From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: ACJfBovaYfn8tO8Rgqnh2wa5Gkz+TxURyAd5oNGFIFh8q/Hd+f3s3j1MRXJvQtLjglsXV/nQExFs ARC-Seal: i=1; a=rsa-sha256; t=1516345229; cv=none; d=google.com; s=arc-20160816; b=Oj82iuJkXP2bfIbH196p++AADhZ5rdKSSR7D1D9B40rr5G+ySMW+v2oAYzjaGflcx3 H1aydFpAcDWAStgNyY0Vx2h0M7XA4FXvcjL4a7KtbxSMOSA/3x6aO+KwlNOpBRIcTARk yvslv/SU0d1sETNLuTkTKoPC0TW2O8hUrB0v7LNOCzLqf+Kdfq7Qn6cWQ+ZQYsR23Ca8 +l3rEviLGy1YFCmm7wdlVobi7Z3ivCAKyA0xpBRPHmXtelzi2br6TggCeDTLoTp1oZwM AFd/ayZyP9eMxFSbI6fQroR0+Dz5qO7EWjx9olXMOaeoF1ikazoGmuMMaVgTsjq+PyKP /VHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject :arc-authentication-results; bh=hPE3kD3q6j2Qcpu3lMlcuZipFI2SS9qiI3g4pAb6Xtg=; b=CMDkFTAMAS0iLvctC4wGGjUjGXpRX5oaTXYJCzPjkrWAxERSDJl5s4JyecxhgeOkgp PUxUhe64He0bB4RiyY7f62pNRYos52R15QF7dWj5fd1cvA/QRzXKL+DQ7vI/GZL6SCbU 9Ng8OMv61i87+26VQaqqei3/n4vITCSJBdP+eYDE4vh4bsNGWQ70oYSUrndSzhjo7lDb XAV8/mfMoWFp53pLRxIv32gstaXhE1eFUOfYvIZBxfYxrJMWtLVpBbY8FW+F/SeBcX9c IdGahY7nN7KKdfagFnp+sqyUDwfC1Q8VdWqr4rzVhivlgUp5Rz0HoojkI/OCI0cjBQLR XARw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of mathias.nyman@linux.intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=mathias.nyman@linux.intel.com Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of mathias.nyman@linux.intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=mathias.nyman@linux.intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,380,1511856000"; d="scan'208";a="11793047" Subject: Re: [PATCH] xhci:Fix NULL pointer in xhci debugfs To: Zhengjun Xing , gregkh@linuxfoundation.org Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org References: <20180119021351.8881-1-zhengjun.xing@linux.intel.com> From: Mathias Nyman Message-ID: <4b1e0988-cf37-cc16-d365-0c19ab1aebf5@linux.intel.com> Date: Fri, 19 Jan 2018 09:03:20 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <20180119021351.8881-1-zhengjun.xing@linux.intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1589985133572304308?= X-GMAIL-MSGID: =?utf-8?q?1590003215481447613?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 19.01.2018 04:13, Zhengjun Xing wrote: > Commit dde634057da7 ("xhci: Fix use-after-free in xhci debugfs") causes a > null pointer dereference while fixing xhci-debugfs usage of ring pointers > that were freed during hibernate. > > The fix passed addresses to ring pointers instead, but forgot to do this > change for the xhci_ring_trb_show function. > > The address of the ring pointer passed to xhci-debugfs was of a temporary > ring pointer "new_ring" instead of the actual ring "ring" pointer. The > temporary new_ring pointer will be set to NULL later causing the NULL > pointer dereference. > > This issue was seen when reading xhci related files in debugfs: > > cat /sys/kernel/debug/usb/xhci/*/devices/*/ep*/trbs > > [ 184.604861] BUG: unable to handle kernel NULL pointer dereference at (null) > [ 184.613776] IP: xhci_ring_trb_show+0x3a/0x890 > [ 184.618733] PGD 264193067 P4D 264193067 PUD 263238067 PMD 0 > [ 184.625184] Oops: 0000 [#1] SMP > [ 184.726410] RIP: 0010:xhci_ring_trb_show+0x3a/0x890 > [ 184.731944] RSP: 0018:ffffba8243c0fd90 EFLAGS: 00010246 > [ 184.737880] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000295d6 > [ 184.746020] RDX: 00000000000295d5 RSI: 0000000000000001 RDI: ffff971a6418d400 > [ 184.754121] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 > [ 184.762222] R10: ffff971a64c98a80 R11: ffff971a62a00e40 R12: ffff971a62a85500 > [ 184.770325] R13: 0000000000020000 R14: ffff971a6418d400 R15: ffff971a6418d400 > [ 184.778448] FS: 00007fe725a79700(0000) GS:ffff971a6ec00000(0000) knlGS:0000000000000000 > [ 184.787644] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 184.794168] CR2: 0000000000000000 CR3: 000000025f365005 CR4: 00000000003606f0 > [ 184.802318] Call Trace: > [ 184.805094] ? seq_read+0x281/0x3b0 > [ 184.809068] seq_read+0xeb/0x3b0 > [ 184.812735] full_proxy_read+0x4d/0x70 > [ 184.817007] __vfs_read+0x23/0x120 > [ 184.820870] vfs_read+0x91/0x130 > [ 184.824538] SyS_read+0x42/0x90 > [ 184.828106] entry_SYSCALL_64_fastpath+0x1a/0x7d > > Fixes: dde634057da7 ("xhci: Fix use-after-free in xhci debugfs") > Signed-off-by: Zhengjun Xing > --- Thanks, adding to queue -Mathias