From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38A74C43381 for ; Wed, 20 Mar 2019 05:32:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0A3C72064A for ; Wed, 20 Mar 2019 05:32:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726802AbfCTFck (ORCPT ); Wed, 20 Mar 2019 01:32:40 -0400 Received: from mga01.intel.com ([192.55.52.88]:58052 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725942AbfCTFck (ORCPT ); Wed, 20 Mar 2019 01:32:40 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Mar 2019 22:32:39 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.60,247,1549958400"; d="scan'208";a="308697115" Received: from fei-dev-host.jf.intel.com ([10.7.198.158]) by orsmga005.jf.intel.com with ESMTP; 19 Mar 2019 22:32:38 -0700 From: fei.yang@intel.com To: balbi@kernel.org, gregkh@linuxfoundation.org, zhangjerry@google.com, andrzej.p@collabora.com, plr.vincent@gmail.com, fei.yang@intel.com, jingx.shen@intel.com, john.stultz@linaro.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH V2] usb: gadget: f_fs: don't free buffer prematurely Date: Tue, 19 Mar 2019 22:32:20 -0700 Message-Id: <1553059940-127038-1-git-send-email-fei.yang@intel.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Fei Yang The following kernel panic happens due to the io_data buffer gets deallocated before the async io is completed. Add a check for the case where io_data buffer should be deallocated by ffs_user_copy_worker. [ 41.663334] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 41.672099] #PF error: [normal kernel read fault] [ 41.677356] PGD 20c974067 P4D 20c974067 PUD 20c973067 PMD 0 [ 41.683687] Oops: 0000 [#1] PREEMPT SMP [ 41.687976] CPU: 1 PID: 7 Comm: kworker/u8:0 Tainted: G U 5.0.0-quilt-2e5dc0ac-00790-gd8c79f2-dirty #2 [ 41.705309] Workqueue: adb ffs_user_copy_worker [ 41.705316] RIP: 0010:__vunmap+0x2a/0xc0 [ 41.705318] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 [ 41.705320] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 [ 41.705322] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 [ 41.705323] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff [ 41.705324] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 [ 41.705325] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 [ 