From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B17DFC197A0 for ; Mon, 20 Nov 2023 15:32:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234163AbjKTPcV (ORCPT ); Mon, 20 Nov 2023 10:32:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54602 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234137AbjKTPcO (ORCPT ); Mon, 20 Nov 2023 10:32:14 -0500 Received: from mgamail.intel.com (mgamail.intel.com [192.55.52.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9495DC8; Mon, 20 Nov 2023 07:32:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1700494330; x=1732030330; h=message-id:date:mime-version:to:cc:references:from: subject:in-reply-to:content-transfer-encoding; bh=yzidrUEMCUcbFArGAxx+rdrshE4gppTFAhlR8SrrLjA=; b=WuYOW1vF4qVKdsSZjGzkvpRblDOvmfnXcqQ+1UkGPpqkyEByuConDx+0 TF3oDQmGijhPLKd15tejBVH8cIV7F1LgPmjLZ8rnNkqD5QlkjTD0jvpnI XYMOa8w9jQMf2Jrbuh8NgcgxLcEK56660NY+sL55twSBqgg9tkUoOeua1 DjdiSonQV52VCzbpLw1VeNlaUlTNCYujoVnOVk2VG5ETSLHL+fGO4Yjbd pR+aGNxLau5AEKZktP7cbHS1foZMIvPq/ssZZ6BcQW/6/sG9t9I0kZ7Uh q1woaSffJhe4R4x6eEqxmluuWWrub+mXvb8MKuJN+wvJYMzGQPdxhMD8A g==; X-IronPort-AV: E=McAfee;i="6600,9927,10900"; a="371815232" X-IronPort-AV: E=Sophos;i="6.04,214,1695711600"; d="scan'208";a="371815232" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Nov 2023 07:32:10 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10900"; a="836760404" X-IronPort-AV: E=Sophos;i="6.04,214,1695711600"; d="scan'208";a="836760404" Received: from mattu-haswell.fi.intel.com (HELO [10.237.72.199]) ([10.237.72.199]) by fmsmga004.fm.intel.com with ESMTP; 20 Nov 2023 07:32:08 -0800 Message-ID: Date: Mon, 20 Nov 2023 17:33:23 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Thunderbird/102.13.0 Content-Language: en-US To: Kuen-Han Tsai Cc: mathias.nyman@intel.com, gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, alan Stern References: <20231117072131.2886406-1-khtsai@google.com> From: Mathias Nyman Subject: Re: [PATCH] xhci: fix null pointer deref for xhci_urb_enqueue In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 18.11.2023 12.19, Kuen-Han Tsai wrote: > Hi Mathias > >>> if (usb_endpoint_xfer_isoc(&urb->ep->desc)) >>> @@ -1552,8 +1561,10 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag >>> num_tds = 1; >>> >>> urb_priv = kzalloc(struct_size(urb_priv, td, num_tds), mem_flags); >> kzalloc with spinlock held, should preferably be moved outside lock, otherwise should use GFP_ATOMIC > > Thanks for pointing this out. I realize this patch is incorrect and it > is non-ideal to include many codes unrelated to xhci->devs[slot_id] > within the lock. > >> xhci_check_maxpacket() called here can't be called with spinlock held > > It appears that xhci_check_maxpacket() might potentially lead to a > deadlock later if a spinlock is held. Is this the concern you were > referring to? If not, please let me know if there are any other > potential issues that I may have missed, thanks! xhci_check_maxpacket() will allocate memory, wait for completion, and use the same lock, so there are several issues here. I actually think we shouldn't call xhci_check_maxpacket() at all while queuing urbs. usb core knows when there was max packet size mismatch during enumeration. I think we should add a hook to the hcd that usb core can call in these cases Thanks Mathias