linux-kernel - Re: [PATCH v3] usb:xhci:Fix slot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42d12655-dca5-4465-a19d-17a2e4984d31@linux.intel.com>
Date: Fri, 1 Aug 2025 16:06:26 +0300
From: Mathias Nyman <mathias.nyman@...ux.intel.com>
To: Weitao Wang <WeitaoWang-oc@...oxin.com>, gregkh@...uxfoundation.org,
 mathias.nyman@...el.com, linux-usb@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: WeitaoWang@...oxin.com, wwt8723@....com, CobeChen@...oxin.com,
 stable@...r.kernel.org
Subject: Re: [PATCH v3] usb:xhci:Fix slot_id resource race conflict

On 30.7.2025 18.27, Weitao Wang wrote:
> In such a scenario, device-A with slot_id equal to 1 is disconnecting
> while device-B is enumerating, device-B will fail to enumerate in the
> follow sequence.
> 
> 1.[device-A] send disable slot command
> 2.[device-B] send enable slot command
> 3.[device-A] disable slot command completed and wakeup waiting thread
> 4.[device-B] enable slot command completed with slot_id equal to 1 and
> wakeup waiting thread
> 5.[device-B] driver check this slot_id was used by someone(device-A) in
> xhci_alloc_virt_device, this device fails to enumerate as this conflict
> 6.[device-A] xhci->devs[slot_id] set to NULL in xhci_free_virt_device
> 
> To fix driver's slot_id resources conflict, clear xhci->devs[slot_id] and
> xhci->dcbba->dev_context_ptrs[slot_id] pointers in the interrupt context
> when disable slot command completes successfully. Simultaneously, adjust
> function xhci_free_virt_device to accurately handle device release.
> 
> Cc: stable@...r.kernel.org
> Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend")
> Signed-off-by: Weitao Wang <WeitaoWang-oc@...oxin.com>

Thanks, added to queue with some minor commit message tuning

-Mathias