KASAN found a use-after-free in xhci_free_virt_device+0x33b/0x38e
where xhci_free_virt_device() sets slot id to 0 if udev exists:
if (dev->udev && dev->udev->slot_id)
dev->udev->slot_id = 0;
dev->udev will be true even if udev is freed because dev->udev is
not set to NULL.
set dev->udev pointer to NULL in xhci_free_dev()
The original patch went to stable so this fix needs to be applied
there as well.
Fixes: a400efe455f7 ("xhci: zero usb device slot_id member when disabling and freeing a xhci slot")
Cc: <stable(a)vger.kernel.org>
Reported-by: Guenter Roeck <linux(a)roeck-us.net>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Tested-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
---
drivers/usb/host/xhci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 9b27798..711da33 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3621,6 +3621,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
}
xhci_debugfs_remove_slot(xhci, udev->slot_id);
+ virt_dev->udev = NULL;
ret = xhci_disable_slot(xhci, udev->slot_id);
if (ret)
xhci_free_virt_device(xhci, udev->slot_id);
--
2.7.4
From: Hector Martin <marcan(a)marcan.st>
[ Upstream commit 188775181bc05f29372b305ef96485840e351fde ]
At least some JMicron controllers issue buggy oversized DMA reads when
fetching context descriptors, always fetching 0x20 bytes at once for
descriptors which are only 0x10 bytes long. This is often harmless, but
can cause page faults on modern systems with IOMMUs:
DMAR: [DMA Read] Request device [05:00.0] fault addr fff56000 [fault reason 06] PTE Read access is not set
firewire_ohci 0000:05:00.0: DMA context IT0 has stopped, error code: evt_descriptor_read
This works around the problem by always leaving 0x10 padding bytes at
the end of descriptor buffer pages, which should be harmless to do
unconditionally for controllers in case others have the same behavior.
Signed-off-by: Hector Martin <marcan(a)marcan.st>
Reviewed-by: Clemens Ladisch <clemens(a)ladisch.de>
Signed-off-by: Stefan Richter <stefanr(a)s5r6.in-berlin.de>
Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com>
---
drivers/firewire/ohci.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 8bf89267dc25..d731b413cb2c 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx)
return -ENOMEM;
offset = (void *)&desc->buffer - (void *)desc;
- desc->buffer_size = PAGE_SIZE - offset;
+ /*
+ * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
+ * for descriptors, even 0x10-byte ones. This can cause page faults when
+ * an IOMMU is in use and the oversized read crosses a page boundary.
+ * Work around this by always leaving at least 0x10 bytes of padding.
+ */
+ desc->buffer_size = PAGE_SIZE - offset - 0x10;
desc->buffer_bus = bus_addr + offset;
desc->used = 0;
--
2.15.1
Hi,
On stable v4.14.40-rc1, commit below breaks kernel boot on ARMv7 board
(Odroid XU3 with Samsung Exynos5422, exynos_defconfig). The kernel
hangs on "Starting kernel ...". Full log:
http://www.krzk.eu/#/builders/1/builds/1897
The board boots from TFTP with NFS root (NFSv4).
