linux-kernel - Re: [PATCH] usb: gadget: composite: Fix null pointer exception

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 1 Nov 2021 21:18:49 +0800
From:   Peter Chen <peter.chen@...nel.org>
To:     Qihang Hu <huqihang@...o.com>
Cc:     balbi@...nel.org, gregkh@...uxfoundation.org,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: gadget: composite: Fix null pointer exception

On 21-11-01 09:57:57, Qihang Hu wrote:
> In the config_ep_by_speed_and_alt function, select the corresponding
> descriptor through g->speed, but the interface driver

function driver

> may not
> support the corresponding speed. So, we need to check whether the
> interface driver provides the corresponding speed descriptor when
> selecting the descriptor.
> 
> [  237.708146]  android_work: sent uevent USB_STATE=CONNECTED
> [  237.712464]  kconfigfs-gadget gadget: super-speed config #1: b
> [  237.712487]  kUnable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> [  237.712493]  kMem abort info:
> [  237.712498]  k  ESR = 0x96000006
> [  237.712504]  k  EC = 0x25: DABT (current EL), IL = 32 bits
> [  237.712510]  k  SET = 0, FnV = 0
> [  237.712515]  k  EA = 0, S1PTW = 0
> [  237.712520]  kData abort info:
> [  237.712525]  k  ISV = 0, ISS = 0x00000006
> [  237.712530]  k  CM = 0, WnR = 0
> [  237.712536]  kuser pgtable: 4k pages, 39-bit VAs, pgdp=000000020ef29000
> [  237.712541]  k[0000000000000000] pgd=000000020ef2a003, pud=000000020ef2a003, pmd=0000000000000000
> [  237.712554]  kInternal error: Oops: 96000006 [#1] PREEMPT SMP
> [  237.722067]  kSkip md ftrace buffer dump for: 0x1609e0
> [  237.787037]  kWorkqueue: dwc_wq dwc3_bh_work.cfi_jt
> [  237.854922]  kpstate: 60c00085 (nZCv daIf +PAN +UAO)
> [  237.863165]  kpc : config_ep_by_speed_and_alt+0x90/0x308
> [  237.871766]  klr : audio_set_alt+0x54/0x78
> [  237.879108]  ksp : ffffffc0104839e0
> 
> Signed-off-by: Qihang Hu <huqihang@...o.com>
> ---
>  drivers/usb/gadget/composite.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
> index 72a9797dbbae..443a65af98af 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -166,21 +166,21 @@ int config_ep_by_speed_and_alt(struct usb_gadget *g,
>  	/* select desired speed */
>  	switch (g->speed) {
>  	case USB_SPEED_SUPER_PLUS:
> -		if (gadget_is_superspeed_plus(g)) {
> +		if (gadget_is_superspeed_plus(g) && f->ssp_descriptors) {
>  			speed_desc = f->ssp_descriptors;
>  			want_comp_desc = 1;
>  			break;
>  		}
>  		fallthrough;
>  	case USB_SPEED_SUPER:
> -		if (gadget_is_superspeed(g)) {
> +		if (gadget_is_superspeed(g) && f->ss_descriptors) {
>  			speed_desc = f->ss_descriptors;
>  			want_comp_desc = 1;
>  			break;
>  		}
>  		fallthrough;
>  	case USB_SPEED_HIGH:
> -		if (gadget_is_dualspeed(g)) {
> +		if (gadget_is_dualspeed(g) && f->hs_descriptors) {
>  			speed_desc = f->hs_descriptors;
>  			break;
>  		}
> -- 
> 2.25.1
> 

Besides your fix, you may show an warning that said "the function
doesn't hold the descriptors for supported speed, using the default (FS)
descriptors". See below kernel doc for detail.

/**
 * config_ep_by_speed_and_alt() - configures the given endpoint
 *
 * ....
 * Note: the supplied function should hold all the descriptors
 * for supported speeds
 */

What's more, you may fix android f_audio_source.c, and let it support
super speed and super speed plus.

-- 

Thanks,
Peter Chen