leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: xhci: Fix potential memory leak in xhci_disable_slot()

Browse Source 
xhci_disable_slot() allows the invoker to pass a command pointer
as paramenter. Otherwise, it will allocate one. This will cause
memory leak when a command structure was allocated inside of this
function while queuing command trb fails. Another problem comes up
when the invoker passed a command pointer, but xhci_disable_slot()
frees it when it detects a dead host.

This patch fixes these two problems by removing the command parameter
from xhci_disable_slot().

Fixes: f9e609b824 ("usb: xhci: Add helper function xhci_disable_slot().")
Cc: Guoqing Zhang <guoqing.zhang@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Lu Baolu 2017-10-05 11:21:41 +03:00 committed by Greg Kroah-Hartman
parent b64149ca01
commit cd3f1790b0
3 changed files with 11 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/host/xhci-hub.c
View File

@ -615,7 +615,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci,
if (!xhci->devs[i]) if (!xhci->devs[i])
continue; continue;
retval = xhci_disable_slot(xhci, NULL, i); retval = xhci_disable_slot(xhci, i);
if (retval) if (retval)
xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n",
i, retval); i, retval);

30
drivers/usb/host/xhci.c
View File

@ -3531,14 +3531,9 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
struct xhci_virt_device *virt_dev; struct xhci_virt_device *virt_dev;
struct xhci_slot_ctx *slot_ctx; struct xhci_slot_ctx *slot_ctx;
int i, ret; int i, ret;
struct xhci_command *command;
xhci_debugfs_remove_slot(xhci, udev->slot_id); xhci_debugfs_remove_slot(xhci, udev->slot_id);
command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
if (!command)
return;
#ifndef CONFIG_USB_DEFAULT_PERSIST #ifndef CONFIG_USB_DEFAULT_PERSIST
/* /*
* We called pm_runtime_get_noresume when the device was attached. * We called pm_runtime_get_noresume when the device was attached.
@ -3553,10 +3548,8 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
/* If the host is halted due to driver unload, we still need to free the /* If the host is halted due to driver unload, we still need to free the
* device. * device.
*/ */
if (ret <= 0 && ret != -ENODEV) { if (ret <= 0 && ret != -ENODEV)
kfree(command);
return; return;
}
virt_dev = xhci->devs[udev->slot_id]; virt_dev = xhci->devs[udev->slot_id];
slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx); slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
@ -3568,22 +3561,21 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
} }
xhci_disable_slot(xhci, command, udev->slot_id); xhci_disable_slot(xhci, udev->slot_id);
/* /*
* Event command completion handler will free any data structures * Event command completion handler will free any data structures
* associated with the slot. XXX Can free sleep? * associated with the slot. XXX Can free sleep?
*/ */
} }
int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command, int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
u32 slot_id)
{ {
struct xhci_command *command;
unsigned long flags; unsigned long flags;
u32 state; u32 state;
int ret = 0; int ret = 0;
if (!command) command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
if (!command) if (!command)
return -ENOMEM; return -ENOMEM;
@ -3602,7 +3594,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command,
slot_id); slot_id);
if (ret) { if (ret) {
spin_unlock_irqrestore(&xhci->lock, flags); spin_unlock_irqrestore(&xhci->lock, flags);
xhci_dbg(xhci, "FIXME: allocate a command ring segment\n"); kfree(command);
return ret; return ret;
} }
xhci_ring_cmd_db(xhci); xhci_ring_cmd_db(xhci);
@ -3677,6 +3669,8 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
return 0; return 0;
} }
xhci_free_command(xhci, command);
if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) { if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) {
spin_lock_irqsave(&xhci->lock, flags); spin_lock_irqsave(&xhci->lock, flags);
ret = xhci_reserve_host_control_ep_resources(xhci); ret = xhci_reserve_host_control_ep_resources(xhci);
@ -3714,18 +3708,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
pm_runtime_get_noresume(hcd->self.controller); pm_runtime_get_noresume(hcd->self.controller);
#endif #endif
xhci_free_command(xhci, command);
/* Is this a LS or FS device under a HS hub? */ /* Is this a LS or FS device under a HS hub? */
/* Hub or peripherial? */ /* Hub or peripherial? */
return 1; return 1;
disable_slot: disable_slot:
/* Disable slot, if we can do it without mem alloc */ return xhci_disable_slot(xhci, udev->slot_id);
kfree(command->completion);
command->completion = NULL;
command->status = 0;
return xhci_disable_slot(xhci, command, udev->slot_id);
} }
/* /*

3
drivers/usb/host/xhci.h
View File

@ -2019,8 +2019,7 @@ int xhci_run(struct usb_hcd *hcd);
int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
void xhci_init_driver(struct hc_driver *drv, void xhci_init_driver(struct hc_driver *drv,
const struct xhci_driver_overrides *over); const struct xhci_driver_overrides *over);
int xhci_disable_slot(struct xhci_hcd *xhci, int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id);
struct xhci_command *command, u32 slot_id);
int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup);
int xhci_resume(struct xhci_hcd *xhci, bool hibernated); int xhci_resume(struct xhci_hcd *xhci, bool hibernated);