From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga12.intel.com ([192.55.52.136]:47737 "EHLO mga12.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933199AbeFUNRN (ORCPT ); Thu, 21 Jun 2018 09:17:13 -0400 From: Mathias Nyman To: Cc: , Zhengjun Xing , stable@vger.kernel.org, Mathias Nyman Subject: [PATCH 2/5] xhci: Fix kernel oops in trace_xhci_free_virt_device Date: Thu, 21 Jun 2018 16:19:42 +0300 Message-Id: <1529587185-2776-3-git-send-email-mathias.nyman@linux.intel.com> In-Reply-To: <1529587185-2776-1-git-send-email-mathias.nyman@linux.intel.com> References: <1529587185-2776-1-git-send-email-mathias.nyman@linux.intel.com> Sender: stable-owner@vger.kernel.org List-ID: From: Zhengjun Xing commit 44a182b9d177 ("xhci: Fix use-after-free in xhci_free_virt_device") set dev->udev pointer to NULL in xhci_free_dev(), it will cause kernel panic in trace_xhci_free_virt_device. This patch reimplement the trace function trace_xhci_free_virt_device, remove dev->udev dereference and added more useful parameters to show in the trace function,it also makes sure dev->udev is not NULL before calling trace_xhci_free_virt_device. This issue happened when xhci-hcd trace is enabled and USB devices hot plug test. Original use-after-free patch went to stable so this needs so be applied there as well. [ 1092.022457] usb 2-4: USB disconnect, device number 6 [ 1092.092772] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 1092.101694] PGD 0 P4D 0 [ 1092.104601] Oops: 0000 [#1] SMP [ 1092.207734] Workqueue: usb_hub_wq hub_event [ 1092.212507] RIP: 0010:trace_event_raw_event_xhci_log_virt_dev+0x6c/0xf0 [ 1092.220050] RSP: 0018:ffff8c252e883d28 EFLAGS: 00010086 [ 1092.226024] RAX: ffff8c24af86fa84 RBX: 0000000000000003 RCX: ffff8c25255c2a01 [ 1092.234130] RDX: 0000000000000000 RSI: 00000000aef55009 RDI: ffff8c252e883d28 [ 1092.242242] RBP: ffff8c252550e2c0 R08: ffff8c24af86fa84 R09: 0000000000000a70 [ 1092.250364] R10: 0000000000000a70 R11: 0000000000000000 R12: ffff8c251f21a000 [ 1092.258468] R13: 000000000000000c R14: ffff8c251f21a000 R15: ffff8c251f432f60 [ 1092.266572] FS: 0000000000000000(0000) GS:ffff8c252e880000(0000) knlGS:0000000000000000 [ 1092.275757] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1092.282281] CR2: 0000000000000000 CR3: 0000000154209001 CR4: 00000000003606e0 [ 1092.290384] Call Trace: [ 1092.293156] [ 1092.295439] xhci_free_virt_device.part.34+0x182/0x1a0 [ 1092.301288] handle_cmd_completion+0x7ac/0xfa0 [ 1092.306336] ? trace_event_raw_event_xhci_log_trb+0x6e/0xa0 [ 1092.312661] xhci_irq+0x3e8/0x1f60 [ 1092.316524] __handle_irq_event_percpu+0x75/0x180 [ 1092.321876] handle_irq_event_percpu+0x20/0x50 [ 1092.326922] handle_irq_event+0x36/0x60 [ 1092.331273] handle_edge_irq+0x6d/0x180 [ 1092.335644] handle_irq+0x16/0x20 [ 1092.339417] do_IRQ+0x41/0xc0 [ 1092.342782] common_interrupt+0xf/0xf [ 1092.346955] Fixes: 44a182b9d177 ("xhci: Fix use-after-free in xhci_free_virt_device") Cc: Signed-off-by: Zhengjun Xing Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci-mem.c | 4 ++-- drivers/usb/host/xhci-trace.h | 36 +++++++++++++++++++++++++++++++----- 2 files changed, 33 insertions(+), 7 deletions(-) diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index acbd3d7..8a62eee 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -886,12 +886,12 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) dev = xhci->devs[slot_id]; - trace_xhci_free_virt_device(dev); - xhci->dcbaa->dev_context_ptrs[slot_id] = 0; if (!dev) return; + trace_xhci_free_virt_device(dev); + if (dev->tt_info) old_active_eps = dev->tt_info->active_eps; diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h index 410544f..88b4274 100644 --- a/drivers/usb/host/xhci-trace.h +++ b/drivers/usb/host/xhci-trace.h @@ -171,6 +171,37 @@ DEFINE_EVENT(xhci_log_trb, xhci_dbc_gadget_ep_queue, TP_ARGS(ring, trb) ); +DECLARE_EVENT_CLASS(xhci_log_free_virt_dev, + TP_PROTO(struct xhci_virt_device *vdev), + TP_ARGS(vdev), + TP_STRUCT__entry( + __field(void *, vdev) + __field(unsigned long long, out_ctx) + __field(unsigned long long, in_ctx) + __field(u8, fake_port) + __field(u8, real_port) + __field(u16, current_mel) + + ), + TP_fast_assign( + __entry->vdev = vdev; + __entry->in_ctx = (unsigned long long) vdev->in_ctx->dma; + __entry->out_ctx = (unsigned long long) vdev->out_ctx->dma; + __entry->fake_port = (u8) vdev->fake_port; + __entry->real_port = (u8) vdev->real_port; + __entry->current_mel = (u16) vdev->current_mel; + ), + TP_printk("vdev %p ctx %llx | %llx fake_port %d real_port %d current_mel %d", + __entry->vdev, __entry->in_ctx, __entry->out_ctx, + __entry->fake_port, __entry->real_port, __entry->current_mel + ) +); + +DEFINE_EVENT(xhci_log_free_virt_dev, xhci_free_virt_device, + TP_PROTO(struct xhci_virt_device *vdev), + TP_ARGS(vdev) +); + DECLARE_EVENT_CLASS(xhci_log_virt_dev, TP_PROTO(struct xhci_virt_device *vdev), TP_ARGS(vdev), @@ -208,11 +239,6 @@ DEFINE_EVENT(xhci_log_virt_dev, xhci_alloc_virt_device, TP_ARGS(vdev) ); -DEFINE_EVENT(xhci_log_virt_dev, xhci_free_virt_device, - TP_PROTO(struct xhci_virt_device *vdev), - TP_ARGS(vdev) -); - DEFINE_EVENT(xhci_log_virt_dev, xhci_setup_device, TP_PROTO(struct xhci_virt_device *vdev), TP_ARGS(vdev) -- 2.7.4 From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [2/5] xhci: Fix kernel oops in trace_xhci_free_virt_device From: Mathias Nyman Message-Id: <1529587185-2776-3-git-send-email-mathias.nyman@linux.intel.com> Date: Thu, 21 Jun 2018 16:19:42 +0300 To: gregkh@linuxfoundation.org Cc: linux-usb@vger.kernel.org, Zhengjun Xing , stable@vger.kernel.org, Mathias Nyman List-ID: RnJvbTogWmhlbmdqdW4gWGluZyA8emhlbmdqdW4ueGluZ0BsaW51eC5pbnRlbC5jb20+Cgpjb21t aXQgNDRhMTgyYjlkMTc3ICgieGhjaTogRml4IHVzZS1hZnRlci1mcmVlIGluIHhoY2lfZnJlZV92 aXJ0X2RldmljZSIpCnNldCBkZXYtPnVkZXYgcG9pbnRlciB0byBOVUxMIGluIHhoY2lfZnJlZV9k ZXYoKSwgaXQgd2lsbCBjYXVzZSBrZXJuZWwKcGFuaWMgaW4gdHJhY2VfeGhjaV9mcmVlX3ZpcnRf ZGV2aWNlLiBUaGlzIHBhdGNoIHJlaW1wbGVtZW50IHRoZSB0cmFjZQpmdW5jdGlvbiB0cmFjZV94 aGNpX2ZyZWVfdmlydF9kZXZpY2UsIHJlbW92ZSBkZXYtPnVkZXYgZGVyZWZlcmVuY2UgYW5kCmFk ZGVkIG1vcmUgdXNlZnVsIHBhcmFtZXRlcnMgdG8gc2hvdyBpbiB0aGUgdHJhY2UgZnVuY3Rpb24s aXQgYWxzbyBtYWtlcwpzdXJlIGRldi0+dWRldiBpcyBub3QgTlVMTCBiZWZvcmUgY2FsbGluZyB0 cmFjZV94aGNpX2ZyZWVfdmlydF9kZXZpY2UuClRoaXMgaXNzdWUgaGFwcGVuZWQgd2hlbiB4aGNp LWhjZCB0cmFjZSBpcyBlbmFibGVkIGFuZCBVU0IgZGV2aWNlcyBob3QKcGx1ZyB0ZXN0LiBPcmln aW5hbCB1c2UtYWZ0ZXItZnJlZSBwYXRjaCB3ZW50IHRvIHN0YWJsZSBzbyB0aGlzIG5lZWRzIHNv CmJlIGFwcGxpZWQgdGhlcmUgYXMgd2VsbC4KClsgMTA5Mi4wMjI0NTddIHVzYiAyLTQ6IFVTQiBk aXNjb25uZWN0LCBkZXZpY2UgbnVtYmVyIDYKWyAxMDkyLjA5Mjc3Ml0gQlVHOiB1bmFibGUgdG8g aGFuZGxlIGtlcm5lbCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2UgYXQgMDAwMDAwMDAwMDAwMDAw MApbIDEwOTIuMTAxNjk0XSBQR0QgMCBQNEQgMApbIDEwOTIuMTA0NjAxXSBPb3BzOiAwMDAwIFsj MV0gU01QClsgMTA5Mi4yMDc3MzRdIFdvcmtxdWV1ZTogdXNiX2h1Yl93cSBodWJfZXZlbnQKWyAx MDkyLjIxMjUwN10gUklQOiAwMDEwOnRyYWNlX2V2ZW50X3Jhd19ldmVudF94aGNpX2xvZ192aXJ0 X2RldisweDZjLzB4ZjAKWyAxMDkyLjIyMDA1MF0gUlNQOiAwMDE4OmZmZmY4YzI1MmU4ODNkMjgg RUZMQUdTOiAwMDAxMDA4NgpbIDEwOTIuMjI2MDI0XSBSQVg6IGZmZmY4YzI0YWY4NmZhODQgUkJY OiAwMDAwMDAwMDAwMDAwMDAzIFJDWDogZmZmZjhjMjUyNTVjMmEwMQpbIDEwOTIuMjM0MTMwXSBS RFg6IDAwMDAwMDAwMDAwMDAwMDAgUlNJOiAwMDAwMDAwMGFlZjU1MDA5IFJESTogZmZmZjhjMjUy ZTg4M2QyOApbIDEwOTIuMjQyMjQyXSBSQlA6IGZmZmY4YzI1MjU1MGUyYzAgUjA4OiBmZmZmOGMy