lkml.org 
[lkml]   [2017]   [Sep]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] xhci: Cancel cmd_timer before cleanup the command queue in xhci_hc_died()
    Date
    When the cmd_timer fired, it would try to access the command struct.
    So cancel it before cleanup the command queue in xhci_hc_died(), to
    avoid use-after-free reported by KASAN:
    [ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
    [ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
    ...
    [ 177.180644] Freed by task 0:
    [ 177.183882] kasan_slab_free+0x90/0x15c
    [ 177.188194] kfree+0x114/0x28c
    [ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8
    [ 177.196916] xhci_hc_died+0x84/0x358

    Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
    Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
    ---

    drivers/usb/host/xhci-ring.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    index a9443651ce0f..69ac3deffb7b 100644
    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -914,6 +914,7 @@ void xhci_hc_died(struct xhci_hcd *xhci)
    xhci_err(xhci, "xHCI host controller not responding, assume dead\n");
    xhci->xhc_state |= XHCI_STATE_DYING;

    + cancel_delayed_work_sync(&xhci->cmd_timer);
    xhci_cleanup_command_queue(xhci);

    /* return any pending urbs, remove may be waiting for them */
    --
    2.11.0

    \
     
     \ /
      Last update: 2017-09-29 11:14    [W:8.577 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site