linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Guenter Roeck <groeck@google.com>,
	Guenter Roeck <groeck@chromium.org>,
	Guenter Roeck <linux@roeck-us.net>,
	Fan Ning <fanning4@hisilicon.com>, Li Rui <lirui39@hisilicon.com>,
	yangdi <yangdi10@hisilicon.com>, Yu Chen <chenyu56@huawei.com>,
	Mathias Nyman <mathias.nyman@linux.intel.com>
Subject: [PATCH 4.14 72/75] usb: xhci: fix panic in xhci_free_virt_devices_depth_first
Date: Thu,  7 Dec 2017 14:08:34 +0100	[thread overview]
Message-ID: <20171207130821.724699787@linuxfoundation.org> (raw)
In-Reply-To: <20171207130818.742746317@linuxfoundation.org>

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Chen <chenyu56@huawei.com>

commit 80e457699a8dbdd70f2d26911e46f538645c55fc upstream.

Check vdev->real_port 0 to avoid panic
[    9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108
[    9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570
[    9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8
[    9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0
[    9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8
[    9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70
[    9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108
[    9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40
[    9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120
[    9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210
[    9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0
[    9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488
[    9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8
[    9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490
[    9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0
[    9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100
[    9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50

The problem can occur if xhci_plat_remove() is called shortly after
xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
called before the device has been setup and get real_port initialized.
The problem occurred on Hikey960 and was reproduced by Guenter Roeck
on Kevin with chromeos-4.4.

Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first")
Cc: Guenter Roeck <groeck@google.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Fan Ning <fanning4@hisilicon.com>
Signed-off-by: Li Rui <lirui39@hisilicon.com>
Signed-off-by: yangdi <yangdi10@hisilicon.com>
Signed-off-by: Yu Chen <chenyu56@huawei.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-mem.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -947,6 +947,12 @@ void xhci_free_virt_devices_depth_first(
 	if (!vdev)
 		return;
 
+	if (vdev->real_port == 0 ||
+			vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
+		xhci_dbg(xhci, "Bad vdev->real_port.\n");
+		goto out;
+	}
+
 	tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
 	list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
 		/* is this a hub device that added a tt_info to the tts list */
@@ -960,6 +966,7 @@ void xhci_free_virt_devices_depth_first(
 			}
 		}
 	}
+out:
 	/* we are now at a leaf device */
 	xhci_free_virt_device(xhci, slot_id);
 }

  parent reply	other threads:[~2017-12-07 13:13 UTC|newest]

