| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <b5ab0f46-0fde-420e-97a2-136d3074b59c@suswa.mountain>
Date: Fri, 1 Aug 2025 17:31:41 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Weitao Wang <WeitaoWang-oc@...oxin.com>,
gregkh@...uxfoundation.org, mathias.nyman@...el.com,
linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev, WeitaoWang@...oxin.com,
wwt8723@....com, CobeChen@...oxin.com, stable@...r.kernel.org
Subject: Re: [PATCH v3] usb:xhci:Fix slot_id resource race conflict
Hi Weitao,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Weitao-Wang/usb-xhci-Fix-slot_id-resource-race-conflict/20250730-183802
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/r/20250730152715.8368-1-WeitaoWang-oc%40zhaoxin.com
patch subject: [PATCH v3] usb:xhci:Fix slot_id resource race conflict
config: x86_64-randconfig-161-20250801 (https://download.01.org/0day-ci/archive/20250801/202508010850.Bqd6wf47-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202508010850.Bqd6wf47-lkp@intel.com/
New smatch warnings:
drivers/usb/host/xhci-mem.c:913 xhci_free_virt_device() warn: variable dereferenced before check 'dev->out_ctx' (see line 878)
vim +913 drivers/usb/host/xhci-mem.c
0b5ed80150eb59 Weitao Wang 2025-07-30 868 void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev,
0b5ed80150eb59 Weitao Wang 2025-07-30 869 int slot_id)
3ffbba9511b414 Sarah Sharp 2009-04-27 870 {
3ffbba9511b414 Sarah Sharp 2009-04-27 871 int i;
2e27980e6eb781 Sarah Sharp 2011-09-02 872 int old_active_eps = 0;
3ffbba9511b414 Sarah Sharp 2009-04-27 873
3ffbba9511b414 Sarah Sharp 2009-04-27 874 /* Slot ID 0 is reserved */
0b5ed80150eb59 Weitao Wang 2025-07-30 875 if (slot_id == 0 || !dev)
3ffbba9511b414 Sarah Sharp 2009-04-27 876 return;
3ffbba9511b414 Sarah Sharp 2009-04-27 877
0b5ed80150eb59 Weitao Wang 2025-07-30 @878 if (xhci->dcbaa->dev_context_ptrs[slot_id] == cpu_to_le64(dev->out_ctx->dma))
^^^^^^^^^^^^
dev->out_ctx dereferenced without checking for NULL
8e595a5d30a5ee Sarah Sharp 2009-07-27 879 xhci->dcbaa->dev_context_ptrs[slot_id] = 0;
3ffbba9511b414 Sarah Sharp 2009-04-27 880
d850c1658328e7 Zhengjun Xing 2018-06-21 881 trace_xhci_free_virt_device(dev);
d850c1658328e7 Zhengjun Xing 2018-06-21 882
2e27980e6eb781 Sarah Sharp 2011-09-02 883 if (dev->tt_info)
2e27980e6eb781 Sarah Sharp 2011-09-02 884 old_active_eps = dev->tt_info->active_eps;
2e27980e6eb781 Sarah Sharp 2011-09-02 885
98871e9470a50c Felipe Balbi 2017-01-23 886 for (i = 0; i < 31; i++) {
63a0d9abd18cdc Sarah Sharp 2009-09-04 887 if (dev->eps[i].ring)
63a0d9abd18cdc Sarah Sharp 2009-09-04 888 xhci_ring_free(xhci, dev->eps[i].ring);
8df75f42f8e67e Sarah Sharp 2010-04-02 889 if (dev->eps[i].stream_info)
8df75f42f8e67e Sarah Sharp 2010-04-02 890 xhci_free_stream_info(xhci,
8df75f42f8e67e Sarah Sharp 2010-04-02 891 dev->eps[i].stream_info);
5aed5b7c2430ce Mathias Nyman 2022-10-24 892 /*
5aed5b7c2430ce Mathias Nyman 2022-10-24 893 * Endpoints are normally deleted from the bandwidth list when
5aed5b7c2430ce Mathias Nyman 2022-10-24 894 * endpoints are dropped, before device is freed.
5aed5b7c2430ce Mathias Nyman 2022-10-24 895 * If host is dying or being removed then endpoints aren't
5aed5b7c2430ce Mathias Nyman 2022-10-24 896 * dropped cleanly, so delete the endpoint from list here.
5aed5b7c2430ce Mathias Nyman 2022-10-24 897 * Only applicable for hosts with software bandwidth checking.
2e27980e6eb781 Sarah Sharp 2011-09-02 898 */
5aed5b7c2430ce Mathias Nyman 2022-10-24 899
5aed5b7c2430ce Mathias Nyman 2022-10-24 900 if (!list_empty(&dev->eps[i].bw_endpoint_list)) {
5aed5b7c2430ce Mathias Nyman 2022-10-24 901 list_del_init(&dev->eps[i].bw_endpoint_list);
5aed5b7c2430ce Mathias Nyman 2022-10-24 902 xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n",
2e27980e6eb781 Sarah Sharp 2011-09-02 903 slot_id, i);
8df75f42f8e67e Sarah Sharp 2010-04-02 904 }
5aed5b7c2430ce Mathias Nyman 2022-10-24 905 }
839c817ce67178 Sarah Sharp 2011-09-02 906 /* If this is a hub, free the TT(s) from the TT list */
839c817ce67178 Sarah Sharp 2011-09-02 907 xhci_free_tt_info(xhci, dev, slot_id);
2e27980e6eb781 Sarah Sharp 2011-09-02 908 /* If necessary, update the number of active TTs on this root port */
2e27980e6eb781 Sarah Sharp 2011-09-02 909 xhci_update_tt_active_eps(xhci, dev, old_active_eps);
3ffbba9511b414 Sarah Sharp 2009-04-27 910
3ffbba9511b414 Sarah Sharp 2009-04-27 911 if (dev->in_ctx)
d115b04818e57b John Youn 2009-07-27 912 xhci_free_container_ctx(xhci, dev->in_ctx);
3ffbba9511b414 Sarah Sharp 2009-04-27 @913 if (dev->out_ctx)
^^^^^^^^^^^^
Can dev->out_ctx be NULL?
d115b04818e57b John Youn 2009-07-27 914 xhci_free_container_ctx(xhci, dev->out_ctx);
d115b04818e57b John Youn 2009-07-27 915
a400efe455f7b6 Mathias Nyman 2018-03-16 916 if (dev->udev && dev->udev->slot_id)
a400efe455f7b6 Mathias Nyman 2018-03-16 917 dev->udev->slot_id = 0;
74151b5349266b Niklas Neronin 2024-02-29 918 if (dev->rhub_port && dev->rhub_port->slot_id == slot_id)
74151b5349266b Niklas Neronin 2024-02-29 919 dev->rhub_port->slot_id = 0;
0b5ed80150eb59 Weitao Wang 2025-07-30 920 if (xhci->devs[slot_id] == dev)
326b4810cc9952 Randy Dunlap 2010-04-19 921 xhci->devs[slot_id] = NULL;
0b5ed80150eb59 Weitao Wang 2025-07-30 922 kfree(dev);
3ffbba9511b414 Sarah Sharp 2009-04-27 923 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists