* [PATCH] usb: dwc3: ep0: fix NULL pointer exception
@ 2021-06-08 16:26 Marian-Cristian Rotariu
2021-06-09 9:03 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Marian-Cristian Rotariu @ 2021-06-08 16:26 UTC (permalink / raw
To: linux-usb; +Cc: mircescu, marian.c.rotariu
There is no validation of the index from dwc3_wIndex_to_dep() and we might
be referring a non-existing ep and trigger a NULL pointer exception. In
certain configurations we might use fewer eps and the index might wrongly
indicate a larger ep index than existing.
By adding this validation from the patch we can actually report a wrong
index back to the caller.
In our usecase we are using a composite device on an older kernel, but
upstream might use this fix also. Unfortunately, I cannot describe the
hardware for others to reproduce the issue as it is a proprietary
implementation.
[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
[ 82.966891] Mem abort info:
[ 82.969663] ESR = 0x96000006
[ 82.972703] Exception class = DABT (current EL), IL = 32 bits
[ 82.978603] SET = 0, FnV = 0
[ 82.981642] EA = 0, S1PTW = 0
[ 82.984765] Data abort info:
[ 82.987631] ISV = 0, ISS = 0x00000006
[ 82.991449] CM = 0, WnR = 0
[ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
[ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
[ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
[ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
[ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
[ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
[ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
...
[ 83.141788] Call trace:
[ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c
[ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94
[ 83.181546] ---[ end trace aac6b5267d84c32f ]---
Signed-off-by: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
---
linux-4.19.124/drivers/usb/dwc3/ep0.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/linux-4.19.124/drivers/usb/dwc3/ep0.c b/linux-4.19.124/drivers/usb/dwc3/ep0.c
index 662a1298b..3a55bbdde 100644
--- a/linux-4.19.124/drivers/usb/dwc3/ep0.c
+++ b/linux-4.19.124/drivers/usb/dwc3/ep0.c
@@ -292,6 +292,9 @@ static struct dwc3_ep *dwc3_wIndex_to_dep(struct dwc3 *dwc, __le16 wIndex_le)
epnum |= 1;
dep = dwc->eps[epnum];
+ if (dep == NULL)
+ return NULL;
+
if (dep->flags & DWC3_EP_ENABLED)
return dep;
--
2.29.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: dwc3: ep0: fix NULL pointer exception
2021-06-08 16:26 [PATCH] usb: dwc3: ep0: fix NULL pointer exception Marian-Cristian Rotariu
@ 2021-06-09 9:03 ` Greg KH
2021-06-09 10:07 ` Marian-Cristian Rotariu
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2021-06-09 9:03 UTC (permalink / raw
To: Marian-Cristian Rotariu; +Cc: linux-usb, mircescu
On Tue, Jun 08, 2021 at 07:26:50PM +0300, Marian-Cristian Rotariu wrote:
> There is no validation of the index from dwc3_wIndex_to_dep() and we might
> be referring a non-existing ep and trigger a NULL pointer exception. In
> certain configurations we might use fewer eps and the index might wrongly
> indicate a larger ep index than existing.
>
> By adding this validation from the patch we can actually report a wrong
> index back to the caller.
>
> In our usecase we are using a composite device on an older kernel, but
> upstream might use this fix also. Unfortunately, I cannot describe the
> hardware for others to reproduce the issue as it is a proprietary
> implementation.
>
> [ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
> [ 82.966891] Mem abort info:
> [ 82.969663] ESR = 0x96000006
> [ 82.972703] Exception class = DABT (current EL), IL = 32 bits
> [ 82.978603] SET = 0, FnV = 0
> [ 82.981642] EA = 0, S1PTW = 0
> [ 82.984765] Data abort info:
> [ 82.987631] ISV = 0, ISS = 0x00000006
> [ 82.991449] CM = 0, WnR = 0
> [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
> [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
> [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
> [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
> [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
> [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
> [ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
> [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
>
> ...
>
> [ 83.141788] Call trace:
> [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c
> [ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94
> [ 83.181546] ---[ end trace aac6b5267d84c32f ]---
>
> Signed-off-by: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
> ---
> linux-4.19.124/drivers/usb/dwc3/ep0.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/linux-4.19.124/drivers/usb/dwc3/ep0.c b/linux-4.19.124/drivers/usb/dwc3/ep0.c
> index 662a1298b..3a55bbdde 100644
> --- a/linux-4.19.124/drivers/usb/dwc3/ep0.c
> +++ b/linux-4.19.124/drivers/usb/dwc3/ep0.c
How did you create this? It's one level too "deep" for git.
I'll go edit it by hand, but next time be more careful.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: dwc3: ep0: fix NULL pointer exception
2021-06-09 9:03 ` Greg KH
@ 2021-06-09 10:07 ` Marian-Cristian Rotariu
2021-06-10 9:08 ` Felipe Balbi
0 siblings, 1 reply; 4+ messages in thread
From: Marian-Cristian Rotariu @ 2021-06-09 10:07 UTC (permalink / raw
To: Greg KH; +Cc: linux-usb, mircescu
> How did you create this? It's one level too "deep" for git.
I forgot to rebase it on the adequate kernel repo. Sorry for that.
We use an in-house repo where the 4.19 kernel is inside a directory
as you could see.
> I'll go edit it by hand, but next time be more careful.
Thank you!
Marian
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: dwc3: ep0: fix NULL pointer exception
2021-06-09 10:07 ` Marian-Cristian Rotariu
@ 2021-06-10 9:08 ` Felipe Balbi
0 siblings, 0 replies; 4+ messages in thread
From: Felipe Balbi @ 2021-06-10 9:08 UTC (permalink / raw
To: Marian-Cristian Rotariu, Greg KH; +Cc: linux-usb, mircescu
[-- Attachment #1: Type: text/plain, Size: 468 bytes --]
Marian-Cristian Rotariu <marian.c.rotariu@gmail.com> writes:
>> How did you create this? It's one level too "deep" for git.
> I forgot to rebase it on the adequate kernel repo. Sorry for that.
> We use an in-house repo where the 4.19 kernel is inside a directory
> as you could see.
Make sure you can reproduce the bug with upstream too. If you can run
upstream, at a minimum provide a minimal method for reproducing the NULL
pointer deref.
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 511 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-06-10 9:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-06-08 16:26 [PATCH] usb: dwc3: ep0: fix NULL pointer exception Marian-Cristian Rotariu
2021-06-09 9:03 ` Greg KH
2021-06-09 10:07 ` Marian-Cristian Rotariu
2021-06-10 9:08 ` Felipe Balbi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.