linux-kernel - Re: [PATCH] xhci: solve a double free problem while doing s4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e6ca9524-67a6-1eef-a44f-b9a1acd5205c@linux.intel.com>
Date:   Thu, 10 Jun 2021 16:45:54 +0300
From:   Mathias Nyman <mathias.nyman@...ux.intel.com>
To:     "Zhangjiantao (Kirin, nanjing)" <water.zhangjiantao@...wei.com>,
        "Xuetao (kirin)" <xuetao09@...wei.com>,
        "mathias.nyman@...el.com" <mathias.nyman@...el.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     "chenyu (U)" <chenyu56@...wei.com>,
        Caiyadong <caiyadong@...wei.com>,
        xuhaiyang <xuhaiyang5@...ilicon.com>
Subject: Re: [PATCH] xhci: solve a double free problem while doing s4

On 9.6.2021 17.22, Zhangjiantao (Kirin, nanjing) wrote:
> when system is doing s4, the process of xhci_resume may be as below:
> 1、xhci_mem_cleanup
> 2、xhci_init->xhci_mem_init->xhci_mem_cleanup(when memory is not enough).
> xhci_mem_cleanup will be executed twice when system is out of memory.
> xhci->port_caps is freed in xhci_mem_cleanup,but it isn't set to NULL.
> It will be freed twice when xhci_mem_cleanup is called the second time.
> 

Thanks, nice catch

> We got following bug when system resumes from s4:
> 
> kernel BUG at mm/slub.c:309!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> CPU: 0 PID: 5929 Tainted: G S   W   5.4.96-arm64-desktop #1
> pc : __slab_free+0x5c/0x424
> lr : kfree+0x30c/0x32c
> 
> Call trace:
>  __slab_free+0x5c/0x424
>  kfree+0x30c/0x32c
>  xhci_mem_cleanup+0x394/0x3cc
>  xhci_mem_init+0x9ac/0x1070
>  xhci_init+0x8c/0x1d0
>  xhci_resume+0x1cc/0x5fc
>  xhci_plat_resume+0x64/0x70
>  platform_pm_thaw+0x28/0x60
>  dpm_run_callback+0x54/0x24c
>  device_resume+0xd0/0x200
>  async_resume+0x24/0x60
>  async_run_entry_fn+0x44/0x110
>  process_one_work+0x1f0/0x490
>  worker_thread+0x5c/0x450
>  kthread+0x158/0x160
>  ret_from_fork+0x10/0x24
> 
> Signed-off-by: Tao Xue <xuetao09@...wei.com>

Checkpatch complains:
ERROR: Missing Signed-off-by: line by nominal patch author 'Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@...wei.com>'

Is Zhangjiantao (Kirin, nanjing)  the correct author? If yes can I add 
"Signed-off-by: Zhangjiantao (Kirin, nanjing) <water.zhangjiantao@...wei.com>?

I'll add the stable and correct fixes tags for this.

Thanks
Mathias