Thread overview: 85+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-07 13:07 [PATCH 4.14 00/75] 4.14.5-stable review Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 01/75] drm/fsl-dcu: avoid disabling pixel clock twice on suspend Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 02/75] drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 04/75] s390/runtime instrumentation: simplify task exit handling Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 05/75] usbip: fix usbip attach to find a port that matches the requested speed Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 06/75] usbip: Fix USB device hang due to wrong enabling of scatter-gather Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 07/75] uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 08/75] usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 09/75] serial: 8250_pci: Add Amazon PCI serial device ID Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 10/75] ANDROID: binder: fix transaction leak Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 11/75] USB: serial: option: add Quectel BG96 id Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 12/75] USB: serial: usb_debug: add new USB device id Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 13/75] serial: 8250_early: Only set divisor if valid clk & baud Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 14/75] MIPS: Add custom serial.h with BASE_BAUD override for generic kernel Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 15/75] ima: fix hash algorithm initialization Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 16/75] s390: vfio-ccw: Do not attempt to free no-op, test and tic cda Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 17/75] PM / Domains: Fix genpd to deal with drivers returning 1 from ->prepare() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 18/75] s390/pci: do not require AIS facility Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 19/75] selftests/x86/ldt_get: Add a few additional tests for limits Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 20/75] selftests/x86/ldt_gdt: Robustify against set_thread_area() and LAR oddities Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 21/75] staging: greybus: loopback: Fix iteration count on async path Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 22/75] m68k: fix ColdFire node shift size calculation Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 23/75] serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 24/75] staging: rtl8822be: fix wrong dma unmap len Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 25/75] staging: rtl8188eu: avoid a null dereference on pmlmepriv Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 26/75] spi: sh-msiof: Fix DMA transfer size check Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 27/75] spi: spi-axi: fix potential use-after-free after deregistration Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 28/75] mmc: tmio: check mmc_regulator_get_supply return value Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 29/75] mmc: sdhci-msm: fix issue with power irq Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 30/75] hwmon: (pmbus/core) Prevent unintentional setting of page to 0xFF Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 31/75] perf/core: Fix __perf_read_group_add() locking Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 32/75] usb: dwc2: Fix UDC state tracking Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 33/75] usb: dwc2: Error out of dwc2_hsotg_ep_disable() if were in host mode Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 34/75] usb: phy: tahvo: fix error handling in tahvo_usb_probe() Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 35/75] PCI: dra7xx: Create functional dependency between PCIe and PHY Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 36/75] x86/intel_rdt: Initialize bitmask of shareable resource if CDP enabled Greg Kroah-Hartman
2017-12-07 13:07 ` [PATCH 4.14 37/75] x86/intel_rdt: Fix potential deadlock during resctrl mount Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 38/75] serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 39/75] kprobes: Use synchronize_rcu_tasks() for optprobe with CONFIG_PREEMPT=y Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 40/75] x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 41/75] clocksource/drivers/arm_arch_timer: Validate CNTFRQ after enabling frame Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 42/75] dt-bindings: timer: renesas, cmt: Fix SoC-specific compatible values Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 43/75] EDAC, sb_edac: Fix missing break in switch Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 44/75] usb: mtu3: fix error return code in ssusb_gadget_init() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 45/75] staging: fsl-dpaa2/eth: Account for Rx FD buffers on error path Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 46/75] staging: rtl8822be: Keep array subscript no lower than zero Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 47/75] ARM: cpuidle: Correct driver unregistration if init fails Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 48/75] usb: xhci: Return error when host is dead in xhci_disable_slot() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 49/75] sysrq : fix Show Regs call trace on ARM Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 50/75] serial: sh-sci: suppress warning for ports without dma channels Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 51/75] usbip: tools: Install all headers needed for libusbip development Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 53/75] staging: fsl-mc/dpio: Fix incorrect comparison Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 54/75] perf test attr: Fix ignored test case result Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 55/75] perf test attr: Fix python error on empty result Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 56/75] kprobes/x86: Disable preemption in ftrace-based jprobes Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 57/75] locking/refcounts, x86/asm: Use unique .text section for refcount exceptions Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 58/75] s390/ptrace: fix guarded storage regset handling Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 60/75] perf tools: Fix leaking rec_argv in error cases Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 61/75] mm, x86/mm: Fix performance regression in get_user_pages_fast() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 63/75] iio: multiplexer: add NULL check on devm_kzalloc() and devm_kmemdup() return values Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 64/75] locking/refcounts, x86/asm: Enable CONFIG_ARCH_HAS_REFCOUNT Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 65/75] powerpc/jprobes: Disable preemption when triggered through ftrace Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 66/75] powerpc/kprobes: Disable preemption before invoking probe handler for optprobes Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 67/75] dma-buf/sw_sync: force signal all unsignaled fences on dying timeline Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 68/75] staging: ccree: fix leak of import() after init() Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 69/75] usb: hub: Cycle HUB power when initialization fails Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 70/75] USB: ulpi: fix bus-node lookup Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 71/75] xhci: Dont show incorrect WARN message about events for empty rings Greg Kroah-Hartman
2017-12-07 13:08 ` Greg Kroah-Hartman [this message]
2017-12-07 13:08 ` [PATCH 4.14 73/75] USB: core: Add type-specific length check of BOS descriptors Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 74/75] USB: usbfs: Filter flags passed in from user space Greg Kroah-Hartman
2017-12-07 13:08 ` [PATCH 4.14 75/75] usb: host: fix incorrect updating of offset Greg Kroah-Hartman
2017-12-07 20:55 ` [PATCH 4.14 00/75] 4.14.5-stable review Guenter Roeck
2017-12-08 10:37   ` Greg Kroah-Hartman
2017-12-08  0:08 ` Shuah Khan
2017-12-08 10:34   ` Greg Kroah-Hartman
2017-12-08  5:35 ` Naresh Kamboju
2017-12-09  3:34 ` Ivan Kozik
2017-12-09  7:45   ` Greg Kroah-Hartman
2017-12-09  7:56     ` Ivan Kozik
2017-12-09 17:13       ` Greg Kroah-Hartman
2017-12-09 17:32         ` Thomas Backlund
2017-12-10 12:36           ` Greg Kroah-Hartman
2017-12-09 18:39         ` Ivan Kozik
     [not found] ` <5a29b63a.13bbdf0a.b5a04.7588@mx.google.com>
     [not found]   ` <7hk1xxkmw9.fsf@baylibre.com>
2017-12-09 16:59     ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171207130821.724699787@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=chenyu56@huawei.com \
    --cc=fanning4@hisilicon.com \
    --cc=groeck@chromium.org \
    --cc=groeck@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@roeck-us.net \
    --cc=lirui39@hisilicon.com \
    --cc=mathias.nyman@linux.intel.com \
    --cc=stable@vger.kernel.org \
    --cc=yangdi10@hisilicon.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).