From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Jeffy Chen <jeffy.chen@rock-chips.com>
Cc: linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
Mathias Nyman <mathias.nyman@intel.com>
Subject: Re: [PATCH] xhci: Cancel cmd_timer before cleanup the command queue in xhci_hc_died()
Date: Wed, 1 Nov 2017 17:03:36 +0100 [thread overview]
Message-ID: <20171101160336.GA22440@kroah.com> (raw)
In-Reply-To: <20170929091247.28604-1-jeffy.chen@rock-chips.com>
On Fri, Sep 29, 2017 at 05:12:47PM +0800, Jeffy Chen wrote:
> When the cmd_timer fired, it would try to access the command struct.
> So cancel it before cleanup the command queue in xhci_hc_died(), to
> avoid use-after-free reported by KASAN:
> [ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
> [ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
> ...
> [ 177.180644] Freed by task 0:
> [ 177.183882] kasan_slab_free+0x90/0x15c
> [ 177.188194] kfree+0x114/0x28c
> [ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8
> [ 177.196916] xhci_hc_died+0x84/0x358
>
> Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
> Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
> ---
Mathias, did you miss this one? Want me to queue it up?
thanks,
greg k-h
next prev parent reply other threads:[~2017-11-01 16:03 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-29 9:12 [PATCH] xhci: Cancel cmd_timer before cleanup the command queue in xhci_hc_died() Jeffy Chen
2017-11-01 16:03 ` Greg Kroah-Hartman [this message]
2017-11-01 16:28 ` Mathias Nyman
2017-11-01 16:39 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171101160336.GA22440@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=jeffy.chen@rock-chips.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mathias.nyman@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.