linux-kernel - Re: [PATCH] XHCI NULL Pointer check in xhci_check_bw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a02cfe06-b227-431f-baa1-a504857a8dea@linux.intel.com>
Date: Mon, 18 Nov 2024 11:36:47 +0200
From: Mathias Nyman <mathias.nyman@...ux.intel.com>
To: Sundtek <linuxusb.ml@...dtek.de>, linux-kernel@...r.kernel.org,
 linux-usb@...r.kernel.org
Cc: Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] XHCI NULL Pointer check in xhci_check_bw_table

Hi

On 17.11.2024 17.32, Sundtek wrote:
> This patch fixes a NULL Pointer exception when a device using the XHCI
> controller driver is not properly initialized. It's relatively easy to
> reproduce with a faulty connection to a USB Harddisk / USB Ethernet
> adapter.
> The way I used for testing this patch was to short USB D+/D- and pull
> them to ground.
> 
> We manufacture our own USB devices and use Linux for testing, lately we
> upgraded the system to Ubuntu noble with Kernel 6.8.0 and our system
> also crashed multiple times just when plugging in some devices (no
> commands need to be executed).
> We connect/disconnect devices > 100 times (eg uploading firmware, do
> electrical tests etc).
> 
> I would rate this issue as highly critical.
> The problem is triggered via some fallback code in hub.c, a second
> patch will follow which
> removes the endpoint reset in the particular fallback.
> 


> 2024-11-16T22:14:12.122224+08:00 sundtek-UX32VD kernel: RIP:
> 0010:xhci_check_bw_table+0x100/0x4d0

This looks very similar to a null pointer issue I fixed recently.
Patch should be in 6.11 and recent stable releases:

af8e119f52e9 xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration

What kernel are you running?

Thanks
Mathias