From: Guenter Roeck <linux@roeck-us.net>
To: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: linux-usb@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [RFT PATCH 1/1] xhci: free xhci virtual devices with leaf nodes first
Date: Mon, 28 Nov 2016 12:24:55 -0800 [thread overview]
Message-ID: <20161128202455.GC10709@roeck-us.net> (raw)
In-Reply-To: <1479903867-561-1-git-send-email-mathias.nyman@linux.intel.com>
On Wed, Nov 23, 2016 at 02:24:27PM +0200, Mathias Nyman wrote:
> the tt_info provided by a HS hub might be in use to by a child device
> Make sure we free the devices in the correct order.
>
> This is needed in special cases such as when xhci controller is
> reset when resuming from hibernate, and all virt_devices are freed.
>
> Also free the virt_devices starting from max slot_id as children
> more commonly have higher slot_id than parent.
>
> CC: <stable@vger.kernel.org>
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
>
> ---
>
> Guenter Roeck, does this work for you?
>
Yes, it does.
Tested-by: Guenter Roeck <groeck@chromium.org>
Thanks,
Guenter
> A rework of how tt_info is stored and used might be needed,
> but that will take some time and won't go to stable as easily.
> ---
> drivers/usb/host/xhci-mem.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index 6afe323..b3a5cd8 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -979,6 +979,40 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
> xhci->devs[slot_id] = NULL;
> }
>
> +/*
> + * Free a virt_device structure.
> + * If the virt_device added a tt_info (a hub) and has children pointing to
> + * that tt_info, then free the child first. Recursive.
> + * We can't rely on udev at this point to find child-parent relationships.
> + */
> +void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
> +{
> + struct xhci_virt_device *vdev;
> + struct list_head *tt_list_head;
> + struct xhci_tt_bw_info *tt_info, *next;
> + int i;
> +
> + vdev = xhci->devs[slot_id];
> + if (!vdev)
> + return;
> +
> + tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
> + list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
> + /* is this a hub device that added a tt_info to the tts list */
> + if (tt_info->slot_id == slot_id) {
> + /* are any devices using this tt_info? */
> + for (i = 1; i < HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
> + vdev = xhci->devs[i];
> + if (vdev && (vdev->tt_info == tt_info))
> + xhci_free_virt_devices_depth_first(
> + xhci, i);
> + }
> + }
> + }
> + /* we are now at a leaf device */
> + xhci_free_virt_device(xhci, slot_id);
> +}
> +
> int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
> struct usb_device *udev, gfp_t flags)
> {
> @@ -1829,8 +1863,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
> }
> }
>
> - for (i = 1; i < MAX_HC_SLOTS; ++i)
> - xhci_free_virt_device(xhci, i);
> + for (i = HCS_MAX_SLOTS(xhci->hcs_params1); i > 0; i--)
> + xhci_free_virt_devices_depth_first(xhci, i);
>
> dma_pool_destroy(xhci->segment_pool);
> xhci->segment_pool = NULL;
> --
> 1.9.1
>
next prev parent reply other threads:[~2016-11-28 20:24 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-15 20:36 [RFC PATCH] xhci: Fix memory use after free in xhci_free_virt_device Guenter Roeck
2016-11-17 15:11 ` Mathias Nyman
2016-11-23 12:24 ` [RFT PATCH 1/1] xhci: free xhci virtual devices with leaf nodes first Mathias Nyman
2016-11-23 13:32 ` Guenter Roeck
2016-11-23 14:44 ` Mathias Nyman
2016-11-24 9:02 ` Felipe Balbi
2016-11-24 9:57 ` Mathias Nyman
2016-11-24 11:03 ` Felipe Balbi
2016-11-24 12:07 ` Mathias Nyman
2016-11-24 19:58 ` Guenter Roeck
2016-11-28 20:24 ` Guenter Roeck [this message]
2016-11-30 11:41 ` Mathias Nyman
2016-12-09 21:28 ` Guenter Roeck
2016-12-12 13:50 ` Mathias Nyman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161128202455.GC10709@roeck-us.net \
--to=linux@roeck-us.net \
--cc=linux-usb@vger.kernel.org \
--cc=mathias.nyman@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.