; > + goto done; > + } > > urb_priv->num_tds = num_tds; > urb_priv->num_tds_done = 0; > @@ -1571,13 +1582,11 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
xhci_check_maxpacket() called here can't be called with spinlock held
> if (ret < 0) { > xhci_urb_free_priv(urb_priv); > urb->hcpriv = NULL; > - return ret; > + goto done;
Thanks Mathias
| |