linux-kernel - Re: [RFT PATCH v2] xhci: Fix memory leak when caching protocol extended capability PSI tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Feb 2020 09:47:52 +0200
From:   Mathias Nyman <mathias.nyman@...ux.intel.com>
To:     Jon Hunter <jonathanh@...dia.com>, gregkh@...uxfoundation.org,
        m.szyprowski@...sung.com
Cc:     pmenzel@...gen.mpg.de, mika.westerberg@...ux.intel.com,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-samsung-soc@...r.kernel.org, krzk@...nel.org,
        stable <stable@...r.kernel.org>,
        linux-tegra <linux-tegra@...r.kernel.org>
Subject: Re: [RFT PATCH v2] xhci: Fix memory leak when caching protocol
 extended capability PSI tables

On 13.2.2020 15.33, Jon Hunter wrote:
> 
> On 11/02/2020 15:01, Mathias Nyman wrote:
>> xhci driver assumed that xHC controllers have at most one custom
>> supported speed table (PSI) for all usb 3.x ports.
>> Memory was allocated for one PSI table under the xhci hub structure.
>>
>> Turns out this is not the case, some controllers have a separate
>> "supported protocol capability" entry with a PSI table for each port.
>> This means each usb3 roothub port can in theory support different custom
>> speeds.
>>
>> To solve this, cache all supported protocol capabilities with their PSI
>> tables in an array, and add pointers to the xhci port structure so that
>> every port points to its capability entry in the array.
>>
>> When creating the SuperSpeedPlus USB Device Capability BOS descriptor
>> for the xhci USB 3.1 roothub we for now will use only data from the
>> first USB 3.1 capable protocol capability entry in the array.
>> This could be improved later, this patch focuses resolving
>> the memory leak.
>>
>> Reported-by: Paul Menzel <pmenzel@...gen.mpg.de>
>> Reported-by: Sajja Venkateswara Rao <VenkateswaraRao.Sajja@....com>
>> Fixes: 47189098f8be ("xhci: parse xhci protocol speed ID list for usb 3.1 usage")
>> Cc: stable <stable@...r.kernel.org> # v4.4+
>> Signed-off-by: Mathias Nyman <mathias.nyman@...ux.intel.com>
> 
> 
> Since next-20200211, we have been observing a regression exiting suspend
> on our Tegra124 Jetson TK1 board. Bisect is pointing to this commit and
> reverting on top of -next fixes the problem.
> 
> On exiting suspend, I am seeing the following ...
> 
> [   56.216793] tegra-xusb 70090000.usb: Firmware already loaded, Falcon state 0x20
> [   56.216834] usb usb3: root hub lost power or was reset
> [   56.216837] usb usb4: root hub lost power or was reset
> [   56.217760] tegra-xusb 70090000.usb: No ports on the roothubs?
> [   56.218257] tegra-xusb 70090000.usb: failed to resume XHCI: -12
> [   56.218299] PM: dpm_run_callback(): platform_pm_resume+0x0/0x40 returns -12
> [   56.218312] PM: Device 70090000.usb failed to resume: error -12
> [   56.334366] hub 4-0:1.0: hub_ext_port_status failed (err = -32)
> [   56.334368] hub 3-0:1.0: hub_ext_port_status failed (err = -32)
> 
> Let me know if you have any thoughts on this.
> 
> Cheers
> Jon

This was an issue with the first version, and should be fixed in the second.

next-20200211 has the faulty version, 
next-20200213 is fixed, reverted first version and applied second.

Does next-20200213 work for you?

-Mathias