From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
Subject: [PATCH 4.14 28/49] usb: dwc3: ep0: fix NULL pointer exception
Date: Mon, 14 Jun 2021 12:27:21 +0200 [thread overview]
Message-ID: <20210614102642.790361172@linuxfoundation.org> (raw)
In-Reply-To: <20210614102641.857724541@linuxfoundation.org>
From: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
commit d00889080ab60051627dab1d85831cd9db750e2a upstream.
There is no validation of the index from dwc3_wIndex_to_dep() and we might
be referring a non-existing ep and trigger a NULL pointer exception. In
certain configurations we might use fewer eps and the index might wrongly
indicate a larger ep index than existing.
By adding this validation from the patch we can actually report a wrong
index back to the caller.
In our usecase we are using a composite device on an older kernel, but
upstream might use this fix also. Unfortunately, I cannot describe the
hardware for others to reproduce the issue as it is a proprietary
implementation.
[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
[ 82.966891] Mem abort info:
[ 82.969663] ESR = 0x96000006
[ 82.972703] Exception class = DABT (current EL), IL = 32 bits
[ 82.978603] SET = 0, FnV = 0
[ 82.981642] EA = 0, S1PTW = 0
[ 82.984765] Data abort info:
[ 82.987631] ISV = 0, ISS = 0x00000006
[ 82.991449] CM = 0, WnR = 0
[ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
[ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
[ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
[ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
[ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
[ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
[ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
...
[ 83.141788] Call trace:
[ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c
[ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94
[ 83.181546] ---[ end trace aac6b5267d84c32f ]---
Signed-off-by: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210608162650.58426-1-marian.c.rotariu@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/ep0.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -302,6 +302,9 @@ static struct dwc3_ep *dwc3_wIndex_to_de
epnum |= 1;
dep = dwc->eps[epnum];
+ if (dep == NULL)
+ return NULL;
+
if (dep->flags & DWC3_EP_ENABLED)
return dep;
next prev parent reply other threads:[~2021-06-14 10:39 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-14 10:26 [PATCH 4.14 00/49] 4.14.237-rc1 review Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 4.14 01/49] proc: Track /proc/$pid/attr/ opener mm_struct Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 4.14 02/49] net/nfc/rawsock.c: fix a permission check bug Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 4.14 03/49] ASoC: sti-sas: add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 4.14 04/49] isdn: mISDN: netjet: Fix crash in nj_probe: Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 4.14 05/49] bonding: init notify_work earlier to avoid uninitialized use Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 4.14 06/49] netlink: disable IRQs for netlink_lock_table() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 07/49] net: mdiobus: get rid of a BUG_ON() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 08/49] cgroup: disable controllers at parse time Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 09/49] wq: handle VM suspension in stall detection Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 10/49] net/qla3xxx: fix schedule while atomic in ql_sem_spinlock Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 11/49] scsi: vmw_pvscsi: Set correct residual data length Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 12/49] scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 13/49] net: macb: ensure the device is available before accessing GEMGXL control registers Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 14/49] net: appletalk: cops: Fix data race in cops_probe1 Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 15/49] MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 16/49] bnx2x: Fix missing error code in bnx2x_iov_init_one() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 17/49] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 18/49] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 " Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 19/49] i2c: mpc: Make use of i2c_recover_bus() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 20/49] i2c: mpc: implement erratum A-004447 workaround Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 21/49] drm: Fix use-after-free read in drm_getunique() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 22/49] drm: Lock pointer access in drm_master_release() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 23/49] kvm: avoid speculation-based attacks from out-of-range memslot accesses Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 24/49] staging: rtl8723bs: Fix uninitialized variables Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 25/49] btrfs: return value from btrfs_mark_extent_written() in case of error Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 26/49] cgroup1: dont allow \n in renaming Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 27/49] USB: f_ncm: ncm_bitrate (speed) is unsigned Greg Kroah-Hartman
2021-06-14 10:27 ` Greg Kroah-Hartman [this message]
2021-06-14 10:27 ` [PATCH 4.14 29/49] usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 30/49] usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 31/49] USB: serial: ftdi_sio: add NovaTech OrionMX product ID Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 32/49] USB: serial: omninet: add device id for Zyxel Omni 56K Plus Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 33/49] USB: serial: quatech2: fix control-request directions Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 34/49] usb: gadget: eem: fix wrong eem header operation Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 35/49] usb: fix various gadgets null ptr deref on 10gbps cabling Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 36/49] usb: fix various gadget panics " Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 37/49] regulator: core: resolve supply for boot-on/always-on regulators Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 38/49] regulator: max77620: Use device_set_of_node_from_dev() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 39/49] perf: Fix data race between pin_count increment/decrement Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 40/49] NFS: Fix a potential NULL dereference in nfs_get_client() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 41/49] perf session: Correct buffer copying when peeking events Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 42/49] kvm: fix previous commit for 32-bit builds Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 43/49] NFS: Fix use-after-free in nfs4_init_client() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 44/49] NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 45/49] scsi: core: Fix error handling of scsi_host_alloc() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 46/49] scsi: core: Put .shost_dev in failure path if host state changes to RUNNING Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 47/49] scsi: core: Only put parent device if host state differs from SHOST_CREATED Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 48/49] ftrace: Do not blindly read the ip address in ftrace_bug() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 4.14 49/49] tracing: Correct the length check which causes memory corruption Greg Kroah-Hartman
2021-06-14 17:55 ` [PATCH 4.14 00/49] 4.14.237-rc1 review Jon Hunter
2021-06-15 1:03 ` Samuel Zou
2021-06-15 9:53 ` Naresh Kamboju
2021-06-15 14:20 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210614102642.790361172@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marian.c.rotariu@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.