linux-kernel - Re: [PATCH] usb: xhci: check Null pointer in segment alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025122131-jaunt-obtuse-4585@gregkh>
Date: Sun, 21 Dec 2025 17:22:57 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: 胡连勤 <hulianqin@...o.com>
Cc: Mathias Nyman <mathias.nyman@...el.com>,
	Sarah Sharp <sarah.a.sharp@...ux.intel.com>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usb: xhci: check Null pointer in segment alloc

On Fri, Dec 19, 2025 at 07:18:10AM +0000, 胡连勤 wrote:
> From: Lianqin Hu <hulianqin@...o.com>
> 
> Considering that in some extreme cases,
> when a digital headset is connected and a wake-up
> operation is performed,if the headset is plug out
> or the headset connection is abnormally disconnected at this time,
> segment_pool will be set to null, resulting in accessing a null pointer.

Nit, please wrap your changelog at 72 columns.

> So, add null pointer checks to fix the problem.
> 
> Call trace:
>  dma_pool_alloc+0x3c/0x248
>  xhci_segment_alloc+0x9c/0x184
>  xhci_alloc_segments_for_ring+0xcc/0x1cc
>  xhci_ring_alloc+0xc4/0x1a8
>  xhci_endpoint_init+0x36c/0x4ac
>  xhci_add_endpoint+0x18c/0x2a4
>  usb_hcd_alloc_bandwidth+0x384/0x3e4
>  usb_set_interface+0x144/0x510
>  usb_reset_and_verify_device+0x248/0x5fc
>  usb_port_resume+0x580/0x700
>  usb_generic_driver_resume+0x24/0x5c
>  usb_resume_both+0x104/0x32c
>  usb_runtime_resume+0x18/0x28
>  __rpm_callback+0x94/0x3d4
>  rpm_resume+0x3f8/0x5fc
>  rpm_resume+0x1fc/0x5fc
> 
> Fixes: 0ebbab374223 ("USB: xhci: Ring allocation and initialization.")
> Cc: stable@...r.kernel.org
> Signed-off-by: Lianqin Hu <hulianqin@...o.com>
> 
>  drivers/usb/host/xhci-mem.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index c708bdd69f16..2ea5fb810a80 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -35,6 +35,9 @@ static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci,
>  	dma_addr_t	dma;
>  	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
>  
> +	if (!xhci->segment_pool)
> +		return NULL;

What prevents segment_pool from being set to NULL right after checking
this?

And what happens when you return "out of memory" like this is doing?
Doesn't that cause problems with the caller?  Looking at the callbacks
it seems like the whole ring will then be torn down, is that the proper
thing to do on system resume?

thanks,

greg k-h