NGFmODZmYTg0IFIwOTogMDAwMDAwMDAwMDAwMGE3MApbIDEwOTIuMjUwMzY0XSBSMTA6IDAwMDAw MDAwMDAwMDBhNzAgUjExOiAwMDAwMDAwMDAwMDAwMDAwIFIxMjogZmZmZjhjMjUxZjIxYTAwMApb IDEwOTIuMjU4NDY4XSBSMTM6IDAwMDAwMDAwMDAwMDAwMGMgUjE0OiBmZmZmOGMyNTFmMjFhMDAw IFIxNTogZmZmZjhjMjUxZjQzMmY2MApbIDEwOTIuMjY2NTcyXSBGUzogIDAwMDAwMDAwMDAwMDAw MDAoMDAwMCkgR1M6ZmZmZjhjMjUyZTg4MDAwMCgwMDAwKSBrbmxHUzowMDAwMDAwMDAwMDAwMDAw ClsgMTA5Mi4yNzU3NTddIENTOiAgMDAxMCBEUzogMDAwMCBFUzogMDAwMCBDUjA6IDAwMDAwMDAw ODAwNTAwMzMKWyAxMDkyLjI4MjI4MV0gQ1IyOiAwMDAwMDAwMDAwMDAwMDAwIENSMzogMDAwMDAw MDE1NDIwOTAwMSBDUjQ6IDAwMDAwMDAwMDAzNjA2ZTAKWyAxMDkyLjI5MDM4NF0gQ2FsbCBUcmFj ZToKWyAxMDkyLjI5MzE1Nl0gIDxJUlE+ClsgMTA5Mi4yOTU0MzldICB4aGNpX2ZyZWVfdmlydF9k ZXZpY2UucGFydC4zNCsweDE4Mi8weDFhMApbIDEwOTIuMzAxMjg4XSAgaGFuZGxlX2NtZF9jb21w bGV0aW9uKzB4N2FjLzB4ZmEwClsgMTA5Mi4zMDYzMzZdICA/IHRyYWNlX2V2ZW50X3Jhd19ldmVu dF94aGNpX2xvZ190cmIrMHg2ZS8weGEwClsgMTA5Mi4zMTI2NjFdICB4aGNpX2lycSsweDNlOC8w eDFmNjAKWyAxMDkyLjMxNjUyNF0gIF9faGFuZGxlX2lycV9ldmVudF9wZXJjcHUrMHg3NS8weDE4 MApbIDEwOTIuMzIxODc2XSAgaGFuZGxlX2lycV9ldmVudF9wZXJjcHUrMHgyMC8weDUwClsgMTA5 Mi4zMjY5MjJdICBoYW5kbGVfaXJxX2V2ZW50KzB4MzYvMHg2MApbIDEwOTIuMzMxMjczXSAgaGFu ZGxlX2VkZ2VfaXJxKzB4NmQvMHgxODAKWyAxMDkyLjMzNTY0NF0gIGhhbmRsZV9pcnErMHgxNi8w eDIwClsgMTA5Mi4zMzk0MTddICBkb19JUlErMHg0MS8weGMwClsgMTA5Mi4zNDI3ODJdICBjb21t b25faW50ZXJydXB0KzB4Zi8weGYKWyAxMDkyLjM0Njk1NV0gIDwvSVJRPgoKRml4ZXM6IDQ0YTE4 MmI5ZDE3NyAoInhoY2k6IEZpeCB1c2UtYWZ0ZXItZnJlZSBpbiB4aGNpX2ZyZWVfdmlydF9kZXZp Y2UiKQpDYzogPHN0YWJsZUB2Z2VyLmtlcm5lbC5vcmc+ClNpZ25lZC1vZmYtYnk6IFpoZW5nanVu IFhpbmcgPHpoZW5nanVuLnhpbmdAbGludXguaW50ZWwuY29tPgpTaWduZWQtb2ZmLWJ5OiBNYXRo aWFzIE55bWFuIDxtYXRoaWFzLm55bWFuQGxpbnV4LmludGVsLmNvbT4KLS0tCiBkcml2ZXJzL3Vz Yi9ob3N0L3hoY2ktbWVtLmMgICB8ICA0ICsrLS0KIGRyaXZlcnMvdXNiL2hvc3QveGhjaS10cmFj ZS5oIHwgMzYgKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKy0tLS0tCiAyIGZpbGVzIGNo YW5nZWQsIDMzIGluc2VydGlvbnMoKyksIDcgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvZHJp dmVycy91c2IvaG9zdC94aGNpLW1lbS5jIGIvZHJpdmVycy91c2IvaG9zdC94aGNpLW1lbS5jCmlu ZGV4IGFjYmQzZDcuLjhhNjJlZWUgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvdXNiL2hvc3QveGhjaS1t ZW0uYworKysgYi9kcml2ZXJzL3VzYi9ob3N0L3hoY2ktbWVtLmMKQEAgLTg4NiwxMiArODg2LDEy IEBAIHZvaWQgeGhjaV9mcmVlX3ZpcnRfZGV2aWNlKHN0cnVjdCB4aGNpX2hjZCAqeGhjaSwgaW50 IHNsb3RfaWQpCiAKIAlkZXYgPSB4aGNpLT5kZXZzW3Nsb3RfaWRdOwogCi0JdHJhY2VfeGhjaV9m cmVlX3ZpcnRfZGV2aWNlKGRldik7Ci0KIAl4aGNpLT5kY2JhYS0+ZGV2X2NvbnRleHRfcHRyc1tz