linux-kernel - Re: [PATCH] usb: xhci: Check for xhci->interrupters being allocated in xhci_mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d3f16547-80db-48a8-9a6c-7eaf26da9ece@linux.intel.com>
Date: Mon, 5 Aug 2024 11:23:03 +0300
From: Mathias Nyman <mathias.nyman@...ux.intel.com>
To: Marc Zyngier <maz@...nel.org>, linux-usb@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: Wesley Cheng <quic_wcheng@...cinc.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] usb: xhci: Check for xhci->interrupters being allocated
 in xhci_mem_clearup()

On 31.7.2024 23.59, Marc Zyngier wrote:
> If xhci_mem_init() fails, it calls into xhci_mem_cleanup() to mop
> up the damage. If it fails early enough, before xhci->interrupters
> is allocated but after xhci->max_interrupters has been set, which
> happens in most (all?) cases, things get uglier, as xhci_mem_cleanup()
> unconditionally derefences xhci->interrupters. With prejudice.
> 
> Gate the interrupt freeing loop with a check on xhci->interrupters
> being non-NULL.
> 
> Found while debugging a DMA allocation issue that led the XHCI driver
> on this exact path.
> 
> Fixes: c99b38c41234 ("xhci: add support to allocate several interrupters")
> Cc: Mathias Nyman <mathias.nyman@...ux.intel.com>
> Cc: Wesley Cheng <quic_wcheng@...cinc.com>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Marc Zyngier <maz@...nel.org>
> ---

Thanks, Adding to queue

-Mathias