openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity
linux/drivers
History
Nicolai Stange 7222c83225 usb/core: usb_alloc_dev(): fix setting of ->portnum 
With commit 69bec72598 ("USB: core: let USB device know device node"),
the port1 argument of usb_alloc_dev() gets overwritten as follows:

  ... usb_alloc_dev(..., unsigned port1)
  {
    ...
    if (!parent->parent) {
      port1 = usb_hcd_find_raw_port_number(..., port1);
    }
    ...
  }

Later on, this now overwritten port1 gets assigned to ->portnum:

  dev->portnum = port1;

However, since xhci_find_raw_port_number() isn't idempotent, the
aforementioned commit causes a number of KASAN splats like the following:

  BUG: KASAN: slab-out-of-bounds in xhci_find_raw_port_number+0x98/0x170
                                       at addr ffff8801d9311670
  Read of size 8 by task kworker/2:1/87
  [...]
  Workqueue: usb_hub_wq hub_event
   0000000000000188 000000005814b877 ffff8800cba17588 ffffffff8191447e
   0000000041b58ab3 ffffffff82a03209 ffffffff819143a2 ffffffff82a252f4
   ffff8801d93115e0 0000000000000188 ffff8801d9311628 ffff8800cba17588
  Call Trace:
   [<ffffffff8191447e>] dump_stack+0xdc/0x15e
   [<ffffffff819143a2>] ? _atomic_dec_and_lock+0xa2/0xa2
   [<ffffffff814e2cd1>] ? print_section+0x61/0xb0
   [<ffffffff814e4939>] print_trailer+0x179/0x2c0
   [<ffffffff814f0d84>] object_err+0x34/0x40
   [<ffffffff814f4388>] kasan_report_error+0x2f8/0x8b0
   [<ffffffff814eb91e>] ? __slab_alloc+0x5e/0x90
   [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130
   [<ffffffff814f5091>] kasan_report+0x71/0xa0
   [<ffffffff814ec082>] ? kmem_cache_alloc_trace+0x212/0x560
   [<ffffffff81d99468>] ? xhci_find_raw_port_number+0x98/0x170
   [<ffffffff814f33d4>] __asan_load8+0x64/0x70
   [<ffffffff81d99468>] xhci_find_raw_port_number+0x98/0x170
   [<ffffffff81db0105>] xhci_setup_addressable_virt_dev+0x235/0xa10
   [<ffffffff81d9ea51>] xhci_setup_device+0x3c1/0x1430
   [<ffffffff8121cddd>] ? trace_hardirqs_on+0xd/0x10
   [<ffffffff81d9fac0>] ? xhci_setup_device+0x1430/0x1430
   [<ffffffff81d9fad3>] xhci_address_device+0x13/0x20
   [<ffffffff81d2081a>] hub_port_init+0x55a/0x1550
   [<ffffffff81d28705>] hub_event+0xef5/0x24d0
   [<ffffffff81d27810>] ? hub_port_debounce+0x2f0/0x2f0
   [<ffffffff8195e1ee>] ? debug_object_deactivate+0x1be/0x270
   [<ffffffff81210203>] ? print_rt_rq+0x53/0x2d0
   [<ffffffff8121657d>] ? trace_hardirqs_off+0xd/0x10
   [<ffffffff8226acfb>] ? _raw_spin_unlock_irqrestore+0x5b/0x60
   [<ffffffff81250000>] ? irq_domain_set_hwirq_and_chip+0x30/0xb0
   [<ffffffff81256339>] ? debug_lockdep_rcu_enabled+0x39/0x40
   [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130
   [<ffffffff81196877>] process_one_work+0x567/0xec0
  [...]

Afterwards, xhci reports some functional errors:

  xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
                                code 0x11.
  xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
                                code 0x11.
  usb 4-3: device not accepting address 2, error -22

Fix this by not overwriting the port1 argument in usb_alloc_dev(), but
storing the raw port number as required by OF in an additional variable,
raw_port.