bG90X2lkXSA9IDA7CiAJaWYgKCFkZXYpCiAJCXJldHVybjsKIAorCXRyYWNlX3hoY2lfZnJlZV92 aXJ0X2RldmljZShkZXYpOworCiAJaWYgKGRldi0+dHRfaW5mbykKIAkJb2xkX2FjdGl2ZV9lcHMg PSBkZXYtPnR0X2luZm8tPmFjdGl2ZV9lcHM7CiAKZGlmZiAtLWdpdCBhL2RyaXZlcnMvdXNiL2hv c3QveGhjaS10cmFjZS5oIGIvZHJpdmVycy91c2IvaG9zdC94aGNpLXRyYWNlLmgKaW5kZXggNDEw NTQ0Zi4uODhiNDI3NCAxMDA2NDQKLS0tIGEvZHJpdmVycy91c2IvaG9zdC94aGNpLXRyYWNlLmgK KysrIGIvZHJpdmVycy91c2IvaG9zdC94aGNpLXRyYWNlLmgKQEAgLTE3MSw2ICsxNzEsMzcgQEAg REVGSU5FX0VWRU5UKHhoY2lfbG9nX3RyYiwgeGhjaV9kYmNfZ2FkZ2V0X2VwX3F1ZXVlLAogCVRQ X0FSR1MocmluZywgdHJiKQogKTsKIAorREVDTEFSRV9FVkVOVF9DTEFTUyh4aGNpX2xvZ19mcmVl X3ZpcnRfZGV2LAorCVRQX1BST1RPKHN0cnVjdCB4aGNpX3ZpcnRfZGV2aWNlICp2ZGV2KSwKKwlU UF9BUkdTKHZkZXYpLAorCVRQX1NUUlVDVF9fZW50cnkoCisJCV9fZmllbGQodm9pZCAqLCB2ZGV2 KQorCQlfX2ZpZWxkKHVuc2lnbmVkIGxvbmcgbG9uZywgb3V0X2N0eCkKKwkJX19maWVsZCh1bnNp Z25lZCBsb25nIGxvbmcsIGluX2N0eCkKKwkJX19maWVsZCh1OCwgZmFrZV9wb3J0KQorCQlfX2Zp ZWxkKHU4LCByZWFsX3BvcnQpCisJCV9fZmllbGQodTE2LCBjdXJyZW50X21lbCkKKworCSksCisJ VFBfZmFzdF9hc3NpZ24oCisJCV9fZW50cnktPnZkZXYgPSB2ZGV2OworCQlfX2VudHJ5LT5pbl9j dHggPSAodW5zaWduZWQgbG9uZyBsb25nKSB2ZGV2LT5pbl9jdHgtPmRtYTsKKwkJX19lbnRyeS0+ b3V0X2N0eCA9ICh1bnNpZ25lZCBsb25nIGxvbmcpIHZkZXYtPm91dF9jdHgtPmRtYTsKKwkJX19l bnRyeS0+ZmFrZV9wb3J0ID0gKHU4KSB2ZGV2LT5mYWtlX3BvcnQ7CisJCV9fZW50cnktPnJlYWxf cG9ydCA9ICh1OCkgdmRldi0+cmVhbF9wb3J0OworCQlfX2VudHJ5LT5jdXJyZW50X21lbCA9ICh1 MTYpIHZkZXYtPmN1cnJlbnRfbWVsOworCQkpLAorCVRQX3ByaW50aygidmRldiAlcCBjdHggJWxs eCB8ICVsbHggZmFrZV9wb3J0ICVkIHJlYWxfcG9ydCAlZCBjdXJyZW50X21lbCAlZCIsCisJCV9f ZW50cnktPnZkZXYsIF9fZW50cnktPmluX2N0eCwgX19lbnRyeS0+b3V0X2N0eCwKKwkJX19lbnRy eS0+ZmFrZV9wb3J0LCBfX2VudHJ5LT5yZWFsX3BvcnQsIF9fZW50cnktPmN1cnJlbnRfbWVsCisJ KQorKTsKKworREVGSU5FX0VWRU5UKHhoY2lfbG9nX2ZyZWVfdmlydF9kZXYsIHhoY2lfZnJlZV92 aXJ0X2RldmljZSwKKwlUUF9QUk9UTyhzdHJ1Y3QgeGhjaV92aXJ0X2RldmljZSAqdmRldiksCisJ VFBfQVJHUyh2ZGV2KQorKTsKKwogREVDTEFSRV9FVkVOVF9DTEFTUyh4aGNpX2xvZ192aXJ0X2Rl diwKIAlUUF9QUk9UTyhzdHJ1Y3QgeGhjaV92aXJ0X2RldmljZSAqdmRldiksCiAJVFBfQVJHUyh2 ZGV2KSwKQEAgLTIwOCwxMSArMjM5LDYgQEAgREVGSU5FX0VWRU5UKHhoY2lfbG9nX3ZpcnRfZGV2 LCB4aGNpX2FsbG9jX3ZpcnRfZGV2aWNlLAogCVRQX0FSR1ModmRldikKICk7CiAKLURFRklORV9F VkVOVCh4aGNpX2xvZ192aXJ0X2RldiwgeGhjaV9mcmVlX3ZpcnRfZGV2aWNlLAotCVRQX1BST1RP KHN0cnVjdCB4aGNpX3ZpcnRfZGV2aWNlICp2ZGV2KSwKLQlUUF9BUkdTKHZkZXYpCi0pOwotCiBE RUZJTkVfRVZFTlQoeGhjaV9sb2dfdmlydF9kZXYsIHhoY2lfc2V0dXBfZGV2aWNlLAogCVRQX1BS T1RPKHN0cnVjdCB4aGNpX3ZpcnRfZGV2aWNlICp2ZGV2KSwKIAlUUF9BUkdTKHZkZXYpCg==