linux-kernel - Re: [PATCH] usb: xhci: check Null pointer in segment alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251222064252.GA1196800@google.com>
Date: Mon, 22 Dec 2025 06:42:52 +0000
From: Lee Jones <lee@...nel.org>
To: Michal Pecio <michal.pecio@...il.com>
Cc: 胡连勤 <hulianqin@...o.com>,
	Mathias Nyman <mathias.nyman@...ux.intel.com>,
	Mathias Nyman <mathias.nyman@...el.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Sarah Sharp <sarah.a.sharp@...ux.intel.com>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usb: xhci: check Null pointer in segment alloc

On Sat, 20 Dec 2025, Michal Pecio wrote:

> Hi,
> 
> On Fri, 19 Dec 2025 15:53:08 +0000, 胡连勤 wrote:
> > [ 4021.987665][  T332] Call trace:
> > [ 4021.987668][  T332]  dma_pool_alloc+0x3c/0x248
> > [ 4021.987676][  T332]  xhci_segment_alloc+0x9c/0x184
> > [ 4021.987682][  T332]  xhci_alloc_segments_for_ring+0xcc/0x1cc
> > [ 4021.987688][  T332]  xhci_ring_alloc+0xc4/0x1a8
> > [ 4021.987693][  T332]  xhci_endpoint_init+0x36c/0x4ac
> > [ 4021.987698][  T332]  xhci_add_endpoint+0x18c/0x2a4
> > [ 4021.987702][  T332]  usb_hcd_alloc_bandwidth+0x384/0x3e4
> > [ 4021.987711][  T332]  usb_set_interface+0x144/0x510
> > [ 4021.987716][  T332]  usb_reset_and_verify_device+0x248/0x5fc
> > [ 4021.987723][  T332]  usb_port_resume+0x580/0x700
> > [ 4021.987730][  T332]  usb_generic_driver_resume+0x24/0x5c
> > [ 4021.987735][  T332]  usb_resume_both+0x104/0x32c
> > [ 4021.987740][  T332]  usb_runtime_resume+0x18/0x28
> > [ 4021.987746][  T332]  __rpm_callback+0x94/0x3d4
> > [ 4021.987754][  T332]  rpm_resume+0x3f8/0x5fc
> > [ 4021.987762][  T332]  rpm_resume+0x1fc/0x5fc
> > [ 4021.987769][  T332]  __pm_runtime_resume+0x4c/0x90
> > [ 4021.987777][  T332]  usb_autopm_get_interface+0x20/0x4c
> > [ 4021.987783][  T332]  snd_usb_autoresume+0x68/0x124
> > [ 4021.987792][  T332]  suspend_resume_store+0x2a0/0x2b4 [dwc3_msm a4b7997a2e35cfe1a4a429762003b34dd4e85076]
> 
> This looks like some out of tree driver tries to resume a sound device,
> and apparently it's doing it while xhci_hcd isn't ready, perhaps during
> the power_lost branch in xhci_resume() after full system suspend.
> 
> I suppose dynamic debug could show better what's going on:
> echo 'module usbcore +p' >/proc/dynamic_debug/control
> echo 'module xhci_hcd +p' >/proc/dynamic_debug/control
> 
> If my guess is right then USB core is failing to prevent device resume
> during HC resume, but IDK whether it's supposed to prevent that or if
> the out of tree driver simply shouldn't be trying such things.

Lower-level functionality shouldn't be able to attack / fuzz core-code
in this way.  Shouldn't the core be resistant to any possible mistakes
or a lack of education exhibited by it's consumers?  An API that insists
on its users exercising care, knowledge and cognisance sounds fragile
and vulnerable.

-- 
Lee Jones [李琼斯]