* [PATCH] xhci: solve a double free problem while doing s4 [not found] <1623244292-108534-1-git-send-email-xuetao09@huawei.com> @ 2021-06-09 14:22 ` Zhangjiantao (Kirin, nanjing) 2021-06-10 13:45 ` Mathias Nyman 0 siblings, 1 reply; 5+ messages in thread From: Zhangjiantao (Kirin, nanjing) @ 2021-06-09 14:22 UTC (permalink / raw) To: Xuetao (kirin), mathias.nyman, gregkh, linux-usb, linux-kernel Cc: chenyu (U), Caiyadong, xuhaiyang when system is doing s4, the process of xhci_resume may be as below: 1、xhci_mem_cleanup 2、xhci_init->xhci_mem_init->xhci_mem_cleanup(when memory is not enough). xhci_mem_cleanup will be executed twice when system is out of memory. xhci->port_caps is freed in xhci_mem_cleanup,but it isn't set to NULL. It will be freed twice when xhci_mem_cleanup is called the second time. We got following bug when system resumes from s4: kernel BUG at mm/slub.c:309! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP CPU: 0 PID: 5929 Tainted: G S W 5.4.96-arm64-desktop #1 pc : __slab_free+0x5c/0x424 lr : kfree+0x30c/0x32c Call trace: __slab_free+0x5c/0x424 kfree+0x30c/0x32c xhci_mem_cleanup+0x394/0x3cc xhci_mem_init+0x9ac/0x1070 xhci_init+0x8c/0x1d0 xhci_resume+0x1cc/0x5fc xhci_plat_resume+0x64/0x70 platform_pm_thaw+0x28/0x60 dpm_run_callback+0x54/0x24c device_resume+0xd0/0x200 async_resume+0x24/0x60 async_run_entry_fn+0x44/0x110 process_one_work+0x1f0/0x490 worker_thread+0x5c/0x450 kthread+0x158/0x160 ret_from_fork+0x10/0x24 Signed-off-by: Tao Xue <xuetao09@huawei.com> --- drivers/usb/host/xhci-mem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index f66815f..e4b0c04 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -1924,6 +1924,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) xhci->hw_ports = NULL; xhci->rh_bw = NULL; xhci->ext_caps = NULL; + xhci->port_caps = NULL; xhci->page_size = 0; xhci->page_shift = 0; -- 2.7.4 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xhci: solve a double free problem while doing s4 2021-06-09 14:22 ` [PATCH] xhci: solve a double free problem while doing s4 Zhangjiantao (Kirin, nanjing) @ 2021-06-10 13:45 ` Mathias Nyman 2021-06-10 14:01 ` gregkh 0 siblings, 1 reply; 5+ messages in thread From: Mathias Nyman @ 2021-06-10 13:45 UTC (permalink / raw) To: Zhangjiantao (Kirin, nanjing), Xuetao (kirin), mathias.nyman, gregkh, linux-usb, linux-kernel Cc: chenyu (U), Caiyadong, xuhaiyang On 9.6.2021 17.22, Zhangjiantao (Kirin, nanjing) wrote: > when system is doing s4, the process of xhci_resume may be as below: > 1、xhci_mem_cleanup > 2、xhci_init->xhci_mem_init->xhci_mem_cleanup(when memory is not enough). > xhci_mem_cleanup will be executed twice when system is out of memory. > xhci->port_caps is freed in xhci_mem_cleanup,but it isn't set to NULL. > It will be freed twice when xhci_mem_cleanup is called the second time. > Thanks, nice catch > We got following bug when system resumes from s4: > > kernel BUG at mm/slub.c:309! > Internal error: Oops - BUG: 0 [#1] PREEMPT SMP > CPU: 0 PID: 5929 Tainted: G S W 5.4.96-arm64-desktop #1 > pc : __slab_free+0x5c/0x424 > lr : kfree+0x30c/0x32c > > Call trace: > __slab_free+0x5c/0x424 > kfree+0x30c/0x32c > xhci_mem_cleanup+0x394/0x3cc > xhci_mem_init+0x9ac/0x1070 > xhci_init+0x8c/0x1d0 > xhci_resume+0x1cc/0x5fc > xhci_plat_resume+0x64/0x70 > platform_pm_thaw+0x28/0x60 > dpm_run_callback+0x54/0x24c > device_resume+0xd0/0x200 > async_resume+0x24/0x60 > async_run_entry_fn+0x44/0x110 > process_one_work+0x1f0/0x490 > worker_thread+0x5c/0x450 > kthread+0x158/0x160 > ret_from_fork+0x10/0x24 > > Signed-off-by: Tao Xue <xuetao09@huawei.com> Checkpatch complains: ERROR: Missing Signed-off-by: line by nominal patch author 'Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>' Is Zhangjiantao (Kirin, nanjing) the correct author? If yes can I add "Signed-off-by: Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>? I'll add the stable and