linux/drivers/usb
Hans de Goede 90a646c770 usb: Do not allow usb_alloc_streams on unconfigured devices
This commit fixes the following oops:

[10238.622067] scsi host3: uas_eh_bus_reset_handler start
[10240.766164] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
[10245.779365] usb 3-4: device descriptor read/8, error -110
[10245.883331] usb 3-4: reset SuperSpeed USB device number 3 using xhci_hcd
[10250.897603] usb 3-4: device descriptor read/8, error -110
[10251.058200] BUG: unable to handle kernel NULL pointer dereference at  0000000000000040
[10251.058244] IP: [<ffffffff815ac6e1>] xhci_check_streams_endpoint+0x91/0x140
<snip>
[10251.059473] Call Trace:
[10251.059487]  [<ffffffff815aca6c>] xhci_calculate_streams_and_bitmask+0xbc/0x130
[10251.059520]  [<ffffffff815aeb5f>] xhci_alloc_streams+0x10f/0x5a0
[10251.059548]  [<ffffffff810a4685>] ? check_preempt_curr+0x75/0xa0
[10251.059575]  [<ffffffff810a46dc>] ? ttwu_do_wakeup+0x2c/0x100
[10251.059601]  [<ffffffff810a49e6>] ? ttwu_do_activate.constprop.111+0x66/0x70
[10251.059635]  [<ffffffff815779ab>] usb_alloc_streams+0xab/0xf0
[10251.059662]  [<ffffffffc0616b48>] uas_configure_endpoints+0x128/0x150 [uas]
[10251.059694]  [<ffffffffc0616bac>] uas_post_reset+0x3c/0xb0 [uas]
[10251.059722]  [<ffffffff815727d9>] usb_reset_device+0x1b9/0x2a0
[10251.059749]  [<ffffffffc0616f42>] uas_eh_bus_reset_handler+0xb2/0x190 [uas]
[10251.059781]  [<ffffffff81514293>] scsi_try_bus_reset+0x53/0x110
[10251.059808]  [<ffffffff815163b7>] scsi_eh_bus_reset+0xf7/0x270
<snip>

The problem is the following call sequence (simplified):

1) usb_reset_device
2)  usb_reset_and_verify_device
2)   hub_port_init
3)    hub_port_finish_reset
3)     xhci_discover_or_reset_device
        This frees xhci->devs[slot_id]->eps[ep_index].ring for all eps but 0
4)    usb_get_device_descriptor
       This fails
5)   hub_port_init fails
6)  usb_reset_and_verify_device fails, does not restore device config
7)  uas_post_reset
8)   xhci_alloc_streams
      NULL deref on the free-ed ring

This commit fixes this by not allowing usb_alloc_streams to continue if
the device is not configured.

Note that we do allow usb_free_streams to continue after a (logical)
disconnect, as it is necessary to explicitly free the streams at the xhci
controller level.

Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-03 15:26:15 -08:00
..
atm usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
c67x00 USB: c67x00: correct spelling mistakes in comments 2014-01-08 15:05:14 -08:00
chipidea usb: chipidea: Fix oops when removing the ci_hdrc module 2014-10-27 10:01:05 +08:00
class cdc-acm: ensure that termios get set when the port is activated 2014-11-03 15:26:15 -08:00
common usb: Add LED triggers for USB activity 2014-09-25 17:05:12 +02:00
core usb: Do not allow usb_alloc_streams on unconfigured devices 2014-11-03 15:26:15 -08:00
dwc2 usb: dwc2: gadget: disable phy before turning off power regulators 2014-10-23 13:58:51 -05:00
dwc3 usb: dwc3: gadget: Properly initialize LINK TRB 2014-10-23 13:57:24 -05:00
early
gadget usb: gadget: function: Fixed the return value on error path 2014-10-23 14:49:35 -05:00
host Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-10-08 21:40:54 -04:00
image USB: image: correct spelling mistake in comment 2014-01-08 15:08:14 -08:00
misc usb: rename phy to usb_phy in HCD 2014-09-29 11:52:59 -04:00
mon
musb usb: musb: musb_dsps: fix NULL pointer in suspend 2014-10-23 09:55:43 -05:00
phy USB: Remove .owner field for driver 2014-09-28 21:55:10 -04:00
renesas_usbhs usb: gadget: Refactor request completion 2014-09-25 16:58:50 +02:00
serial usb: serial: ftdi_sio: add "bricked" FTDI device PID 2014-10-23 09:52:57 +02:00
storage USB patches for 3.18-rc1 2014-10-08 06:47:31 -04:00
usbip usbip: remove struct usb_device_id table 2014-08-25 10:40:58 -07:00
wusbcore usb: hub: rename khubd to hub_wq in documentation and comments 2014-09-23 22:33:19 -07:00
Kconfig usb: Add LED triggers for USB activity 2014-09-25 17:05:12 +02:00
Makefile usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
README usb: hub: rename khubd to hub_wq in documentation and comments 2014-09-23 22:33:19 -07:00
usb-skeleton.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.