linux-kernel - Re: [PATCH v4] xhci: tegra: fix checked USB2 port number

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <lfjrdb5hx7ytm5kfolsidfa6pfbatocznejedyo4nsxjziouse@6bjo5huzciwa>
Date: Mon, 21 Oct 2024 14:46:24 +0200
From: Thierry Reding <thierry.reding@...il.com>
To: Henry Lin <henryl@...dia.com>
Cc: Mathias Nyman <mathias.nyman@...el.com>, 
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Jonathan Hunter <jonathanh@...dia.com>, 
	Petlozu Pravareshwar <petlozup@...dia.com>, Jim Lin <jilin@...dia.com>, linux-usb@...r.kernel.org, 
	linux-tegra@...r.kernel.org, linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v4] xhci: tegra: fix checked USB2 port number

On Mon, Oct 14, 2024 at 12:21:34PM +0800, Henry Lin wrote:
> If USB virtualizatoin is enabled, USB2 ports are shared between all
> Virtual Functions. The USB2 port number owned by an USB2 root hub in
> a Virtual Function may be less than total USB2 phy number supported
> by the Tegra XUSB controller.
> 
> Using total USB2 phy number as port number to check all PORTSC values
> would cause invalid memory access.
> 
> [  116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f
> ...
> [  117.213640] Call trace:
> [  117.216783]  tegra_xusb_enter_elpg+0x23c/0x658
> [  117.222021]  tegra_xusb_runtime_suspend+0x40/0x68
> [  117.227260]  pm_generic_runtime_suspend+0x30/0x50
> [  117.232847]  __rpm_callback+0x84/0x3c0
> [  117.237038]  rpm_suspend+0x2dc/0x740
> [  117.241229] pm_runtime_work+0xa0/0xb8
> [  117.245769]  process_scheduled_works+0x24c/0x478
> [  117.251007]  worker_thread+0x23c/0x328
> [  117.255547]  kthread+0x104/0x1b0
> [  117.259389]  ret_from_fork+0x10/0x20
> [  117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)
> 
> Cc: <stable@...r.kernel.org> # v6.3+
> Fixes: a30951d31b25 ("xhci: tegra: USB2 pad power controls")
> Signed-off-by: Henry Lin <henryl@...dia.com>
> ---
> V1 -> V2: Add Fixes tag and the cc stable line
> V2 -> V3: Update commit message to clarify issue
> V3 -> V4: Resend for patch changelogs that are missing in V3
> 
>  drivers/usb/host/xhci-tegra.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
> index 6246d5ad1468..76f228e7443c 100644
> --- a/drivers/usb/host/xhci-tegra.c
> +++ b/drivers/usb/host/xhci-tegra.c
> @@ -2183,7 +2183,7 @@ static int tegra_xusb_enter_elpg(struct tegra_xusb *tegra, bool runtime)
>  		goto out;
>  	}
>  
> -	for (i = 0; i < tegra->num_usb_phys; i++) {
> +	for (i = 0; i < xhci->usb2_rhub.num_ports; i++) {
>  		if (!xhci->usb2_rhub.ports[i])
>  			continue;
>  		portsc = readl(xhci->usb2_rhub.ports[i]->addr);

Given that the size of usb2_rhub.ports is given by usb2_rhub.num_ports,
this seems the right thing to do regardless of virtualization.

Acked-by: Thierry Reding <treding@...dia.com>

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)