From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [v3] usb: gadget: f_fs: don't free buffer prematurely From: Greg Kroah-Hartman Message-Id: <20190322053602.GA31708@kroah.com> Date: Fri, 22 Mar 2019 06:36:02 +0100 To: fei.yang@intel.com Cc: balbi@kernel.org, andrzej.p@collabora.com, plr.vincent@gmail.com, jingx.shen@intel.com, john.stultz@linaro.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org List-ID: T24gVGh1LCBNYXIgMjEsIDIwMTkgYXQgMDI6MzE6MTRQTSAtMDcwMCwgZmVpLnlhbmdAaW50ZWwu Y29tIHdyb3RlOgo+IEZyb206IEZlaSBZYW5nIDxmZWkueWFuZ0BpbnRlbC5jb20+Cj4gCj4gVGhl IGZvbGxvd2luZyBrZXJuZWwgcGFuaWMgaGFwcGVucyBkdWUgdG8gdGhlIGlvX2RhdGEgYnVmZmVy IGdldHMgZGVhbGxvY2F0ZWQKPiBiZWZvcmUgdGhlIGFzeW5jIGlvIGlzIGNvbXBsZXRlZC4gQWRk IGEgY2hlY2sgZm9yIHRoZSBjYXNlIHdoZXJlIGlvX2RhdGEgYnVmZmVyCj4gc2hvdWxkIGJlIGRl YWxsb2NhdGVkIGJ5IGZmc191c2VyX2NvcHlfd29ya2VyLgo+IAo+IFsgICA0MS42NjMzMzRdIEJV RzogdW5hYmxlIHRvIGhhbmRsZSBrZXJuZWwgTlVMTCBwb2ludGVyIGRlcmVmZXJlbmNlIGF0IDAw MDAwMDAwMDAwMDAwNDgKPiBbICAgNDEuNjcyMDk5XSAjUEYgZXJyb3I6IFtub3JtYWwga2VybmVs IHJlYWQgZmF1bHRdCj4gWyAgIDQxLjY3NzM1Nl0gUEdEIDIwYzk3NDA2NyBQNEQgMjBjOTc0MDY3 IFBVRCAyMGM5NzMwNjcgUE1EIDAKPiBbICAgNDEuNjgzNjg3XSBPb3BzOiAwMDAwIFsjMV0gUFJF RU1QVCBTTVAKPiBbICAgNDEuNjg3OTc2XSBDUFU6IDEgUElEOiA3IENvbW06IGt3b3JrZXIvdTg6 MCBUYWludGVkOiBHICAgICBVICAgICAgICAgICAgNS4wLjAtcXVpbHQtMmU1ZGMwYWMtMDA3OTAt Z2Q4Yzc5ZjItZGlydHkgIzIKPiBbICAgNDEuNzA1MzA5XSBXb3JrcXVldWU6IGFkYiBmZnNfdXNl cl9jb3B5X3dvcmtlcgo+IFsgICA0MS43MDUzMTZdIFJJUDogMDAxMDpfX3Z1bm1hcCsweDJhLzB4 YzAKPiBbICAgNDEuNzA1MzE4XSBDb2RlOiAwZiAxZiA0NCAwMCAwMCA0OCA4NSBmZiAwZiA4NCA4 NyAwMCAwMCAwMCA1NSBmNyBjNyBmZiAwZiAwMCAwMCA0OCA4OSBlNSA0MSA1NSA0MSA4OSBmNSA0 MSA1NCA1MyA0OCA4OSBmYiA3NSA3MSBlOCA1NiBkNyBmZiBmZiA8NGM+IDhiIDYwIDQ4IDRkIDg1 IGU0IDc0IDc2IDQ4IDg5IGRmIGU4IDI1IGZmIGZmIGZmIDQ1IDg1IGVkIDc0IDQ2Cj4gWyAgIDQx LjcwNTMyMF0gUlNQOiAwMDE4OmZmZmZiYzNhNDAwNTNkZjAgRUZMQUdTOiAwMDAxMDI4Ngo+IFsg ICA0MS43MDUzMjJdIFJBWDogMDAwMDAwMDAwMDAwMDAwMCBSQlg6IGZmZmZiYzNhNDA2ZjEwMDAg UkNYOiAwMDAwMDAwMDAwMDAwMDAwCj4gWyAgIDQxLjcwNTMyM10gUkRYOiAwMDAwMDAwMDAwMDAw MDAxIFJTSTogMDAwMDAwMDAwMDAwMDAwMSBSREk6IDAwMDAwMDAwZmZmZmZmZmYKPiBbICAgNDEu NzA1MzI0XSBSQlA6IGZmZmZiYzNhNDAwNTNlMDggUjA4OiAwMDAwMDAwMDAwMDFmYjc5IFIwOTog MDAwMDAwMDAwMDAwMDAzNwo+IFsgICA0MS43MDUzMjVdIFIxMDogZmZmZmJjM2E0MDA1M2I2OCBS MTE6IGZmZmZiYzNhNDAwNTNjYWQgUjEyOiBmZmZmZmZmZmZmZmZmZmYyCj4gWyAgIDQxLjcwNTMy