LKML Archive on lore.kernel.org
 help / Atom feed
* [PATCH] usb: core: safely deal with the dynamic quirk lists
@ 2018-09-14  8:58 Harry Pan
  2018-09-17  7:05 ` Kai-Heng Feng
  0 siblings, 1 reply; 2+ messages in thread
From: Harry Pan @ 2018-09-14  8:58 UTC (permalink / raw)
  To: LKML
  Cc: gs0622, jongpil19.jung, rajatja, Harry Pan, gregkh,
	kai.heng.feng, stern, felipe.balbi, snecknico, jackstocker.93,
	oneukum, linux-usb

Applying dynamic usbcore quirks in early booting when the slab is
not yet ready would cause kernel panic of null pointer dereference
because the quirk_count has been counted as 1 while the quirk_list
was failed to allocate.

i.e.,
[    1.044970] BUG: unable to handle kernel NULL pointer dereference at           (null)
[    1.044995] IP: [<ffffffffb0953ec7>] usb_detect_quirks+0x88/0xd1
[    1.045016] PGD 0
[    1.045026] Oops: 0000 [#1] PREEMPT SMP
[    1.046986] gsmi: Log Shutdown Reason 0x03
[    1.046995] Modules linked in:
[    1.047008] CPU: 0 PID: 81 Comm: kworker/0:3 Not tainted 4.4.154 #28
[    1.047016] Hardware name: Google Coral/Coral, BIOS Google_Coral.10068.27.0 12/04/2017
[    1.047028] Workqueue: usb_hub_wq hub_event
[    1.047037] task: ffff88017a321c80 task.stack: ffff88017a384000
[    1.047044] RIP: 0010:[<ffffffffb0953ec7>]  [<ffffffffb0953ec7>] usb_detect_quirks+0x88/0xd1

To tackle this odd, let's balance the quirk_count to 0 when the kcalloc
call fails, and defer the quirk setting into a lower level callback
which ensures that the kernel memory management has been initialized.

Fixes: 027bd6cafd9a ("usb: core: Add "quirks" parameter for usbcore")

Signed-off-by: Harry Pan <harry.pan@intel.com>
---
 drivers/usb/core/quirks.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 097057d2eacf..1fe9843fb9c8 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -58,6 +58,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
 	quirk_list = kcalloc(quirk_count, sizeof(struct quirk_entry),
 			     GFP_KERNEL);
 	if (!quirk_list) {
+		quirk_count = 0;
 		mutex_unlock(&quirk_mutex);
 		return -ENOMEM;
 	}
@@ -154,7 +155,7 @@ static struct kparam_string quirks_param_string = {
 	.string = quirks_param,
 };
 
-module_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
+device_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
 MODULE_PARM_DESC(quirks, "Add/modify USB quirks by specifying quirks=vendorID:productID:quirks");
 
 /* Lists of quirky USB devices, split in device quirks and interface quirks.
-- 
2.16.4


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] usb: core: safely deal with the dynamic quirk lists
  2018-09-14  8:58 [PATCH] usb: core: safely deal with the dynamic quirk lists Harry Pan
@ 2018-09-17  7:05 ` Kai-Heng Feng
  0 siblings, 0 replies; 2+ messages in thread
From: Kai-Heng Feng @ 2018-09-17  7:05 UTC (permalink / raw)
  To: Harry Pan
  Cc: LKML, gs0622, jongpil19.jung, rajatja, Greg KH, Alan Stern,
	Felipe Balbi, snecknico, jackstocker.93, oneukum, linux-usb

at 16:58, Harry Pan <harry.pan@intel.com> wrote:

> Applying dynamic usbcore quirks in early booting when the slab is
> not yet ready would cause kernel panic of null pointer dereference
> because the quirk_count has been counted as 1 while the quirk_list
> was failed to allocate.
>
> i.e.,
> [    1.044970] BUG: unable to handle kernel NULL pointer dereference  
> at           (null)
> [    1.044995] IP: [<ffffffffb0953ec7>] usb_detect_quirks+0x88/0xd1
> [    1.045016] PGD 0
> [    1.045026] Oops: 0000 [#1] PREEMPT SMP
> [    1.046986] gsmi: Log Shutdown Reason 0x03
> [    1.046995] Modules linked in:
> [    1.047008] CPU: 0 PID: 81 Comm: kworker/0:3 Not tainted 4.4.154 #28
> [    1.047016] Hardware name: Google Coral/Coral, BIOS  
> Google_Coral.10068.27.0 12/04/2017
> [    1.047028] Workqueue: usb_hub_wq hub_event
> [    1.047037] task: ffff88017a321c80 task.stack: ffff88017a384000
> [    1.047044] RIP: 0010:[<ffffffffb0953ec7>]  [<ffffffffb0953ec7>]  
> usb_detect_quirks+0x88/0xd1
>
> To tackle this odd, let's balance the quirk_count to 0 when the kcalloc
> call fails, and defer the quirk setting into a lower level callback
> which ensures that the kernel memory management has been initialized.
>
> Fixes: 027bd6cafd9a ("usb: core: Add "quirks" parameter for usbcore")
>
> Signed-off-by: Harry Pan <harry.pan@intel.com>

Thanks for the catch!

This issue doesn't appear when usbcore is built as module.

Acked-by: Kai-Heng Feng <kai.heng.feng@canonical.com>

> ---
>  drivers/usb/core/quirks.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
> index 097057d2eacf..1fe9843fb9c8 100644
> --- a/drivers/usb/core/quirks.c
> +++ b/drivers/usb/core/quirks.c
> @@ -58,6 +58,7 @@ static int quirks_param_set(const char *val, const  
> struct kernel_param *kp)
>  	quirk_list = kcalloc(quirk_count, sizeof(struct quirk_entry),
>  			     GFP_KERNEL);
>  	if (!quirk_list) {
> +		quirk_count = 0;
>  		mutex_unlock(&quirk_mutex);
>  		return -ENOMEM;
>  	}
> @@ -154,7 +155,7 @@ static struct kparam_string quirks_param_string = {
>  	.string = quirks_param,
>  };
>
> -module_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
> +device_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
>  MODULE_PARM_DESC(quirks, "Add/modify USB quirks by specifying quirks=vendorID:productID:quirks");
>
>  /* Lists of quirky USB devices, split in device quirks and interface quirks.
> -- 
> 2.16.4



^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-14  8:58 [PATCH] usb: core: safely deal with the dynamic quirk lists Harry Pan
2018-09-17  7:05 ` Kai-Heng Feng

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org linux-kernel@archiver.kernel.org
	public-inbox-index lkml


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox