* [PATCH] usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
@ 2018-03-23 17:05 Jack Pham
2018-03-23 17:23 ` Jack Pham
0 siblings, 1 reply; 2+ messages in thread
From: Jack Pham @ 2018-03-23 17:05 UTC (permalink / raw)
To: Felipe Balbi; +Cc: linux-usb, Mayank Rana, stable, Jack Pham
From: Mayank Rana <mrana@codeaurora.org>
dwc3_ep_dequeue() waits for completion of End Transfer command
using wait_event_lock_irq(), which will release the dwc3->lock
while waiting and reacquire after completion. This allows a
potential race condition with ep_disable() which also removes
all requests from started_list and pending_list. The check for
NULL r->trb should catch this but currently it exits to the
wrong 'out1' label which calls dwc3_gadget_giveback(). Since
its list entry was already removed, if CONFIG_DEBUG_LIST is
enabled a 'list_del corruption' bug is thrown since its
next/prev pointers are already LIST_POISON1/2. If r->trb is
NULL it should simply exit to 'out0'.
Fixes: cf3113d893d4 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue")
Cc: stable@vger.kernel.org
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
---
drivers/usb/dwc3/gadget.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2bda4eb..1238a97 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1417,7 +1417,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
dwc->lock);
if (!r->trb)
- goto out1;
+ goto out0;
if (r->num_pending_sgs) {
struct dwc3_trb *trb;
--
2.9.1.200.gb1ec08f
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
2018-03-23 17:05 [PATCH] usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue Jack Pham
@ 2018-03-23 17:23 ` Jack Pham
0 siblings, 0 replies; 2+ messages in thread
From: Jack Pham @ 2018-03-23 17:23 UTC (permalink / raw)
To: Felipe Balbi; +Cc: linux-usb, Mayank Rana, stable
Hi Felipe,
On Fri, Mar 23, 2018 at 10:05:33AM -0700, Jack Pham wrote:
> dwc3_ep_dequeue() waits for completion of End Transfer command
> using wait_event_lock_irq(), which will release the dwc3->lock
> while waiting and reacquire after completion. This allows a
> potential race condition with ep_disable() which also removes
> all requests from started_list and pending_list. The check for
> NULL r->trb should catch this but currently it exits to the
> wrong 'out1' label which calls dwc3_gadget_giveback(). Since
> its list entry was already removed, if CONFIG_DEBUG_LIST is
> enabled a 'list_del corruption' bug is thrown since its
> next/prev pointers are already LIST_POISON1/2. If r->trb is
> NULL it should simply exit to 'out0'.
>
> Fixes: cf3113d893d4 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue")
Upon taking a second look at this patch, and noting the subject of the
Fixes tag here, one side effect of this fix is that dep->queued_requests
won't get decremented. I see this is a counter for tracing purposes so
probably doesn't affect function. But it begs the question of whether
dwc3_remove_requests() as called from __dwc3_gadget_ep_disable() should
have decremented this counter or even zeroed it out completely?
> if (!r->trb)
> - goto out1;
> + goto out0;
>
Thanks,
Jack
--
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-03-23 17:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-23 17:05 [PATCH] usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue Jack Pham
2018-03-23 17:23 ` Jack Pham
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).