Nl0gUjEzOiAwMDAwMDAwMDAwMDAwMDAxIFIxNDogMDAwMDAwMDAwMDAwMDAwMCBSMTU6IGZmZmZm ZmZmZmZmZmZmZmYKPiBbICAgNDEuNzA1MzI4XSBGUzogIDAwMDAwMDAwMDAwMDAwMDAoMDAwMCkg R1M6ZmZmZjllMjk3N2E4MDAwMCgwMDAwKSBrbmxHUzowMDAwMDAwMDAwMDAwMDAwCj4gWyAgIDQx LjcwNTMyOV0gQ1M6ICAwMDEwIERTOiAwMDAwIEVTOiAwMDAwIENSMDogMDAwMDAwMDA4MDA1MDAz Mwo+IFsgICA0MS43MDUzMzBdIENSMjogMDAwMDAwMDAwMDAwMDA0OCBDUjM6IDAwMDAwMDAyMGM5 OTQwMDAgQ1I0OiAwMDAwMDAwMDAwMzQwNmUwCj4gWyAgIDQxLjcwNTMzMV0gQ2FsbCBUcmFjZToK PiBbICAgNDEuNzA1MzM4XSAgdmZyZWUrMHg1MC8weGIwCj4gWyAgIDQxLjcwNTM0MV0gIGZmc191 c2VyX2NvcHlfd29ya2VyKzB4ZTkvMHgxYzAKPiBbICAgNDEuNzA1MzQ0XSAgcHJvY2Vzc19vbmVf d29yaysweDE5Zi8weDNlMAo+IFsgICA0MS43MDUzNDhdICB3b3JrZXJfdGhyZWFkKzB4M2YvMHgz YjAKPiBbICAgNDEuODI5NzY2XSAga3RocmVhZCsweDEyYi8weDE1MAo+IFsgICA0MS44MzMzNzFd ICA/IHByb2Nlc3Nfb25lX3dvcmsrMHgzZTAvMHgzZTAKPiBbICAgNDEuODM4MDQ1XSAgPyBrdGhy ZWFkX2NyZWF0ZV93b3JrZXJfb25fY3B1KzB4NzAvMHg3MAo+IFsgICA0MS44NDM2OTVdICByZXRf ZnJvbV9mb3JrKzB4M2EvMHg1MAo+IFsgICA0MS44NDc2ODldIE1vZHVsZXMgbGlua2VkIGluOiBo Y2lfdWFydCBibHVldG9vdGggZWNkaF9nZW5lcmljIHJma2lsbF9ncGlvIGR3YzNfcGNpIGR3YzMg c25kX3VzYl9hdWRpbyBtZWlfbWUgdHBtX2NyYiBzbmRfdXNibWlkaV9saWIgeGhjaV9wY2kgeGhj aV9oY2QgbWVpIHRwbSBzbmRfaHdkZXAgY2ZnODAyMTEgc25kX3NvY19za2wgc25kX3NvY19za2xf aXBjIHNuZF9zb2Nfc3N0X2lwYyBzbmRfc29jX3NzdF9kc3Agc25kX2hkYV9leHRfY29yZSBzbmRf aGRhX2NvcmUgdmlkZW9idWYyX2RtYV9zZyBjcmxtb2R1bGUKPiBbICAgNDEuODc2ODgwXSBDUjI6 IDAwMDAwMDAwMDAwMDAwNDgKPiBbICAgNDEuODgwNTg0XSAtLS1bIGVuZCB0cmFjZSAyYmM0YWRk ZmYwZjJlNjczIF0tLS0KPiBbICAgNDEuODkxMzQ2XSBSSVA6IDAwMTA6X192dW5tYXArMHgyYS8w eGMwCj4gWyAgIDQxLjg5NTczNF0gQ29kZTogMGYgMWYgNDQgMDAgMDAgNDggODUgZmYgMGYgODQg ODcgMDAgMDAgMDAgNTUgZjcgYzcgZmYgMGYgMDAgMDAgNDggODkgZTUgNDEgNTUgNDEgODkgZjUg NDEgNTQgNTMgNDggODkgZmIgNzUgNzEgZTggNTYgZDcgZmYgZmYgPDRjPiA4YiA2MCA0OCA0ZCA4 NSBlNCA3NCA3NiA0OCA4OSBkZiBlOCAyNSBmZiBmZiBmZiA0NSA4NSBlZCA3NCA0Ngo+IFsgICA0 MS45MTY3NDBdIFJTUDogMDAxODpmZmZmYmMzYTQwMDUzZGYwIEVGTEFHUzogMDAwMTAyODYKPiBb ICAgNDEuOTIyNTgzXSBSQVg6IDAwMDAwMDAwMDAwMDAwMDAgUkJYOiBmZmZmYmMzYTQwNmYxMDAw IFJDWDogMDAwMDAwMDAwMDAwMDAwMAo+IFsgICA0MS45MzA1NjNdIFJEWDogMDAwMDAwMDAwMDAw MDAwMSBSU0k6IDAwMDAwMDAwMDAwMDAwMDEgUkRJOiAwMDAwMDAwMGZmZmZmZmZmCj4gWyAgIDQx LjkzODU0MF0gUkJQOiBmZmZmYmMzYTQwMDUzZTA4IFIwODogMDAwMDAwMDAwMDAxZmI3OSBSMDk6 IDAwMDAwMDAwMDAwMDAwMzcKPiBbICAgNDEuOTQ2NTIwXSBSMTA6IGZmZmZiYzNhNDAwNTNiNjgg