From: Lars-Peter Clausen <lars@metafoo.de>
To: Jim Lin <jilin@nvidia.com>, balbi@kernel.org
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: gadget: f_fs: Fix kernel panic for SuperSpeed
Date: Fri, 22 Apr 2016 13:21:53 +0200 [thread overview]
Message-ID: <571A0951.2030802@metafoo.de> (raw)
In-Reply-To: <1461321780-3226-1-git-send-email-jilin@nvidia.com>
On 04/22/2016 12:43 PM, Jim Lin wrote:
> Android N adds os_desc_compat in v2_descriptor by init_functionfs()
> (system/core/adb/usb_linux_client.cpp) to support automatic install
> of MTP driver on Windows for USB device mode.
>
> Current __ffs_data_do_os_desc() of f_fs.c will check reserved1 field
> and return -EINVAL.
> This results in a second adb_write of usb_linux_client.cpp
> (system/core/adb/) which doesn't have ss_descriptors filled.
> Then later kernel_panic (composite.c) occurs when ss_descriptors
> as a pointer with NULL is being accessed.
>
> Fix is to ignore the checking on reserved1 field so that first
> adb_write goes successfully with v2_descriptor which has
> ss_descriptors filled.
That sounds like the wrong approach. The kernel should not crash if
ss_descriptors is not filled. I think the right fix is to make sure that the
NULL pointer deref can never happen regardless of which input is supplied by
userspace.
next prev parent reply other threads:[~2016-04-22 11:22 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-22 10:43 Jim Lin
2016-04-22 11:21 ` Lars-Peter Clausen [this message]
2016-04-22 11:52 ` Felipe Balbi
2016-04-25 11:32 ` Jim Lin
2016-04-25 12:01 ` Felipe Balbi
2016-04-26 8:49 ` Jim Lin
2016-04-28 11:16 ` Jim Lin
2016-04-28 12:21 ` Felipe Balbi
2016-04-29 11:27 ` Jim Lin
2016-04-29 11:57 ` Felipe Balbi
2016-05-04 8:07 ` Jim Lin
2016-05-04 10:37 ` Felipe Balbi
2016-05-05 10:35 ` Jim Lin
2016-05-06 6:44 ` Felipe Balbi
2016-05-06 2:37 ` Jim Lin
2016-04-29 15:28 ` Mathias Nyman
2016-05-02 6:23 ` Felipe Balbi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=571A0951.2030802@metafoo.de \
--to=lars@metafoo.de \
--cc=balbi@kernel.org \
--cc=jilin@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome