shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 11:50:43 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: xhci: Fix xhci debugfs NULL pointer dereference in resume from hibernate

Browse Source 
Free the virt_device and its debugfs_private member together.

When resuming from hibernate the .free_dev callback unconditionally
freed the debugfs_private member, but could leave virt_device intact.

This triggered a NULL pointer dereference after resume when usbmuxd
sent a USBDEVFS_SETCONFIGURATION ioctl to a device, trying to add a
endpoint debugfs entry to a already freed debugfs_private pointer.

Change-Id: Ib0ed39ee0f82f3f5c3af5c46949a6a5f6dfe190d
Fixes: 02b6fdc2a1 ("usb: xhci: Add debugfs interface for xHCI driver")
Reported-by: Alexander Kappner <agk@godking.net>
Tested-by: Alexander Kappner <agk@godking.net>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: William Wu <william.wu@rock-chips.com>
This commit is contained in:
Mathias Nyman
2017-12-21 15:06:13 +02:00
committed by Tao Huang
parent 5f96ef7e0f
commit 87802b3d7a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/usb/host/xhci.c
View File

@@ -3611,8 +3611,6 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
int i, ret;
struct xhci_command *command;
xhci_debugfs_remove_slot(xhci, udev->slot_id);
command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
if (!command)
return;
@@ -3646,6 +3644,8 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
}
xhci_debugfs_remove_slot(xhci, udev->slot_id);
spin_lock_irqsave(&xhci->lock, flags);
virt_dev->udev = NULL;