From: Mathias Nyman <mathias.nyman@linux.intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Guenter Roeck <groeck@google.com>
Cc: linux-usb@vger.kernel.org, Yu Chen <chenyu56@huawei.com>,
"# v4 . 10+" <stable@vger.kernel.org>,
Fan Ning <fanning4@hisilicon.com>, Li Rui <lirui39@hisilicon.com>,
yangdi <yangdi10@hisilicon.com>
Subject: Re: [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first
Date: Mon, 4 Dec 2017 11:16:29 +0200 [thread overview]
Message-ID: <166c4320-7b68-1d8a-ddf5-beea53cf452a@linux.intel.com> (raw)
In-Reply-To: <20171201152340.GA10834@kroah.com>
On 01.12.2017 17:23, Greg Kroah-Hartman wrote:
> On Fri, Dec 01, 2017 at 06:38:16AM -0800, Guenter Roeck wrote:
>> On Fri, Dec 1, 2017 at 3:41 AM, Mathias Nyman
>> <mathias.nyman@linux.intel.com> wrote:
>>> From: Yu Chen <chenyu56@huawei.com>
>>>
>>> Check vdev->real_port 0 to avoid panic
>>> [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108
>>> [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570
>>> [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8
>>> [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0
>>> [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8
>>> [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70
>>> [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108
>>> [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40
>>> [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120
>>> [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210
>>> [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0
>>> [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488
>>> [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8
>>> [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490
>>> [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0
>>> [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100
>>> [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50
>>>
>>> The problem can occur if xhci_plat_remove() is called shortly after
>>> xhci_plat_probe(). While xhci_free_virt_devices_depth_first been
>>> called before the device has been setup and get real_port initialized.
>>> The problem occurred on Hikey960 and was reproduced by Guenter Roeck
>>> on Kevin with chromeos-4.4.
>>>
>>> Cc: Guenter Roeck <groeck@google.com>
>>> Cc: <stable@vger.kernel.org> # v4.10+
>>
>> Fixes: ee8665e28e8d ("xhci: free xhci virtual devices with leaf nodes first")
>>
>> would probably be better. That patch is in v4.4.y as well as in
>> v4.9.y, and thus both releases are affected.
>
> I've added this fixes line, thanks.
>
Thanks
-Mathias
prev parent reply other threads:[~2017-12-04 9:14 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1512128480-11230-1-git-send-email-mathias.nyman@linux.intel.com>
2017-12-01 11:41 ` [PATCH 1/2] xhci: Don't show incorrect WARN message about events for empty rings Mathias Nyman
2017-12-01 11:41 ` [PATCH 2/2] usb: xhci: fix panic in xhci_free_virt_devices_depth_first Mathias Nyman
2017-12-01 14:38 ` Guenter Roeck
2017-12-01 15:23 ` Greg Kroah-Hartman
2017-12-04 9:16 ` Mathias Nyman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=166c4320-7b68-1d8a-ddf5-beea53cf452a@linux.intel.com \
--to=mathias.nyman@linux.intel.com \
--cc=chenyu56@huawei.com \
--cc=fanning4@hisilicon.com \
--cc=gregkh@linuxfoundation.org \
--cc=groeck@google.com \
--cc=linux-usb@vger.kernel.org \
--cc=lirui39@hisilicon.com \
--cc=stable@vger.kernel.org \
--cc=yangdi10@hisilicon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.