UjExOiBmZmZmYmMzYTQwMDUzY2FkIFIxMjogZmZmZmZmZmZmZmZmZmZmMgo+IFsgICA0MS45NTQ1 MDJdIFIxMzogMDAwMDAwMDAwMDAwMDAwMSBSMTQ6IDAwMDAwMDAwMDAwMDAwMDAgUjE1OiBmZmZm ZmZmZmZmZmZmZmZmCj4gWyAgIDQxLjk2MjQ4Ml0gRlM6ICAwMDAwMDAwMDAwMDAwMDAwKDAwMDAp IEdTOmZmZmY5ZTI5NzdhODAwMDAoMDAwMCkga25sR1M6MDAwMDAwMDAwMDAwMDAwMAo+IFsgICA0 MS45NzE1MzZdIENTOiAgMDAxMCBEUzogMDAwMCBFUzogMDAwMCBDUjA6IDAwMDAwMDAwODAwNTAw MzMKPiBbICAgNDEuOTc3OTYwXSBDUjI6IDAwMDAwMDAwMDAwMDAwNDggQ1IzOiAwMDAwMDAwMjBj OTk0MDAwIENSNDogMDAwMDAwMDAwMDM0MDZlMAo+IFsgICA0MS45ODU5MzBdIEtlcm5lbCBwYW5p YyAtIG5vdCBzeW5jaW5nOiBGYXRhbCBleGNlcHRpb24KPiBbICAgNDEuOTkxODE3XSBLZXJuZWwg T2Zmc2V0OiAweDE2MDAwMDAwIGZyb20gMHhmZmZmZmZmZjgxMDAwMDAwIChyZWxvY2F0aW9uIHJh bmdlOiAweGZmZmZmZmZmODAwMDAwMDAtMHhmZmZmZmZmZmJmZmZmZmZmKQo+IFsgICA0Mi4wMDk1 MjVdIFJlYm9vdGluZyBpbiAxMCBzZWNvbmRzLi4KPiBbICAgNTIuMDE0Mzc2XSBBQ1BJIE1FTU9S WSBvciBJL08gUkVTRVRfUkVHLgo+IAo+IEZpeGVzOiA3NzJhN2E3MjRmNiAoInVzYjogZ2FkZ2V0 OiBmX2ZzOiBBbGxvdyBzY2F0dGVyLWdhdGhlciBidWZmZXJzIikKPiBTaWduZWQtb2ZmLWJ5OiBG ZWkgWWFuZyA8ZmVpLnlhbmdAaW50ZWwuY29tPgo+IFJldmlld2VkLWJ5OiBNYW51IEdhdXRhbSA8 bWdhdXRhbUBjb2RlYXVyb3JhLm9yZz4KPiBUZXN0ZWQtYnk6IEpvaG4gU3R1bHR6IDxqb2huLnN0 dWx0ekBsaW5hcm8ub3JnPgo+IC0tLQo+IHYyOiBhZGQgdGFnOiAiRml4ZXM6IDc3MmE3YTcyNGY2 IC4uLi4uLiIsIFJldmlld2VkLWJ5IGFuZCBUZXN0ZWQtYnkuCj4gdjM6IGNoZWNrIGRhdGEgZm9y IE5VTEwgaW5zdGVhZCBvZiAicmV0ID09IC1FSU9DQlFVRVVFRCIsIHdoaWNoIHdvdWxkIGJlIHNh ZmVyCj4gICAgIGFuZCBrZWVwIHRoZSBvcmlnaW5hbCBsb2dpYyBpbnRhY3QuCgpJZiBpdCAiZml4 ZXMiIGEgcHJvYmxlbSBpbiA1LjAsIHdlIHNob3VsZCBhZGQgYToKCUNjOiBzdGFibGUgPHN0YWJs ZUB2Z2VyLmtlcm5lbC5vcmc+CnRvIGl0IGFzIHdlbGwuCgp0aGFua3MsCgpncmVnIGstaAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76612C43381 for ; Fri, 22 Mar 2019 05:36:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3FACF218B0 for ; Fri, 22 Mar 2019 05:36:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553232969; bh=mX++0dd0hjObisk5SEXrUW7udMc7ZLafaRpSFFqF/FE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=IF4fRXuwZK6/3EEPwdBFXXDbMUASzIx4F1N8RWHdE6s3wqpSQ++w5FWa8KOVwuhNI mauoiG8+/vR/IM6DABVOzBisQGT4IIs5W7+5yvUUs4XF/m6Lo34g0tg83GLS7Kq09u rpjEcylBagJK2ywSR/2B5cRW9NuMj433eVEmqdTU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727717AbfCVFgH (ORCPT ); Fri, 22 Mar 2019 01:36:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:45366 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726162AbfCVFgH (ORCPT ); Fri, 22 Mar 2019 01:36:07 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 60580218B0; Fri, 22 Mar 2019 05:36:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553232965; bh=mX++0dd0hjObisk5SEXrUW7udMc7ZLafaRpSFFqF/FE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=u7ihKpvycdNKRXBe9HgslhWBlq4OmYVUF7bsXw9uARp3JPivf9LWNI3S48FLQy433 +L2pDe+dD1TaGFH9bGVt2njlzDm5FLFgqRDyXW/sIi0sTsGUg1ZRGJFxtBs6Q3WMZV 52tPfnPl6S0I3zSQgW3yZOlk53RRkzpDPKBJWGuA= Date: Fri, 22 Mar 2019 06:36:02 +0100 From: Greg KH To: fei.yang@intel.com Cc: balbi@kernel.org, andrzej.p@collabora.com, plr.vincent@gmail.com, jingx.shen@intel.com, john.stultz@linaro.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] usb: gadget: f_fs: don't free buffer prematurely Message-ID: <20190322053602.GA31708@kroah.com> References: <1553203874-130203-1-git-send-email-fei.yang@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1553203874-130203-1-git-send-email-fei.yang@intel.com> User-Agent: Mutt/1.11.4 (2019-03-13) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Mar 21, 2019 at 02:31:14PM -0700, fei.yang@intel.com wrote: > From: Fei Yang > > The following kernel panic happens due to the io_data buffer gets deallocated > before the async io is completed. Add a check for the case where io_data buffer > should be deallocated by ffs_user_copy_worker. > > [ 41.663334] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 > [ 41.672099] #PF error: [normal kernel read fault] > [ 41.677356] PGD 20c974067 P4D 20c974067 PUD 20c973067 PMD 0 > [ 41.683687] Oops: 0000 [#1] PREEMPT SMP > [ 41.687976] CPU: 1 PID: 7 Comm: kworker/u8:0 Tainted: G U 5.0.0-quilt-2e5dc0ac-00790-gd8c79f2-dirty #2 > [ 41.705309] Workqueue: adb ffs_user_copy_worker > [ 41.705316] RIP: 0010:__vunmap+0x2a/0xc0 > [ 41.705318] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 > [ 41.705320] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 > [ 41.705322] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 > [ 41.705323] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff > [ 41.705324] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 > [ 41.705325] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 > [ 41.705326] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff > [ 41.705328] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 > [ 41.705329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 41.705330] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 > [ 41.705331] Call Trace: > [ 41.705338] vfree+0x50/0xb0 > [ 41.705341] ffs_user_copy_worker+0xe9/0x1c0 > [ 41.705344] process_one_work+0x19f/0x3e0 > [ 41.705348] worker_thread+0x3f/0x3b0 > [ 41.829766] kthread+0x12b/0x150 > [ 41.833371] ? process_one_work+0x3e0/0x3e0 > [ 41.838045] ? kthread_create_worker_on_cpu+0x70/0x70 > [ 41.843695] ret_from_fork+0x3a/0x50 > [ 41.847689] Modules linked in: hci_uart bluetooth ecdh_generic rfkill_gpio dwc3_pci dwc3 snd_usb_audio mei_me tpm_crb snd_usbmidi_lib xhci_pci xhci_hcd mei tpm snd_hwdep cfg80211 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core snd_hda_core videobuf2_dma_sg crlmodule > [ 41.876880] CR2: 0000000000000048 > [ 41.880584] ---[ end trace 2bc4addff0f2e673 ]--- > [ 41.891346] RIP: 0010:__vunmap+0x2a/0xc0 > [ 41.895734] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 > [ 41.916740] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 > [ 41.922583] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 > [ 41.930563] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff > [ 41.938540] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 > [ 41.946520] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 > [ 41.954502] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff > [ 41.962482] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 > [ 41.971536] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 41.977960] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 > [ 41.985930] Kernel panic - not syncing: Fatal exception > [ 41.991817] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) > [ 42.009525] Rebooting in 10 seconds.. > [ 52.014376] ACPI MEMORY or I/O RESET_REG. > > Fixes: 772a7a724f6 ("usb: gadget: f_fs: Allow scatter-gather buffers") > Signed-off-by: Fei Yang > Reviewed-by: Manu Gautam > Tested-by: John Stultz > --- > v2: add tag: "Fixes: 772a7a724f6 ......", Reviewed-by and Tested-by. > v3: check data for NULL instead of "ret == -EIOCBQUEUED", which would be safer > and keep the original logic intact. If it "fixes" a problem in 5.0, we should add a: Cc: stable to it as well. thanks, greg k-h