From: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Signed-off-by: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
Cc: stable(a)vger.kernel.org
---
drivers/usb/dwc2/gadget.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 70ac47a341ac..a68c01b1dd73 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1553,12 +1553,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
From: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Signed-off-by: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
Cc: stable(a)vger.kernel.org
---
changes in v2:
- remove unused struct dwc2_hsotg_ep *ep;
drivers/usb/dwc2/gadget.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0a0d11151cfb..ad4c94366dad 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1543,7 +1543,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
u32 windex)
{
- struct dwc2_hsotg_ep *ep;
int dir = (windex & USB_DIR_IN) ? 1 : 0;
int idx = windex & 0x7F;
@@ -1553,12 +1552,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
From: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Reported-by: Gerhard Klostermeier <gerhard.klostermeier(a)syss.de>
Signed-off-by: Heiko Stuebner <heiko.stuebner(a)theobroma-systems.com>
Cc: stable(a)vger.kernel.org
---
changes in v3:
- added Reported-by tag
changes in v2:
- remove unused struct dwc2_hsotg_ep *ep;
drivers/usb/dwc2/gadget.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0a0d11151cfb..ad4c94366dad 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1543,7 +1543,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
u32 windex)
{
- struct dwc2_hsotg_ep *ep;
int dir = (windex & USB_DIR_IN) ? 1 : 0;
int idx = windex & 0x7F;
@@ -1553,12 +1552,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
This is the start of the stable review cycle for the 4.19.171 release.
There are 58 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 27 Jan 2021 18:31:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.171-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.171-rc1
Dan Carpenter <dan.carpenter(a)oracle.com>
net: dsa: b53: fix an off by one in checking "vlan->vid"
Tariq Toukan <tariqt(a)nvidia.com>
net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: allow offloading of bridge on top of LAG
Matteo Croce <mcroce(a)microsoft.com>
ipv6: set multicast flag on the multicast route
Eric Dumazet <edumazet(a)google.com>
net_sched: reject silly cell_log in qdisc_get_rtab()
Eric Dumazet <edumazet(a)google.com>
net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
Matteo Croce <mcroce(a)microsoft.com>
ipv6: create multicast route with RTPROT_KERNEL
Guillaume Nault <gnault(a)redhat.com>
udp: mask TOS bits in udp_v4_early_demux()
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix incorrect arguments passing in kasan_add_zero_shadow
Lecopzer Chen <lecopzer(a)gmail.com>
kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow
Alexander Lobakin <alobakin(a)pm.me>
skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
Geert Uytterhoeven <geert+renesas(a)glider.be>
sh_eth: Fix power down vs. is_opened flag ordering
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext
Necip Fazil Yildiran <fazilyildiran(a)gmail.com>
sh: dma: fix kconfig dependency for G2_DMA
Guillaume Nault <gnault(a)redhat.com>
netfilter: rpfilter: mask ecn bits before fib lookup
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
driver core: Extend device_is_dependent()
JC Kuo <jckuo(a)nvidia.com>
xhci: tegra: Delay for disabling LFPS detector
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: make sure TRB is fully written before giving it to the controller
Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com>
usb: bdc: Make bdc pci driver depend on BROKEN
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: udc: core: Use lock when write to soft_connect
Ryan Chen <ryan_chen(a)aspeedtech.com>
usb: gadget: aspeed: fix stop dma register setting.
Longfang Liu <liulongfang(a)huawei.com>
USB: ehci: fix an interrupt calltrace error
Eugene Korenevsky <ekorenevsky(a)astralinux.ru>
ehci: fix EHCI host controller initialization sequence
Pali Rohár <pali(a)kernel.org>
serial: mvebu-uart: fix tx lost characters at power off
Wang Hui <john.wanghui(a)huawei.com>
stm class: Fix module init return on allocation failure
Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
intel_th: pci: Add Alder Lake-P support
Mathias Kresin <dev(a)kresin.me>
irqchip/mips-cpu: Set IPI domain parent chip
Lars-Peter Clausen <lars(a)metafoo.de>
iio: ad5504: Fix setting power-down state
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: peak_usb: fix use after free bugs
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: vxcan: vxcan_xmit: fix use after free bug
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: dev: can_restart: fix use after free bug
Hangbin Liu <liuhangbin(a)gmail.com>
selftests: net: fib_tests: remove duplicate log test
