From: Mathias Nyman <mathias.nyman@intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jeffy Chen <jeffy.chen@rock-chips.com>
Cc: linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org
Subject: Re: [PATCH] xhci: Cancel cmd_timer before cleanup the command queue in xhci_hc_died()
Date: Wed, 1 Nov 2017 18:28:01 +0200 [thread overview]
Message-ID: <59F9F611.2050607@intel.com> (raw)
In-Reply-To: <20171101160336.GA22440@kroah.com>
On 01.11.2017 18:03, Greg Kroah-Hartman wrote:
> On Fri, Sep 29, 2017 at 05:12:47PM +0800, Jeffy Chen wrote:
>> When the cmd_timer fired, it would try to access the command struct.
>> So cancel it before cleanup the command queue in xhci_hc_died(), to
>> avoid use-after-free reported by KASAN:
>> [ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
>> [ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
>> ...
>> [ 177.180644] Freed by task 0:
>> [ 177.183882] kasan_slab_free+0x90/0x15c
>> [ 177.188194] kfree+0x114/0x28c
>> [ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8
>> [ 177.196916] xhci_hc_died+0x84/0x358
>>
>> Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
>> Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
>> ---
>
> Mathias, did you miss this one? Want me to queue it up?
>
There is a v2 of that patch already upstreamed.
d1aad52 xhci: Cleanup current_cmd in xhci_cleanup_command_queue()
https://marc.info/?l=linux-usb&m=150668331802206&w=2
A bit confusing as patch subject changed as well in v2
-Mathias
next prev parent reply other threads:[~2017-11-01 16:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-29 9:12 [PATCH] xhci: Cancel cmd_timer before cleanup the command queue in xhci_hc_died() Jeffy Chen
2017-11-01 16:03 ` Greg Kroah-Hartman
2017-11-01 16:28 ` Mathias Nyman [this message]
2017-11-01 16:39 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=59F9F611.2050607@intel.com \
--to=mathias.nyman@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=jeffy.chen@rock-chips.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.