Fixes: 69bec72598 ("USB: core: let USB device know device node")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2016-03-18 09:19:02 -07:00
..
accessibility
…
acpi libnvdimm for 4.6 2016-03-16 17:45:56 -07:00
amba
…
android Merge 4.5-rc6 into char-misc-next 2016-03-01 16:38:16 -08:00
ata PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
atm
…
auxdisplay
…
base Char/Misc patches for 4.6-rc1 2016-03-17 13:47:50 -07:00
bcma GPIO bulk updates for the v4.5 kernel cycle: 2016-01-17 12:32:01 -08:00
block Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-17 11:22:54 -07:00
bluetooth
…
bus vexpress fixes for v4.5 2016-02-01 12:27:18 -08:00
cdrom
…
char TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
clk clk: ti: omap3+: dpll: use non-locking version of clk_get_rate 2016-02-22 14:03:02 -08:00
clocksource One of the largest releases for KVM... Hardly any generic improvement, 2016-03-16 09:55:35 -07:00
connector
…
cpufreq Merge branch 'pm-cpufreq' 2016-03-14 14:22:03 +01:00
cpuidle cpuidle: menu: help gcc generate slightly better code 2016-02-17 00:28:15 +01:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-17 11:22:54 -07:00
dca
…
devfreq PM / devfreq: tegra: Set freq in rate callback 2016-02-23 14:27:42 +09:00
dio
…
dma dmaengine updates for 4.6 2016-03-17 12:34:54 -07:00
dma-buf
…
edac EDAC queue for 4.6 2016-03-16 08:36:55 -07:00
eisa
…
extcon extcon: palmas: Drop IRQF_EARLY_RESUME flag 2016-02-29 11:07:34 +09:00
firewire
…
firmware Driver core patches for 4.6-rc1 2016-03-17 13:38:00 -07:00
fmc
…
fpga
…
gpio gpio: rcar: Add Runtime PM handling for interrupts 2016-02-25 15:46:27 +01:00
gpu PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
hid asm-generic changes for 4.5 2016-01-20 17:30:20 -08:00
hsi HSI: ssi-protocol: Use handshake logic from n950 2016-01-28 17:47:56 +01:00
hv Char/Misc patches for 4.6-rc1 2016-03-17 13:47:50 -07:00
hwmon hwmon: Create an NSA320 hardware monitoring driver 2016-03-08 18:40:49 -08:00
hwspinlock drivers/hwspinlock: fix race between radix tree insertion and lookup 2016-02-03 08:28:43 -08:00
hwtracing drivers/hwtracing: make coresight-etm-perf.c explicitly non-modular 2016-03-05 12:19:39 -08:00
i2c i2c: designware: Add device HID for future AMD I2C controller 2016-03-10 21:34:47 +01:00
ide PCI: Remove includes of asm/pci-bridge.h 2016-02-05 16:29:28 -06:00
idle
…
iio Second set of IIO fixes for the 4.5 cycle. These ones are mostly 2016-02-01 13:08:26 -08:00
infiniband Additional 4.5-rc6 fixes 2016-03-04 18:06:49 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2016-02-10 12:21:57 -08:00
iommu iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path 2016-02-29 23:55:16 +01:00
ipack
…
irqchip irqchip/irq-alpine-msi: Release the correct domain on error 2016-03-11 10:06:55 +01:00
isdn TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
leds leds: triggers: simplify led_trigger_store 2016-03-14 09:22:23 +01:00
lguest
…
lightnvm lightnvm: allow to force mm initialization 2016-02-04 09:19:45 -07:00
macintosh PCI: Remove includes of asm/pci-bridge.h 2016-02-05 16:29:28 -06:00
mailbox Merge branches 'acpi-processor' and 'acpi-cppc' 2016-03-14 14:20:33 +01:00
mcb
…
md Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-17 11:22:54 -07:00
media media updates for v4.6-rc1 2016-03-16 18:27:32 -07:00
memory ARM: SoC driver updates for v4.5 2016-01-20 18:42:30 -08:00
memstick memstick: use sector_div instead of do_div 2016-01-20 17:09:18 -08:00
message mptbase: fixup error handling paths in mpt_attach() 2016-02-23 21:27:02 -05:00