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: octeon: check correct size of maximum RECV_LEN packet
Arnd Bergmann <arnd(a)arndb.de>
scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/mmu: fix vram heap sizing
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/privring: ack interrupts the same way as RM
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/bios: fix issue shadowing expansion ROMs
David Woodhouse <dwmw(a)amazon.co.uk>
xen: Fix event channel callback via INTX/GSI
Peter Geis <pgwipeout(a)gmail.com>
clk: tegra30: Add hda clock default rates to clock driver
Seth Miller <miller.seth(a)gmail.com>
HID: Ignore battery for Elan touchscreen on ASUS UX550
Damien Le Moal <damien.lemoal(a)wdc.com>
riscv: Fix kernel time_init()
Nilesh Javali <njavali(a)marvell.com>
scsi: qedi: Correct max length of CHAP secret
Can Guo <cang(a)codeaurora.org>
scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
Anthony Iliopoulos <ailiop(a)suse.com>
dm integrity: select CRYPTO_SKCIPHER
Cezary Rojewski <cezary.rojewski(a)intel.com>
ASoC: Intel: haswell: Add missing pm_ops
Pan Bian <bianpan2016(a)163.com>
drm/atomic: put state on error path
Mikulas Patocka <mpatocka(a)redhat.com>
dm integrity: fix a crash if "recalculate" used without "internal_hash"
Hannes Reinecke <hare(a)suse.de>
dm: avoid filesystem lookup in dm_get_dev_t()
Alex Leibovich <alexl(a)marvell.com>
mmc: sdhci-xenon: fix 1.8v regulator stabilization
Peter Collingbourne <pcc(a)google.com>
mmc: core: don't initialize block size from ext_csd if not present
Josef Bacik <josef(a)toxicpanda.com>
btrfs: fix lockdep splat in btrfs_recover_relocation
Hans de Goede <hdegoede(a)redhat.com>
ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/via: Add minimum mute flag
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
Mikko Perttunen <mperttunen(a)nvidia.com>
i2c: bpmp-tegra: Ignore unknown I2C_M flags
-------------
Diffstat:
Makefile | 4 +-
arch/arm/xen/enlighten.c | 2 +-
arch/riscv/kernel/time.c | 3 +
arch/sh/drivers/dma/Kconfig | 3 +-
drivers/acpi/scan.c | 2 +
drivers/base/core.c | 17 ++++-
drivers/clk/tegra/clk-tegra30.c | 2 +
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +-
drivers/gpu/drm/nouveau/dispnv50/disp.h | 2 +-
drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 +--
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 6 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 +
drivers/hwtracing/intel_th/pci.c | 5 ++
drivers/hwtracing/stm/heartbeat.c | 6 +-
drivers/i2c/busses/i2c-octeon-core.c | 2 +-
drivers/i2c/busses/i2c-tegra-bpmp.c | 2 +-
drivers/iio/dac/ad5504.c | 4 +-
drivers/irqchip/irq-mips-cpu.c | 7 ++
drivers/md/Kconfig | 1 +
drivers/md/dm-integrity.c | 6 ++
drivers/md/dm-table.c | 15 +++-
drivers/mmc/core/queue.c | 4 +-
drivers/mmc/host/sdhci-xenon.c | 7 +-
drivers/net/can/dev.c | 4 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 +--
drivers/net/can/vxcan.c | 6 +-
drivers/net/dsa/b53/b53_common.c | 2 +-
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 4 ++
drivers/net/ethernet/mscc/ocelot.c | 4 +-
drivers/net/ethernet/renesas/sh_eth.c | 4 +-
drivers/platform/x86/intel-vbtn.c | 6 --
drivers/scsi/megaraid/megaraid_sas_base.c | 6 +-
drivers/scsi/qedi/qedi_main.c | 4 +-
drivers/scsi/ufs/ufshcd.c | 11 ++-
drivers/tty/serial/mvebu-uart.c | 10 ++-
drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 +-
drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
drivers/usb/gadget/udc/core.c | 13 +++-
drivers/usb/host/ehci-hcd.c | 12 ++++
drivers/usb/host/ehci-hub.c | 3 +
drivers/usb/host/xhci-ring.c | 2 +
drivers/usb/host/xhci-tegra.c | 7 ++
drivers/xen/events/events_base.c | 10 ---
drivers/xen/platform-pci.c | 1 -
drivers/xen/xenbus/xenbus.h | 1 +
drivers/xen/xenbus/xenbus_comms.c | 8 ---
drivers/xen/xenbus/xenbus_probe.c | 81 ++++++++++++++++++----
fs/btrfs/volumes.c | 2 +
include/xen/xenbus.h | 2 +-
mm/kasan/kasan_init.c | 23 +++---
net/core/dev.c | 5 ++
net/core/skbuff.c | 6 +-
net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
net/ipv4/udp.c | 3 +-
net/ipv6/addrconf.c | 3 +-
net/sched/cls_tcindex.c | 8 ++-
net/sched/sch_api.c | 3 +-
sound/core/seq/oss/seq_oss_synth.c | 3 +-
sound/pci/hda/patch_via.c | 1 +
sound/soc/intel/boards/haswell.c | 1 +
tools/testing/selftests/net/fib_tests.sh | 1 -
67 files changed, 290 insertions(+), 128 deletions(-)
On Tue, Jan 26, 2021 at 8:25 AM Mike Rapoport <rppt(a)linux.ibm.com> wrote:
>
> On Mon, Jan 25, 2021 at 09:46:19PM +0000, Chris Wilson wrote:
> >
> > CI does confirm that the revert of d3921cb8be29 brings the machines back
> > to life.
>
> I still cannot see what could possibly go wrong, so let's revert
> d3921cb8be29 for now and I'll continue to work with Chris to debug this.
Ok, reverted in my tree.
And added stable to the cc, so that they know not to pick up that
commit d3921cb8be29, despite it being marked for stable.
Linus