linux/drivers/usb
Zhengjun Xing d850c16583 xhci: Fix kernel oops in trace_xhci_free_virt_device
commit 44a182b9d1 ("xhci: Fix use-after-free in xhci_free_virt_device")
set dev->udev pointer to NULL in xhci_free_dev(), it will cause kernel
panic in trace_xhci_free_virt_device. This patch reimplement the trace
function trace_xhci_free_virt_device, remove dev->udev dereference and
added more useful parameters to show in the trace function,it also makes
sure dev->udev is not NULL before calling trace_xhci_free_virt_device.
This issue happened when xhci-hcd trace is enabled and USB devices hot
plug test. Original use-after-free patch went to stable so this needs so
be applied there as well.

[ 1092.022457] usb 2-4: USB disconnect, device number 6
[ 1092.092772] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[ 1092.101694] PGD 0 P4D 0
[ 1092.104601] Oops: 0000 [#1] SMP
[ 1092.207734] Workqueue: usb_hub_wq hub_event
[ 1092.212507] RIP: 0010:trace_event_raw_event_xhci_log_virt_dev+0x6c/0xf0
[ 1092.220050] RSP: 0018:ffff8c252e883d28 EFLAGS: 00010086
[ 1092.226024] RAX: ffff8c24af86fa84 RBX: 0000000000000003 RCX: ffff8c25255c2a01
[ 1092.234130] RDX: 0000000000000000 RSI: 00000000aef55009 RDI: ffff8c252e883d28
[ 1092.242242] RBP: ffff8c252550e2c0 R08: ffff8c24af86fa84 R09: 0000000000000a70
[ 1092.250364] R10: 0000000000000a70 R11: 0000000000000000 R12: ffff8c251f21a000
[ 1092.258468] R13: 000000000000000c R14: ffff8c251f21a000 R15: ffff8c251f432f60
[ 1092.266572] FS:  0000000000000000(0000) GS:ffff8c252e880000(0000) knlGS:0000000000000000
[ 1092.275757] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1092.282281] CR2: 0000000000000000 CR3: 0000000154209001 CR4: 00000000003606e0
[ 1092.290384] Call Trace:
[ 1092.293156]  <IRQ>
[ 1092.295439]  xhci_free_virt_device.part.34+0x182/0x1a0
[ 1092.301288]  handle_cmd_completion+0x7ac/0xfa0
[ 1092.306336]  ? trace_event_raw_event_xhci_log_trb+0x6e/0xa0
[ 1092.312661]  xhci_irq+0x3e8/0x1f60
[ 1092.316524]  __handle_irq_event_percpu+0x75/0x180
[ 1092.321876]  handle_irq_event_percpu+0x20/0x50
[ 1092.326922]  handle_irq_event+0x36/0x60
[ 1092.331273]  handle_edge_irq+0x6d/0x180
[ 1092.335644]  handle_irq+0x16/0x20
[ 1092.339417]  do_IRQ+0x41/0xc0
[ 1092.342782]  common_interrupt+0xf/0xf
[ 1092.346955]  </IRQ>

Fixes: 44a182b9d1 ("xhci: Fix use-after-free in xhci_free_virt_device")
Cc: <stable@vger.kernel.org>
Signed-off-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-25 21:16:27 +08:00
..
atm USB: atm: fix up some remaining DEVICE_ATTR() usage 2018-01-24 08:49:52 +01:00
c67x00 USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
chipidea USB: chipidea: no need to check return value of debugfs_create functions 2018-05-31 12:54:22 +02:00
class usb: usbtmc: Remove rigol_quirk 2018-05-18 15:56:40 +02:00
common usb: common: Small class for USB role switches 2018-03-22 13:40:10 +01:00
core treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
dwc2 dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation 2018-06-19 12:48:14 +03:00
dwc3 usb: dwc3: qcom: mark PM functions as __maybe_unused 2018-06-19 12:48:12 +03:00
early usb: early: Correct the endpoint type value for bulk in endpoint 2017-12-07 16:03:15 +01:00
gadget usb: gadget: composite: fix delayed_status race condition when set_interface 2018-06-19 12:48:13 +03:00
host xhci: Fix kernel oops in trace_xhci_free_virt_device 2018-06-25 21:16:27 +08:00
image USB/PHY patches for 4.15-rc1 2017-11-13 21:14:07 -08:00
isp1760 usb: isp1760: Replace mdelay with msleep in isp1760_stop 2018-04-22 15:49:42 +02:00
misc treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
mon treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
mtu3 USB: mtu3: no need to check return value of debugfs_create_dir() 2018-05-31 12:54:21 +02:00
musb USB: musb: clean up debugfs file and directory creation 2018-05-31 12:54:21 +02:00
phy phy: tegra: select USB_COMMON 2018-05-31 12:50:40 +02:00
renesas_usbhs treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
roles usb: roles: intel_xhci: Enable runtime PM 2018-05-24 18:17:00 +02:00
serial treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
storage treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
typec USB: typec: fsusb302: no need to check return value of debugfs_create_dir() 2018-05-31 16:03:59 +02:00
usbip usbip: vhci_sysfs: fix potential Spectre v1 2018-05-24 18:14:28 +02:00
wusbcore treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
Kconfig usb: select USB_COMMON for usb role switch config 2018-04-22 15:23:37 +02:00
Makefile usb: roles: Add Intel xHCI USB role switch driver 2018-03-22 13:49:27 +01:00
README
usb-skeleton.c usb: usb-skeleton: make MODULE_LICENSE and SPDX tag match 2018-03-06 09:42:07 -08:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.