linux-kernel - Re: [RFT PATCH v2] xhci: Fix memory leak when caching protocol extended capability PSI tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a6eedbbf-ce9f-b9c8-beee-a9c941051aeb@linux.intel.com>
Date:   Wed, 12 Feb 2020 11:01:52 +0200
From:   Mathias Nyman <mathias.nyman@...ux.intel.com>
To:     Greg KH <gregkh@...uxfoundation.org>,
        Marek Szyprowski <m.szyprowski@...sung.com>
Cc:     pmenzel@...gen.mpg.de, mika.westerberg@...ux.intel.com,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-samsung-soc@...r.kernel.org, krzk@...nel.org,
        stable <stable@...r.kernel.org>
Subject: Re: [RFT PATCH v2] xhci: Fix memory leak when caching protocol
 extended capability PSI tables

On 11.2.2020 18.13, Greg KH wrote:
> On Tue, Feb 11, 2020 at 04:12:40PM +0100, Marek Szyprowski wrote:
>> Hi Mathias,
>>
>> On 11.02.2020 16:01, Mathias Nyman wrote:
>>> xhci driver assumed that xHC controllers have at most one custom
>>> supported speed table (PSI) for all usb 3.x ports.
>>> Memory was allocated for one PSI table under the xhci hub structure.
>>>
>>> Turns out this is not the case, some controllers have a separate
>>> "supported protocol capability" entry with a PSI table for each port.
>>> This means each usb3 roothub port can in theory support different custom
>>> speeds.
>>>
>>> To solve this, cache all supported protocol capabilities with their PSI
>>> tables in an array, and add pointers to the xhci port structure so that
>>> every port points to its capability entry in the array.
>>>
>>> When creating the SuperSpeedPlus USB Device Capability BOS descriptor
>>> for the xhci USB 3.1 roothub we for now will use only data from the
>>> first USB 3.1 capable protocol capability entry in the array.
>>> This could be improved later, this patch focuses resolving
>>> the memory leak.
>>>
>>> Reported-by: Paul Menzel <pmenzel@...gen.mpg.de>
>>> Reported-by: Sajja Venkateswara Rao <VenkateswaraRao.Sajja@....com>
>>> Fixes: 47189098f8be ("xhci: parse xhci protocol speed ID list for usb 3.1 usage")
>>> Cc: stable <stable@...r.kernel.org> # v4.4+
>>> Signed-off-by: Mathias Nyman <mathias.nyman@...ux.intel.com>
>>
>> Tested-by: Marek Szyprowski <m.szyprowski@...sung.com>
> 
> Nice!
> 
> Should I revert the first and then apply this?
> 

Yes, please

Thanks

-Mathias