linux-kernel - Re: [PATCH] usb: xhci: check Null pointer in segment alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251220141510.1bc1ef19.michal.pecio@gmail.com>
Date: Sat, 20 Dec 2025 14:15:10 +0100
From: Michal Pecio <michal.pecio@...il.com>
To: 胡连勤 <hulianqin@...o.com>
Cc: Mathias Nyman <mathias.nyman@...ux.intel.com>, Mathias Nyman
 <mathias.nyman@...el.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Sarah Sharp <sarah.a.sharp@...ux.intel.com>, "linux-usb@...r.kernel.org"
 <linux-usb@...r.kernel.org>, "linux-kernel@...r.kernel.org"
 <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usb: xhci: check Null pointer in segment alloc

Hi,

On Fri, 19 Dec 2025 15:53:08 +0000, 胡连勤 wrote:
> [ 4021.987665][  T332] Call trace:
> [ 4021.987668][  T332]  dma_pool_alloc+0x3c/0x248
> [ 4021.987676][  T332]  xhci_segment_alloc+0x9c/0x184
> [ 4021.987682][  T332]  xhci_alloc_segments_for_ring+0xcc/0x1cc
> [ 4021.987688][  T332]  xhci_ring_alloc+0xc4/0x1a8
> [ 4021.987693][  T332]  xhci_endpoint_init+0x36c/0x4ac
> [ 4021.987698][  T332]  xhci_add_endpoint+0x18c/0x2a4
> [ 4021.987702][  T332]  usb_hcd_alloc_bandwidth+0x384/0x3e4
> [ 4021.987711][  T332]  usb_set_interface+0x144/0x510
> [ 4021.987716][  T332]  usb_reset_and_verify_device+0x248/0x5fc
> [ 4021.987723][  T332]  usb_port_resume+0x580/0x700
> [ 4021.987730][  T332]  usb_generic_driver_resume+0x24/0x5c
> [ 4021.987735][  T332]  usb_resume_both+0x104/0x32c
> [ 4021.987740][  T332]  usb_runtime_resume+0x18/0x28
> [ 4021.987746][  T332]  __rpm_callback+0x94/0x3d4
> [ 4021.987754][  T332]  rpm_resume+0x3f8/0x5fc
> [ 4021.987762][  T332]  rpm_resume+0x1fc/0x5fc
> [ 4021.987769][  T332]  __pm_runtime_resume+0x4c/0x90
> [ 4021.987777][  T332]  usb_autopm_get_interface+0x20/0x4c
> [ 4021.987783][  T332]  snd_usb_autoresume+0x68/0x124
> [ 4021.987792][  T332]  suspend_resume_store+0x2a0/0x2b4 [dwc3_msm a4b7997a2e35cfe1a4a429762003b34dd4e85076]

This looks like some out of tree driver tries to resume a sound device,
and apparently it's doing it while xhci_hcd isn't ready, perhaps during
the power_lost branch in xhci_resume() after full system suspend.

I suppose dynamic debug could show better what's going on:
echo 'module usbcore +p' >/proc/dynamic_debug/control
echo 'module xhci_hcd +p' >/proc/dynamic_debug/control

If my guess is right then USB core is failing to prevent device resume
during HC resume, but IDK whether it's supposed to prevent that or if
the out of tree driver simply shouldn't be trying such things.

Regards,
Michal