linux-kernel - Re: 答复: [PATCH] USB:Fix kernel NULL pointer when unbind UHCI form vfio-pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200723084131.GA1753458@kroah.com>
Date:   Thu, 23 Jul 2020 10:41:31 +0200
From:   "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
To:     WeitaoWang-oc <WeitaoWang-oc@...oxin.com>
Cc:     Alex Williamson <alex.williamson@...hat.com>,
        "mathias.nyman@...ux.intel.com" <mathias.nyman@...ux.intel.com>,
        "ulf.hansson@...aro.org" <ulf.hansson@...aro.org>,
        "vkoul@...nel.org" <vkoul@...nel.org>,
        "hslester96@...il.com" <hslester96@...il.com>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Carsten_Schmid@...tor.com" <Carsten_Schmid@...tor.com>,
        "efremov@...ux.com" <efremov@...ux.com>,
        "Tony W. Wang(XA-RD)" <TonyWWang@...oxin.com>,
        "Cobe Chen(BJ-RD)" <CobeChen@...oxin.com>,
        "Tim Guo(BJ-RD)" <TimGuo@...oxin.com>,
        "wwt8723@....com" <wwt8723@....com>
Subject: Re: 答复: [PATCH] USB:Fix kernel
 NULL pointer when unbind UHCI form vfio-pci

On Thu, Jul 23, 2020 at 08:36:25AM +0000, WeitaoWang-oc wrote:
> 
> On Thu,23 July 2020 04:18:00 +0000 Alex wrote:
> > On Wed, 22 Jul 2020 19:57:48 +0800
> > WeitaoWangoc <WeitaoWang-oc@...oxin.com> wrote:
> > 
> > >  drivers/usb/core/hcd-pci.c | 5 +++++
> > >  1 file changed, 5 insertions(+)
> > >
> > > diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
> > > index 1547aa6..484f2a0 100644
> > > --- a/drivers/usb/core/hcd-pci.c
> > > +++ b/drivers/usb/core/hcd-pci.c
> > > @@ -34,6 +34,7 @@ static DECLARE_RWSEM(companions_rwsem);
> > >  #define CL_OHCI                PCI_CLASS_SERIAL_USB_OHCI
> > >  #define CL_EHCI                PCI_CLASS_SERIAL_USB_EHCI
> > >
> > > +#define PCI_DEV_DRV_FLAG       2
> > >  static inline int is_ohci_or_uhci(struct pci_dev *pdev)  {
> > >         return pdev->class == CL_OHCI || pdev->class == CL_UHCI; @@
> > > -68,6 +69,8 @@ static void for_each_companion(struct pci_dev *pdev, struct
> > usb_hcd *hcd,
> > >                 if (companion->class != CL_UHCI && companion->class !=
> > CL_OHCI &&
> > >                                 companion->class != CL_EHCI)
> > >                         continue;
> > > +               if (!(companion->priv_flags & PCI_DEV_DRV_FLAG))
> > 
> > But pci_dev.priv_flags is private data for the driver that currently
> > owns the device, which could be vfio-pci.  This is really no different
> > than assuming the structure at device.driver_data.  If vfio-pci were to
> > make legitimate use of pci_dev.priv_flags, this could simply blow up
> > again.  Should there instead be some sort of registration interface
> > where hcd complaint drivers register their devices and only those
> > registered devices can have their driver private data arbitrarily poked
> > by another driver?  Thanks,
> 
> Thanks for your explanation. Set pci_dev.priv_flags is really not a 
> reasonable approach. Are there any more detailed suggestions 
> to patch this issue?

This is not a kernel issue, it is a "do not do this in this way from
userspace" issue :)

thanks,

greg k-h