From: Felipe Balbi <felipe.balbi@linux.intel.com>
To: Mathias Nyman <mathias.nyman@linux.intel.com>, linux@roeck-us.net
Cc: linux-usb@vger.kernel.org,
Mathias Nyman <mathias.nyman@linux.intel.com>,
stable@vger.kernel.org
Subject: Re: [RFT PATCH 1/1] xhci: free xhci virtual devices with leaf nodes first
Date: Thu, 24 Nov 2016 11:02:29 +0200 [thread overview]
Message-ID: <8760ndqmhm.fsf@linux.intel.com> (raw)
In-Reply-To: <1479903867-561-1-git-send-email-mathias.nyman@linux.intel.com>
[-- Attachment #1: Type: text/plain, Size: 3052 bytes --]
Hi,
Mathias Nyman <mathias.nyman@linux.intel.com> writes:
> the tt_info provided by a HS hub might be in use to by a child device
> Make sure we free the devices in the correct order.
>
> This is needed in special cases such as when xhci controller is
> reset when resuming from hibernate, and all virt_devices are freed.
>
> Also free the virt_devices starting from max slot_id as children
> more commonly have higher slot_id than parent.
>
> CC: <stable@vger.kernel.org>
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
>
> ---
>
> Guenter Roeck, does this work for you?
>
> A rework of how tt_info is stored and used might be needed,
> but that will take some time and won't go to stable as easily.
> ---
> drivers/usb/host/xhci-mem.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index 6afe323..b3a5cd8 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -979,6 +979,40 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
> xhci->devs[slot_id] = NULL;
> }
>
> +/*
> + * Free a virt_device structure.
> + * If the virt_device added a tt_info (a hub) and has children pointing to
> + * that tt_info, then free the child first. Recursive.
> + * We can't rely on udev at this point to find child-parent relationships.
> + */
> +void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
> +{
> + struct xhci_virt_device *vdev;
> + struct list_head *tt_list_head;
> + struct xhci_tt_bw_info *tt_info, *next;
> + int i;
> +
> + vdev = xhci->devs[slot_id];
> + if (!vdev)
> + return;
> +
> + tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
> + list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
> + /* is this a hub device that added a tt_info to the tts list */
> + if (tt_info->slot_id == slot_id) {
if (tt_info->slot_id != slot_id)
continue;
> + /* are any devices using this tt_info? */
> + for (i = 1; i < HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
off-by-one here ? Why is i starting from 1?
> + vdev = xhci->devs[i];
> + if (vdev && (vdev->tt_info == tt_info))
if (!vdev || vdev->tt_info != tt_info)
continue;
> + xhci_free_virt_devices_depth_first(
> + xhci, i);
> + }
> + }
> + }
> + /* we are now at a leaf device */
> + xhci_free_virt_device(xhci, slot_id);
> +}
> +
> int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
> struct usb_device *udev, gfp_t flags)
> {
> @@ -1829,8 +1863,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
> }
> }
>
> - for (i = 1; i < MAX_HC_SLOTS; ++i)
> - xhci_free_virt_device(xhci, i);
> + for (i = HCS_MAX_SLOTS(xhci->hcs_params1); i > 0; i--)
converting MAX_HC_SLOTS to HCS_MAX_SLOTS(xhci->hcs_params1) seems
unrelated to $subject. Perhaps just mention on commit log?
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
next prev parent reply other threads:[~2016-11-24 9:04 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-15 20:36 [RFC PATCH] xhci: Fix memory use after free in xhci_free_virt_device Guenter Roeck
2016-11-17 15:11 ` Mathias Nyman
2016-11-23 12:24 ` [RFT PATCH 1/1] xhci: free xhci virtual devices with leaf nodes first Mathias Nyman
2016-11-23 13:32 ` Guenter Roeck
2016-11-23 14:44 ` Mathias Nyman
2016-11-24 9:02 ` Felipe Balbi [this message]
2016-11-24 9:57 ` Mathias Nyman
2016-11-24 11:03 ` Felipe Balbi
2016-11-24 12:07 ` Mathias Nyman
2016-11-24 19:58 ` Guenter Roeck
2016-11-28 20:24 ` Guenter Roeck
2016-11-30 11:41 ` Mathias Nyman
2016-12-09 21:28 ` Guenter Roeck
2016-12-12 13:50 ` Mathias Nyman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8760ndqmhm.fsf@linux.intel.com \
--to=felipe.balbi@linux.intel.com \
--cc=linux-usb@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=mathias.nyman@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.