From: Greg KH <gregkh@linuxfoundation.org>
To: Hardik Gajjar <hgajjar@de.adit-jv.com>
Cc: quic_kriskura@quicinc.com, maze@google.com,
quic_linyyuan@quicinc.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org, guofeng.li@gm.com,
hardik.gajjar@bosch.com, eugeniu.rosca@bosch.com
Subject: Re: [PATCH] usb: gadget: f_ncm: Fix Kernel Panic due to access of invalid gadget ptr
Date: Thu, 7 Mar 2024 16:45:13 +0000 [thread overview]
Message-ID: <2024030736-racism-cornflake-63e9@gregkh> (raw)
In-Reply-To: <20240307161849.9145-1-hgajjar@de.adit-jv.com>
On Thu, Mar 07, 2024 at 05:18:49PM +0100, Hardik Gajjar wrote:
> In the scenario where the system enters suspend to RAM mode (STR) triggers
> the disconnection of Dual Role USB Hub, and the UDC platform driver calls
> usb_del_gadget_udc() to cleanup and delete the associated gadget.
>
> However, at this point, the usb0 interface is not yet deleted, leading to
> a race condition with the TCP/IP stack attempting to access the network
> device parent (gadget pointer), through operations like the GETLINK net
> message.
>
> This patch addresses the issue by clearing the netdevice's parent device
> pointer when the ncm unbinds, effectively preventing the race condition
> during this critical phase.
>
> Followinfg is the backtrace of such race condition
> [ 3566.105792] Call trace:
> [ 3566.105984] if_nlmsg_size+0x48/0x3b0
> [ 3566.107497] rtnetlink_rcv_msg+0x1cc/0x408
> [ 3566.107905] netlink_rcv_skb+0x12c/0x164
> [ 3566.108264] rtnetlink_rcv+0x18/0x24
> [ 3566.108851] netlink_unicast_kernel+0xc4/0x14c
> [ 3566.109192] netlink_unicast+0x210/0x2b0
> [ 3566.109606] netlink_sendmsg+0x2ec/0x360
> [ 3566.110046] __sys_sendto+0x1b8/0x25c
> [ 3566.111594] __arm64_sys_sendto+0x28/0x38
> [ 3566.112599] el0_svc_common+0xb4/0x19c
> [ 3566.112978] el0_svc_handler+0x74/0x98
> [ 3566.113269] el0_svc+0x8/0xc
>
> - code: if_nlmsg_size call the following function
>
> static inline int rtnl_vfinfo_size(const struct net_device *dev,
> u32 ext_filter_mask)
> {
> // dev->dev.parent is not NULL
> if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF)) {
> // dev_num_vf use the dev->dev.parent->bus lead to kernel panic.
> int num_vfs = dev_num_vf(dev->dev.parent);
> size_t size = nla_total_size(0);
> size += num_vfs *
> (nla_total_size(0) +
> nla_total_size(sizeof(struct ifla_vf_mac)) +
> nla_total_size(sizeof(struct ifla_vf_vlan)) +
> nla_total_size(0) + /* nest IFLA_VF_VLAN_LIST *
>
> Signed-off-by: Hardik Gajjar <hgajjar@de.adit-jv.com>
> ---
> drivers/usb/gadget/function/f_ncm.c | 7 +++++++
> 1 file changed, 7 insertions(+)
What commit id does this fix?
thanks,
greg k-h
next prev parent reply other threads:[~2024-03-07 16:45 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-07 16:18 [PATCH] usb: gadget: f_ncm: Fix Kernel Panic due to access of invalid gadget ptr Hardik Gajjar
2024-03-07 16:45 ` Greg KH [this message]
2024-03-07 17:33 ` Hardik Gajjar
2024-03-07 17:42 ` Krishna Kurapati PSSNV
2024-03-08 11:55 ` Hardik Gajjar
2024-03-08 12:17 ` Krishna Kurapati PSSNV
2024-03-11 12:04 ` Hardik Gajjar
2024-04-19 13:35 ` Hardik Gajjar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2024030736-racism-cornflake-63e9@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=eugeniu.rosca@bosch.com \
--cc=guofeng.li@gm.com \
--cc=hardik.gajjar@bosch.com \
--cc=hgajjar@de.adit-jv.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=maze@google.com \
--cc=quic_kriskura@quicinc.com \
--cc=quic_linyyuan@quicinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).