correct fixes tags for this. Thanks Mathias ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xhci: solve a double free problem while doing s4 2021-06-10 13:45 ` Mathias Nyman @ 2021-06-10 14:01 ` gregkh 2021-06-10 19:27 ` Mathias Nyman 0 siblings, 1 reply; 5+ messages in thread From: gregkh @ 2021-06-10 14:01 UTC (permalink / raw) To: Mathias Nyman Cc: Zhangjiantao (Kirin, nanjing), Xuetao (kirin), mathias.nyman, linux-usb, linux-kernel, chenyu (U), Caiyadong, xuhaiyang On Thu, Jun 10, 2021 at 04:45:54PM +0300, Mathias Nyman wrote: > On 9.6.2021 17.22, Zhangjiantao (Kirin, nanjing) wrote: > > when system is doing s4, the process of xhci_resume may be as below: > > 1、xhci_mem_cleanup > > 2、xhci_init->xhci_mem_init->xhci_mem_cleanup(when memory is not enough). > > xhci_mem_cleanup will be executed twice when system is out of memory. > > xhci->port_caps is freed in xhci_mem_cleanup,but it isn't set to NULL. > > It will be freed twice when xhci_mem_cleanup is called the second time. > > > > Thanks, nice catch > > > We got following bug when system resumes from s4: > > > > kernel BUG at mm/slub.c:309! > > Internal error: Oops - BUG: 0 [#1] PREEMPT SMP > > CPU: 0 PID: 5929 Tainted: G S W 5.4.96-arm64-desktop #1 > > pc : __slab_free+0x5c/0x424 > > lr : kfree+0x30c/0x32c > > > > Call trace: > > __slab_free+0x5c/0x424 > > kfree+0x30c/0x32c > > xhci_mem_cleanup+0x394/0x3cc > > xhci_mem_init+0x9ac/0x1070 > > xhci_init+0x8c/0x1d0 > > xhci_resume+0x1cc/0x5fc > > xhci_plat_resume+0x64/0x70 > > platform_pm_thaw+0x28/0x60 > > dpm_run_callback+0x54/0x24c > > device_resume+0xd0/0x200 > > async_resume+0x24/0x60 > > async_run_entry_fn+0x44/0x110 > > process_one_work+0x1f0/0x490 > > worker_thread+0x5c/0x450 > > kthread+0x158/0x160 > > ret_from_fork+0x10/0x24 > > > > Signed-off-by: Tao Xue <xuetao09@huawei.com> > > Checkpatch complains: > ERROR: Missing Signed-off-by: line by nominal patch author 'Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>' > > Is Zhangjiantao (Kirin, nanjing) the correct author? If yes can I add > "Signed-off-by: Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>? Please note that it is generally a bad thing for others to add someone else's s-o-b line, as it is a legal agreement. It is best for them to send it instead. thanks, greg k-h ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xhci: solve a double free problem while doing s4 2021-06-10 14:01 ` gregkh @ 2021-06-10 19:27 ` Mathias Nyman 2021-06-11 7:18 ` Zhangjiantao (Kirin, nanjing) 0 siblings, 1 reply; 5+ messages in thread From: Mathias Nyman @ 2021-06-10 19:27 UTC (permalink / raw) To: gregkh, Zhangjiantao (Kirin, nanjing) Cc: Xuetao (kirin), mathias.nyman, linux-usb, linux-kernel, chenyu (U), Caiyadong, xuhaiyang On 10.6.2021 17.01, gregkh@linuxfoundation.org wrote: > On Thu, Jun 10, 2021 at 04:45:54PM +0300, Mathias Nyman wrote: >> On 9.6.2021 17.22, Zhangjiantao (Kirin, nanjing) wrote: >>> when system is doing s4, the process of xhci_resume may be as below: >>> 1、xhci_mem_cleanup >>> 2、xhci_init->xhci_mem_init->xhci_mem_cleanup(when memory is not enough). >>> xhci_mem_cleanup will be executed twice when system is out of memory. >>> xhci->port_caps is freed in xhci_mem_cleanup,but it isn't set to NULL. >>> It will be freed twice when xhci_mem_cleanup is called the second time. >>> >> >> Thanks, nice catch >> >>> We got following bug when system resumes from s4: >>> >>> kernel BUG at mm/slub.c:309! >>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP >>> CPU: 0 PID: 5929 Tainted: G S W 5.4.96-arm64-desktop #1 >>> pc : __slab_free+0x5c/0x424 >>> lr : kfree+0x30c/0x32c >>> >>> Call trace: >>> __slab_free+0x5c/0x424 >>> kfree+0x30c/0x32c >>> xhci_mem_cleanup+0x394/0x3cc >>> xhci_mem_init+0x9ac/0x1070 >>> xhci_init+0x8c/0x1d0 >>> xhci_resume+0x1cc/0x5fc >>> xhci_plat_resume+0x64/0x70 >>> platform_pm_thaw+0x28/0x60 >>> dpm_run_callback+0x54/0x24c >>> device_resume+0xd0/0x200 >>> async_resume+0x24/0x60 >>> async_run_entry_fn+0x44/0x110 >>> process_one_work+0x1f0/0x490 >>> worker_thread+0x5c/0x450 >>> kthread+0x158/0x160 >>> ret_from_fork+0x10/0x24 >>> >>> Signed-off-by: Tao Xue <xuetao09@huawei.com> >> >> Checkpatch complains: >> ERROR: Missing Signed-off-by: line by nominal patch author 'Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>' >> >> Is Zhangjiantao (Kirin, nanjing) the correct author? If yes can I add >> "Signed-off-by: Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>? > > Please note that it is generally a bad thing for others to add someone > else's s-o-b line, as it is a legal agreement. It is best for them to > send it instead. Good point. Zhangjiantao (Kirin, nanjing), could you resend with Author/Signed-off-by corrected. Thanks -Mathias ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xhci: solve a double free problem while doing s4 2021-06-10 19:27 ` Mathias Nyman @ 2021-06-11 7:18 ` Zhangjiantao (Kirin, nanjing) 0 siblings, 0 replies; 5+ messages in thread From: Zhangjiantao (Kirin, nanjing) @ 2021-06-11 7:18 UTC (permalink / raw) To: Mathias Nyman, gregkh Cc: Xuetao (kirin), mathias.nyman, linux-usb, linux-kernel, chenyu (U), Caiyadong, xuhaiyang On 2021/6/11 3:27, Mathias Nyman wrote: > On 10.6.2021 17.01, gregkh@linuxfoundation.org wrote: >> On Thu, Jun 10, 2021 at 04:45:54PM +0300, Mathias Nyman wrote: >>> On 9.6.2021 17.22, Zhangjiantao (Kirin, nanjing) wrote: >>>> when system is doing s4, the process of xhci_resume may be as below: >>>> 1、xhci_mem_cleanup >>>> 2、xhci_init->xhci_mem_init->xhci_mem_cleanup(when memory is not enough). >>>> xhci_mem_cleanup will be executed twice when system is out of memory. >>>> xhci->port_caps is freed in xhci_mem_cleanup,but it isn't set to NULL. >>>> It will be freed twice when xhci_mem_cleanup is called the second time. >>>> >>> Thanks, nice catch >>> >>>> We got following bug when system resumes from s4: >>>> >>>> kernel BUG at mm/slub.c:309! >>>> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP >>>> CPU: 0 PID: 5929 Tainted: G S W 5.4.96-arm64-desktop #1 >>>> pc : __slab_free+0x5c/0x424 >>>> lr : kfree+0x30c/0x32c >>>> >>>> Call trace: >>>> __slab_free+0x5c/0x424 >>>> kfree+0x30c/0x32c >>>> xhci_mem_cleanup+0x394/0x3cc >>>> xhci_mem_init+0x9ac/0x1070 >>>> xhci_init+0x8c/0x1d0 >>>> xhci_resume+0x1cc/0x5fc >>>> xhci_plat_resume+0x64/0x70 >>>> platform_pm_thaw+0x28/0x60 >>>> dpm_run_callback+0x54/0x24c >>>> device_resume+0xd0/0x200 >>>> async_resume+0x24/0x60 >>>> async_run_entry_fn+0x44/0x110 >>>> process_one_work+0x1f0/0x490 >>>> worker_thread+0x5c/0x450 >>>> kthread+0x158/0x160 >>>> ret_from_fork+0x10/0x24 >>>> >>>> Signed-off-by: Tao Xue <xuetao09@huawei.com> >>> Checkpatch complains: >>> ERROR: Missing Signed-off-by: line by nominal patch author 'Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>' >>> >>> Is Zhangjiantao (Kirin, nanjing) the correct author? If yes can I add >>> "Signed-off-by: Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@huawei.com>? >> Please note that it is generally a bad thing for others to add someone >> else's s-o-b line, as it is a legal agreement. It is best for them to >> send it instead. > Good point. > Zhangjiantao (Kirin, nanjing), could you resend with Author/Signed-off-by corrected. Yes, I amd and Tao Xue are both the correct author, I will resend soon; Thanks --Zhangjiantao ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-06-11 7:19 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <1623244292-108534-1-git-send-email-xuetao09@huawei.com>
2021-06-09 14:22 ` [PATCH] xhci: solve a double free problem while doing s4 Zhangjiantao (Kirin, nanjing)
2021-06-10 13:45 ` Mathias Nyman
2021-06-10 14:01 ` gregkh
2021-06-10 19:27 ` Mathias Nyman
2021-06-11 7:18 ` Zhangjiantao (Kirin, nanjing)
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).