mfd RTC for 4.6 2016-03-15 21:58:58 -07:00
misc Char/Misc patches for 4.6-rc1 2016-03-17 13:47:50 -07:00
mmc TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
mtd Late MTD fix for v4.5: 2016-03-11 16:34:18 -08:00
net TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
nfc nfc: s3fwrn5: Use shash 2016-01-27 20:36:09 +08:00
ntb NTB: Fix macro parameter conflict with field name 2016-01-21 19:53:10 -05:00
nubus
…
nvdimm Merge branch 'for-4.6/pfn' into libnvdimm-for-next 2016-03-09 17:15:43 -08:00
nvme nvme: fix max_segments integer truncation 2016-03-03 14:43:10 -07:00
nvmem nvmem: mediatek: Fix later provider initialization 2016-03-05 12:20:29 -08:00
of TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
oprofile wrappers for ->i_mutex access 2016-01-22 18:04:28 -05:00
parisc PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
parport
…
pci PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
pcmcia
…
perf
…
phy phy: for 4.6 2016-03-05 12:22:41 -08:00
pinctrl pinctrl: single: Use a separate lockdep class 2016-03-11 23:03:06 +07:00
platform goldfish: Fix build error of missing ioremap on UM 2016-03-05 12:33:58 -08:00
pnp PNP / ACPI: add ACPI_RESOURCE_TYPE_SERIAL_BUS as a valid type 2016-03-09 23:50:55 +01:00
power power supply and reset changes for the v4.6 series 2016-03-17 12:50:55 -07:00
powercap powercap/rapl: track lead cpu per package 2016-03-09 00:26:44 +01:00
pps
…
ps3
…
ptp Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-15 12:13:56 -07:00
pwm pwm: Mark all devices as "might sleep" 2016-01-21 15:04:59 +01:00
rapidio drivers: Initialize resource entry to zero 2016-01-30 09:49:58 +01:00
ras
…
regulator Merge remote-tracking branches 'regulator/topic/s5m8767' and 'regulator/topic/vexpress' into regulator-next 2016-03-13 15:20:14 +07:00
remoteproc remoteproc: Supply controller driver for ST's Remote Processors 2016-01-29 17:26:49 -08:00
reset
…
rpmsg
…
rtc rtc: pcf2127: add pcf2129 device id 2016-03-14 17:08:41 +01:00
s390 TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
sbus
…
scsi Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-17 11:22:54 -07:00
sfi
…
sh Linux 4.5-rc6 2016-03-04 12:12:08 +01:00
sn
…
soc ARM: SoC support for Tegra platforms for v4.5 2016-01-22 17:30:52 -08:00
spi dmaengine updates for 4.6 2016-03-17 12:34:54 -07:00
spmi spmi: pmic-arb: Support more than 128 peripherals 2016-02-08 14:57:30 -08:00
ssb ssb: host_soc depends on sprom 2016-02-26 12:47:32 +02:00
staging TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
target Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-17 11:22:54 -07:00
tc
…
thermal thermal: cpu_cooling: fix out of bounds access in time_in_idle 2016-02-11 07:13:29 -08:00
thunderbolt
…
tty serial: 8250: describe CONFIG_SERIAL_8250_RSA 2016-03-07 16:11:14 -08:00
uio
…
usb usb/core: usb_alloc_dev(): fix setting of ->portnum 2016-03-18 09:19:02 -07:00
uwb
…
vfio VFIO updates for v4.6-rc1 2016-03-17 13:05:09 -07:00
vhost vhost: fix error path in vhost_init_used() 2016-03-02 17:01:49 +02:00
video fbdev changes for 4.6 2016-03-16 18:37:20 -07:00
virt
…
virtio PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
vlynq
…
vme vme: vme_ca91cx42.c: use to_pci_dev() 2016-02-07 23:17:59 -08:00
w1 w1: w1_process() is not freezable kthread 2016-02-11 19:23:28 -08:00
watchdog Become maintainer, add hardening tests for use-after-free and atomic wrapping. 2016-03-01 16:51:19 -08:00
xen xen_balloon: support memory auto onlining policy 2016-03-15 16:55:16 -07:00
zorro zorro: Use kobj_to_dev() 2016-01-25 09:42:23 +01:00
Kconfig
…
Makefile
…