From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753142AbcIFBuy (ORCPT ); Mon, 5 Sep 2016 21:50:54 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:35761 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751324AbcIFBuw (ORCPT ); Mon, 5 Sep 2016 21:50:52 -0400 Date: Tue, 6 Sep 2016 09:50:49 +0800 From: Peter Chen To: Clemens Gruber Cc: linux-usb@vger.kernel.org, Peter Chen , Greg Kroah-Hartman , linux-kernel@vger.kernel.org Subject: Re: [PATCH] usb: chipidea: udc: fix NULL ptr dereference in isr_setup_status_phase Message-ID: <20160906015049.GD24593@b29397-desktop> References: <20160905172958.8758-1-clemens.gruber@pqgruber.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160905172958.8758-1-clemens.gruber@pqgruber.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Sep 05, 2016 at 07:29:58PM +0200, Clemens Gruber wrote: > Problems with the signal integrity of the high speed USB data lines or > noise on reference ground lines can cause the i.MX6 USB controller to > violate USB specs and exhibit unexpected behavior. > > It was observed that USBi_UI interrupts were triggered first and when > isr_setup_status_phase was called, ci->status was NULL, which lead to a > NULL pointer dereference kernel panic. > > This patch fixes the kernel panic, emits a warning once and returns > -EPIPE to halt the device and let the host get stalled. > It also adds a comment to point people, who are experiencing this issue, > to their USB hardware design. > > Signed-off-by: Clemens Gruber > --- > drivers/usb/chipidea/udc.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c > index dfec5a1..b933568 100644 > --- a/drivers/usb/chipidea/udc.c > +++ b/drivers/usb/chipidea/udc.c > @@ -949,6 +949,15 @@ static int isr_setup_status_phase(struct ci_hdrc *ci) > int retval; > struct ci_hw_ep *hwep; > > + /* > + * Unexpected USB controller behavior, caused by bad signal integrity > + * or ground reference problems, can lead to isr_setup_status_phase > + * being called with ci->status equal to NULL. > + * If this situation occurs, you should review your USB hardware design. > + */ > + if (WARN_ON_ONCE(!ci->status)) > + return -EPIPE; > + > hwep = (ci->ep0_dir == TX) ? ci->ep0out : ci->ep0in; > ci->status->context = ci; > ci->status->complete = isr_setup_status_complete; Thanks, I will apply it. -- Best Regards, Peter Chen