41.705326] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff [ 41.705328] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 [ 41.705329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.705330] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 [ 41.705331] Call Trace: [ 41.705338] vfree+0x50/0xb0 [ 41.705341] ffs_user_copy_worker+0xe9/0x1c0 [ 41.705344] process_one_work+0x19f/0x3e0 [ 41.705348] worker_thread+0x3f/0x3b0 [ 41.829766] kthread+0x12b/0x150 [ 41.833371] ? process_one_work+0x3e0/0x3e0 [ 41.838045] ? kthread_create_worker_on_cpu+0x70/0x70 [ 41.843695] ret_from_fork+0x3a/0x50 [ 41.847689] Modules linked in: hci_uart bluetooth ecdh_generic rfkill_gpio dwc3_pci dwc3 snd_usb_audio mei_me tpm_crb snd_usbmidi_lib xhci_pci xhci_hcd mei tpm snd_hwdep cfg80211 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core snd_hda_core videobuf2_dma_sg crlmodule [ 41.876880] CR2: 0000000000000048 [ 41.880584] ---[ end trace 2bc4addff0f2e673 ]--- [ 41.891346] RIP: 0010:__vunmap+0x2a/0xc0 [ 41.895734] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 [ 41.916740] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 [ 41.922583] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 [ 41.930563] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff [ 41.938540] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 [ 41.946520] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 [ 41.954502] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff [ 41.962482] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 [ 41.971536] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.977960] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 [ 41.985930] Kernel panic - not syncing: Fatal exception [ 41.991817] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 42.009525] Rebooting in 10 seconds.. [ 52.014376] ACPI MEMORY or I/O RESET_REG. Fixes: 772a7a724f6 ("usb: gadget: f_fs: Allow scatter-gather buffers") Signed-off-by: Fei Yang Reviewed-by: Manu Gautam Tested-by: John Stultz --- V2: add tag: "Fixes: 772a7a724f6 ......", Reviewed-by and Tested-by. drivers/usb/gadget/function/f_fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 20413c2..47be961 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1133,7 +1133,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) error_mutex: mutex_unlock(&epfile->mutex); error: - ffs_free_buffer(io_data); + if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */ + ffs_free_buffer(io_data); return ret; } -- 2.7.4 From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [V2] usb: gadget: f_fs: don't free buffer prematurely From: fei.yang@intel.com Message-Id: <1553059940-127038-1-git-send-email-fei.yang@intel.com> Date: Tue, 19 Mar 2019 22:32:20 -0700 To: balbi@kernel.org, gregkh@linuxfoundation.org, zhangjerry@google.com, andrzej.p@collabora.com, plr.vincent@gmail.com, fei.yang@intel.com, jingx.shen@intel.com, john.stultz@linaro.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org List-ID: RnJvbTogRmVpIFlhbmcgPGZlaS55YW5nQGludGVsLmNvbT4KClRoZSBmb2xsb3dpbmcga2VybmVs IHBhbmljIGhhcHBlbnMgZHVlIHRvIHRoZSBpb19kYXRhIGJ1ZmZlciBnZXRzIGRlYWxsb2NhdGVk CmJlZm9yZSB0aGUgYXN5bmMgaW8gaXMgY29tcGxldGVkLiBBZGQgYSBjaGVjayBmb3IgdGhlIGNh c2Ugd2hlcmUgaW9fZGF0YSBidWZmZXIKc2hvdWxkIGJlIGRlYWxsb2NhdGVkIGJ5IGZmc191c2Vy X2NvcHlfd29ya2VyLgoKWyAgIDQxLjY2MzMzNF0gQlVHOiB1bmFibGUgdG8gaGFuZGxlIGtlcm5l bCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2UgYXQgMDAwMDAwMDAwMDAwMDA0OApbICAgNDEuNjcy MDk5XSAjUEYgZXJyb3I6IFtub3JtYWwga2VybmVsIHJlYWQgZmF1bHRdClsgICA0MS42NzczNTZd IFBHRCAyMGM5NzQwNjcgUDREIDIwYzk3NDA2NyBQVUQgMjBjOTczMDY3IFBNRCAwClsgICA0MS42 ODM2ODddIE9vcHM6IDAwMDAgWyMxXSBQUkVFTVBUIFNNUApbICAgNDEuNjg3OTc2XSBDUFU6IDEg UElEOiA3IENvbW06IGt3b3JrZXIvdTg6MCBUYWludGVkOiBHICAgICBVICAgICAgICAgICAgNS4w LjAtcXVpbHQtMmU1ZGMwYWMtMDA3OTAtZ2Q4Yzc5ZjItZGlydHkgIzIKWyAgIDQxLjcwNTMwOV0g V29ya3F1ZXVlOiBhZGIgZmZzX3VzZXJfY29weV93b3JrZXIKWyAgIDQxLjcwNTMxNl0gUklQOiAw MDEwOl9fdnVubWFwKzB4MmEvMHhjMApbICAgNDEuNzA1MzE4XSBDb2RlOiAwZiAxZiA0NCAwMCAw MCA0OCA4NSBmZiAwZiA4NCA4NyAwMCAwMCAwMCA1NSBmNyBjNyBmZiAwZiAwMCAwMCA0OCA4OSBl NSA0MSA1NSA0MSA4OSBmNSA0MSA1NCA1MyA0OCA4OSBmYiA3NSA3MSBlOCA1NiBkNyBmZiBmZiA8 NGM+IDhiIDYwIDQ4IDRkIDg1IGU0IDc0IDc2IDQ4IDg5IGRmIGU4IDI1IGZmIGZmIGZmIDQ1IDg1 IGVkIDc0IDQ2ClsgICA0MS43MDUzMjBdIFJTUDogMDAxODpmZmZmYmMzYTQwMDUzZGYwIEVGTEFH UzogMDAwMTAyODYKWyAgIDQxLjcwNTMyMl0gUkFYOiAwMDAwMDAwMDAwMDAwMDAwIFJCWDogZmZm ZmJjM2E0MDZmMTAwMCBSQ1g6IDAwMDAwMDAwMDAwMDAwMDAKWyAgIDQxLjcwNTMyM10gUkRYOiAw MDAwMDAwMDAwMDAwMDAxIFJTSTogMDAwMDAwMDAwMDAwMDAwMSBSREk6IDAwMDAwMDAwZmZmZmZm