mirror of
https://github.com/torvalds/linux.git
synced 2025-11-05 03:00:13 +02:00
af8e119f52
re-enumerating full-speed devices after a failed address device command
can trigger a NULL pointer dereference.
Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size
value during enumeration. Usb core calls usb_ep0_reinit() in this case,
which ends up calling xhci_configure_endpoint().
On Panther point xHC the xhci_configure_endpoint() function will
additionally check and reserve bandwidth in software. Other hosts do
this in hardware
If xHC address device command fails then a new xhci_virt_device structure
is allocated as part of re-enabling the slot, but the bandwidth table
pointers are not set up properly here.
This triggers the NULL pointer dereference the next time usb_ep0_reinit()
is called and xhci_configure_endpoint() tries to check and reserve
bandwidth
[46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd
[46710.713699] usb 3-1: Device not responding to setup address.
[46710.917684] usb 3-1: Device not responding to setup address.
[46711.125536] usb 3-1: device not accepting address 5, error -71
[46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008
[46711.125600] #PF: supervisor read access in kernel mode
[46711.125603] #PF: error_code(0x0000) - not-present page
[46711.125606] PGD 0 P4D 0
[46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI
[46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1
[46711.125620] Hardware name: Gigabyte Technology Co., Ltd.
[46711.125623] Workqueue: usb_hub_wq hub_event [usbcore]
[46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c
Fix this by making sure bandwidth table pointers are set up correctly
after a failed address device command, and additionally by avoiding
checking for bandwidth in cases like this where no actual endpoints are
added or removed, i.e. only context for default control endpoint 0 is
evaluated.
Reported-by: Karel Balej <balejk@matfyz.cz>
Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| bcma-hcd.c | ||
| ehci-atmel.c | ||
| ehci-brcm.c | ||
| ehci-dbg.c | ||
| ehci-exynos.c | ||
| ehci-fsl.c | ||
| ehci-fsl.h | ||
| ehci-grlib.c | ||
| ehci-hcd.c | ||
| ehci-hub.c | ||
| ehci-mem.c | ||
| ehci-mv.c | ||
| ehci-npcm7xx.c | ||
| ehci-omap.c | ||
| ehci-orion.c | ||
| ehci-pci.c | ||
| ehci-platform.c | ||
| ehci-ppc-of.c | ||
| ehci-ps3.c | ||
| ehci-q.c | ||
| ehci-sched.c | ||
| ehci-sh.c | ||
| ehci-spear.c | ||
| ehci-st.c | ||
| ehci-sysfs.c | ||
| ehci-timer.c | ||
| ehci-xilinx-of.c | ||
| ehci.h | ||
| fhci-dbg.c | ||
| fhci-hcd.c | ||
| fhci-hub.c | ||
| fhci-mem.c | ||
| fhci-q.c | ||
| fhci-sched.c | ||
| fhci-tds.c | ||
| fhci.h | ||
| fsl-mph-dr-of.c | ||
| isp116x-hcd.c | ||
| isp116x.h | ||
| isp1362-hcd.c | ||
| isp1362.h | ||
| Kconfig | ||
| Makefile | ||
| max3421-hcd.c | ||
| octeon-hcd.c | ||
| octeon-hcd.h | ||
| ohci-at91.c | ||
| ohci-da8xx.c | ||
| ohci-dbg.c | ||
| ohci-exynos.c | ||
| ohci-hcd.c | ||
| ohci-hub.c | ||
| ohci-mem.c | ||
| ohci-nxp.c | ||
| ohci-omap.c | ||
| ohci-pci.c | ||
| ohci-platform.c | ||
| ohci-ppc-of.c | ||
| ohci-ps3.c | ||
| ohci-pxa27x.c | ||
| ohci-q.c | ||
| ohci-s3c2410.c | ||
| ohci-sa1111.c | ||
| ohci-sm501.c | ||
| ohci-spear.c | ||
| ohci-st.c | ||
| ohci.h | ||
| oxu210hp-hcd.c | ||
| pci-quirks.c | ||
| pci-quirks.h | ||
| r8a66597-hcd.c | ||
| r8a66597.h | ||
| sl811-hcd.c | ||
| sl811.h | ||
| sl811_cs.c | ||
| ssb-hcd.c | ||
| uhci-debug.c | ||
| uhci-grlib.c | ||
| uhci-hcd.c | ||
| uhci-hcd.h | ||
| uhci-hub.c | ||
| uhci-pci.c | ||
| uhci-platform.c | ||
| uhci-q.c | ||
| xen-hcd.c | ||
| xhci-caps.h | ||
| xhci-dbg.c | ||
| xhci-dbgcap.c | ||
| xhci-dbgcap.h | ||
| xhci-dbgtty.c | ||
| xhci-debugfs.c | ||
| xhci-debugfs.h | ||
| xhci-ext-caps.c | ||
| xhci-ext-caps.h | ||
| xhci-histb.c | ||
| xhci-hub.c | ||
| xhci-mem.c | ||
| xhci-mtk-sch.c | ||
| xhci-mtk.c | ||
| xhci-mtk.h | ||
| xhci-mvebu.c | ||
| xhci-mvebu.h | ||
| xhci-pci-renesas.c | ||
| xhci-pci.c | ||
| xhci-pci.h | ||
| xhci-plat.c | ||
| xhci-plat.h | ||
| xhci-port.h | ||
| xhci-rcar.c | ||
| xhci-ring.c | ||
| xhci-rzv2m.c | ||
| xhci-rzv2m.h | ||
| xhci-tegra.c | ||
| xhci-trace.c | ||
| xhci-trace.h | ||
| xhci.c | ||
| xhci.h | ||