ZmYKWyAgIDQxLjcwNTMyNF0gUkJQOiBmZmZmYmMzYTQwMDUzZTA4IFIwODogMDAwMDAwMDAwMDAx ZmI3OSBSMDk6IDAwMDAwMDAwMDAwMDAwMzcKWyAgIDQxLjcwNTMyNV0gUjEwOiBmZmZmYmMzYTQw MDUzYjY4IFIxMTogZmZmZmJjM2E0MDA1M2NhZCBSMTI6IGZmZmZmZmZmZmZmZmZmZjIKWyAgIDQx LjcwNTMyNl0gUjEzOiAwMDAwMDAwMDAwMDAwMDAxIFIxNDogMDAwMDAwMDAwMDAwMDAwMCBSMTU6 IGZmZmZmZmZmZmZmZmZmZmYKWyAgIDQxLjcwNTMyOF0gRlM6ICAwMDAwMDAwMDAwMDAwMDAwKDAw MDApIEdTOmZmZmY5ZTI5NzdhODAwMDAoMDAwMCkga25sR1M6MDAwMDAwMDAwMDAwMDAwMApbICAg NDEuNzA1MzI5XSBDUzogIDAwMTAgRFM6IDAwMDAgRVM6IDAwMDAgQ1IwOiAwMDAwMDAwMDgwMDUw MDMzClsgICA0MS43MDUzMzBdIENSMjogMDAwMDAwMDAwMDAwMDA0OCBDUjM6IDAwMDAwMDAyMGM5 OTQwMDAgQ1I0OiAwMDAwMDAwMDAwMzQwNmUwClsgICA0MS43MDUzMzFdIENhbGwgVHJhY2U6Clsg ICA0MS43MDUzMzhdICB2ZnJlZSsweDUwLzB4YjAKWyAgIDQxLjcwNTM0MV0gIGZmc191c2VyX2Nv cHlfd29ya2VyKzB4ZTkvMHgxYzAKWyAgIDQxLjcwNTM0NF0gIHByb2Nlc3Nfb25lX3dvcmsrMHgx OWYvMHgzZTAKWyAgIDQxLjcwNTM0OF0gIHdvcmtlcl90aHJlYWQrMHgzZi8weDNiMApbICAgNDEu ODI5NzY2XSAga3RocmVhZCsweDEyYi8weDE1MApbICAgNDEuODMzMzcxXSAgPyBwcm9jZXNzX29u ZV93b3JrKzB4M2UwLzB4M2UwClsgICA0MS44MzgwNDVdICA/IGt0aHJlYWRfY3JlYXRlX3dvcmtl cl9vbl9jcHUrMHg3MC8weDcwClsgICA0MS44NDM2OTVdICByZXRfZnJvbV9mb3JrKzB4M2EvMHg1 MApbICAgNDEuODQ3Njg5XSBNb2R1bGVzIGxpbmtlZCBpbjogaGNpX3VhcnQgYmx1ZXRvb3RoIGVj ZGhfZ2VuZXJpYyByZmtpbGxfZ3BpbyBkd2MzX3BjaSBkd2MzIHNuZF91c2JfYXVkaW8gbWVpX21l IHRwbV9jcmIgc25kX3VzYm1pZGlfbGliIHhoY2lfcGNpIHhoY2lfaGNkIG1laSB0cG0gc25kX2h3 ZGVwIGNmZzgwMjExIHNuZF9zb2Nfc2tsIHNuZF9zb2Nfc2tsX2lwYyBzbmRfc29jX3NzdF9pcGMg c25kX3NvY19zc3RfZHNwIHNuZF9oZGFfZXh0X2NvcmUgc25kX2hkYV9jb3JlIHZpZGVvYnVmMl9k bWFfc2cgY3JsbW9kdWxlClsgICA0MS44NzY4ODBdIENSMjogMDAwMDAwMDAwMDAwMDA0OApbICAg NDEuODgwNTg0XSAtLS1bIGVuZCB0cmFjZSAyYmM0YWRkZmYwZjJlNjczIF0tLS0KWyAgIDQxLjg5 MTM0Nl0gUklQOiAwMDEwOl9fdnVubWFwKzB4MmEvMHhjMApbICAgNDEuODk1NzM0XSBDb2RlOiAw ZiAxZiA0NCAwMCAwMCA0OCA4NSBmZiAwZiA4NCA4NyAwMCAwMCAwMCA1NSBmNyBjNyBmZiAwZiAw MCAwMCA0OCA4OSBlNSA0MSA1NSA0MSA4OSBmNSA0MSA1NCA1MyA0OCA4OSBmYiA3NSA3MSBlOCA1 NiBkNyBmZiBmZiA8NGM+IDhiIDYwIDQ4IDRkIDg1IGU0IDc0IDc2IDQ4IDg5IGRmIGU4IDI1IGZm IGZmIGZmIDQ1IDg1IGVkIDc0IDQ2ClsgICA0MS45MTY3NDBdIFJTUDogMDAxODpmZmZmYmMzYTQw MDUzZGYwIEVGTEFHUzogMDAwMTAyODYKWyAgIDQxLjkyMjU4M10gUkFYOiAwMDAwMDAwMDAwMDAw MDAwIFJCWDogZmZmZmJjM2E0MDZmMTAwMCBSQ1g6IDAwMDAwMDAwMDAwMDAwMDAKWyAgIDQxLjkz MDU2M10gUkRYOiAwMDAwMDAwMDAwMDAwMDAxIFJTSTogMDAwMDAwMDAwMDAwMDAwMSBSREk6IDAw MDAwMDAwZmZmZmZmZmYKWyAgIDQxLjkzODU0MF0gUkJQOiBmZmZmYmMzYTQwMDUzZTA4IFIwODog MDAwMDAwMDAwMDAxZmI3OSBSMDk6IDAwMDAwMDAwMDAwMDAwMzcKWyAgIDQxLjk0NjUyMF0gUjEw OiBmZmZmYmMzYTQwMDUzYjY4IFIxMTogZmZmZmJjM2E0MDA1M2NhZCBSMTI6IGZmZmZmZmZmZmZm ZmZmZjIKWyAgIDQxLjk1NDUwMl0gUjEzOiAwMDAwMDAwMDAwMDAwMDAxIFIxNDogMDAwMDAwMDAw MDAwMDAwMCBSMTU6IGZmZmZmZmZmZmZmZmZmZmYKWyAgIDQxLjk2MjQ4Ml0gRlM6ICAwMDAwMDAw MDAwMDAwMDAwKDAwMDApIEdTOmZmZmY5ZTI5NzdhODAwMDAoMDAwMCkga25sR1M6MDAwMDAwMDAw MDAwMDAwMApbICAgNDEuOTcxNTM2XSBDUzogIDAwMTAgRFM6IDAwMDAgRVM6IDAwMDAgQ1IwOiAw MDAwMDAwMDgwMDUwMDMzClsgICA0MS45Nzc5NjBdIENSMjogMDAwMDAwMDAwMDAwMDA0OCBDUjM6 IDAwMDAwMDAyMGM5OTQwMDAgQ1I0OiAwMDAwMDAwMDAwMzQwNmUwClsgICA0MS45ODU5MzBdIEtl cm5lbCBwYW5pYyAtIG5vdCBzeW5jaW5nOiBGYXRhbCBleGNlcHRpb24KWyAgIDQxLjk5MTgxN10g S2VybmVsIE9mZnNldDogMHgxNjAwMDAwMCBmcm9tIDB4ZmZmZmZmZmY4MTAwMDAwMCAocmVsb2Nh dGlvbiByYW5nZTogMHhmZmZmZmZmZjgwMDAwMDAwLTB4ZmZmZmZmZmZiZmZmZmZmZikKWyAgIDQy LjAwOTUyNV0gUmVib290aW5nIGluIDEwIHNlY29uZHMuLgpbICAgNTIuMDE0Mzc2XSBBQ1BJIE1F TU9SWSBvciBJL08gUkVTRVRfUkVHLgoKRml4ZXM6IDc3MmE3YTcyNGY2ICgidXNiOiBnYWRnZXQ6 IGZfZnM6IEFsbG93IHNjYXR0ZXItZ2F0aGVyIGJ1ZmZlcnMiKQpTaWduZWQtb2ZmLWJ5OiBGZWkg WWFuZyA8ZmVpLnlhbmdAaW50ZWwuY29tPgpSZXZpZXdlZC1ieTogTWFudSBHYXV0YW0gPG1nYXV0 YW1AY29kZWF1cm9yYS5vcmc+ClRlc3RlZC1ieTogSm9obiBTdHVsdHogPGpvaG4uc3R1bHR6QGxp bmFyby5vcmc+Ci0tLQpWMjogYWRkIHRhZzogIkZpeGVzOiA3NzJhN2E3MjRmNiAuLi4uLi4iLCBS ZXZpZXdlZC1ieSBhbmQgVGVzdGVkLWJ5LgoKIGRyaXZlcnMvdXNiL2dhZGdldC9mdW5jdGlvbi9m X2ZzLmMgfCAzICsrLQogMSBmaWxlIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlv bigtKQoKZGlmZiAtLWdpdCBhL2RyaXZlcnMvdXNiL2dhZGdldC9mdW5jdGlvbi9mX2ZzLmMgYi9k cml2ZXJzL3VzYi9nYWRnZXQvZnVuY3Rpb24vZl9mcy5jCmluZGV4IDIwNDEzYzIuLjQ3YmU5NjEg MTAwNjQ0Ci0tLSBhL2RyaXZlcnMvdXNiL2dhZGdldC9mdW5jdGlvbi9mX2ZzLmMKKysrIGIvZHJp dmVycy91c2IvZ2FkZ2V0L2Z1bmN0aW9uL2ZfZnMuYwpAQCAtMTEzMyw3ICsxMTMzLDggQEAgc3Rh dGljIHNzaXplX3QgZmZzX2VwZmlsZV9pbyhzdHJ1Y3QgZmlsZSAqZmlsZSwgc3RydWN0IGZmc19p b19kYXRhICppb19kYXRhKQogZXJyb3JfbXV0ZXg6CiAJbXV0ZXhfdW5sb2NrKCZlcGZpbGUtPm11 dGV4KTsKIGVycm9yOgotCWZmc19mcmVlX2J1ZmZlcihpb19kYXRhKTsKKwlpZiAocmV0ICE9IC1F SU9DQlFVRVVFRCkgLyogZG9uJ3QgZnJlZSBpZiB0aGVyZSBpcyBpb2NiIHF1ZXVlZCAqLworCQlm ZnNfZnJlZV9idWZmZXIoaW9fZGF0YSk7CiAJcmV0dXJuIHJldDsKIH0KIAo=