commit 449a8040a3b68a58131453b8f3dcfb411e85b1f5
Author: Paul E. McKenney <paulmck(a)linux.vnet.ibm.com>
Date: Mon Jan 8 14:35:52 2018 -0800
rcu: Create RCU-specific workqueues with rescuers
[ Upstream commit ad7c946b35ad455417fdd4bc0e17deda4011841b ]
Bisect log:
git bisect start
# good: [7d6240f0fb85430ae4f490824fdf8d0a078dfcd2] Linux 4.14.39
git bisect good 7d6240f0fb85430ae4f490824fdf8d0a078dfcd2
# bad: [c8cd674cefa12376b3f7f993ddb5b262f9c64dbf] Linux 4.14.40-rc1
git bisect bad c8cd674cefa12376b3f7f993ddb5b262f9c64dbf
# good: [f122a2d150d85721e1c48561ed9073154a9afcc8] bonding: fix the
err path for dev hwaddr sync in bond_enslave
git bisect good f122a2d150d85721e1c48561ed9073154a9afcc8
# good: [e353b1ee991a8aa64103db2b8dba975f1c7f1f0f] usb: dwc2: hcd: Fix
host channel halt flow
git bisect good e353b1ee991a8aa64103db2b8dba975f1c7f1f0f
# good: [95bcea0185094ba218ab24261658993a9af29d9f] serial: xuartps:
Fix out-of-bounds access through DT alias
git bisect good 95bcea0185094ba218ab24261658993a9af29d9f
# good: [58d6d43c0d69602b9325bbc6194188711d1132cd] crypto:
inside-secure - fix the extra cache computation
git bisect good 58d6d43c0d69602b9325bbc6194188711d1132cd
# good: [e1c90fdb0fd515dabb4e56a0cf5ebc276e16c3c7] drm: rcar-du: lvds:
Fix LVDS startup on R-Car Gen3
git bisect good e1c90fdb0fd515dabb4e56a0cf5ebc276e16c3c7
# good: [d3ab1eddcbca4b4eb8ba43451e04df07d2ca5c99] ARM: dts: imx7d:
cl-som-imx7: fix pinctrl_enet
git bisect good d3ab1eddcbca4b4eb8ba43451e04df07d2ca5c99
# good: [6a4469c29bddd0e7c646b2534787d47c77729720] ASoC: samsung: i2s:
Ensure the RCLK rate is properly determined
git bisect good 6a4469c29bddd0e7c646b2534787d47c77729720
# good: [60f7a71df26eca547c542d7d80895257ba10fda6] kdb: make "mdr"
command repeat
git bisect good 60f7a71df26eca547c542d7d80895257ba10fda6
# bad: [449a8040a3b68a58131453b8f3dcfb411e85b1f5] rcu: Create
RCU-specific workqueues with rescuers
git bisect bad 449a8040a3b68a58131453b8f3dcfb411e85b1f5
# good: [b5e56644256a462033f6b52212b9dd135e5fed10] xhci: Show what USB
release number the xHC supports from protocol capablity
git bisect good b5e56644256a462033f6b52212b9dd135e5fed10
# first bad commit: [449a8040a3b68a58131453b8f3dcfb411e85b1f5] rcu:
Create RCU-specific workqueues with rescuers
Let me know if you need any more information.
Best regards,
Krzysztof
From: Sudip Mukherjee <sudipm.mukherjee(a)gmail.com>
While whitelisting Micron M500DC drives, the tweaked blacklist entry
enabled queued TRIM for M500IT variants also. But these do not support
queued TRIM. And while using those SSDs with the latest kernel we have
seen errors and even the partition table getting corrupted.
Some part from the dmesg:
[ 6.727384] ata1.00: ATA-9: Micron_M500IT_MTFDDAK060MBD, MU01, max UDMA/133
[ 6.727390] ata1.00: 117231408 sectors, multi 16: LBA48 NCQ (depth 31/32), AA
[ 6.741026] ata1.00: supports DRM functions and may not be fully accessible
[ 6.759887] ata1.00: configured for UDMA/133
[ 6.762256] scsi 0:0:0:0: Direct-Access ATA Micron_M500IT_MT MU01 PQ: 0 ANSI: 5
and then for the error:
[ 120.860334] ata1.00: exception Emask 0x1 SAct 0x7ffc0007 SErr 0x0 action 0x6 frozen
[ 120.860338] ata1.00: irq_stat 0x40000008
[ 120.860342] ata1.00: failed command: SEND FPDMA QUEUED
[ 120.860351] ata1.00: cmd 64/01:00:00:00:00/00:00:00:00:00/a0 tag 0 ncq dma 512 out
res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x5 (timeout)
[ 120.860353] ata1.00: status: { DRDY }
[ 120.860543] ata1: hard resetting link
[ 121.166128] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[ 121.166376] ata1.00: supports DRM functions and may not be fully accessible
[ 121.186238] ata1.00: supports DRM functions and may not be fully accessible
[ 121.204445] ata1.00: configured for UDMA/133
[ 121.204454] ata1.00: device reported invalid CHS sector 0
[ 121.204541] sd 0:0:0:0: [sda] tag#18 UNKNOWN(0x2003) Result: hostbyte=0x00 driverbyte=0x08
[ 121.204546] sd 0:0:0:0: [sda] tag#18 Sense Key : 0x5 [current]
[ 121.204550] sd 0:0:0:0: [sda] tag#18 ASC=0x21 ASCQ=0x4
[ 121.204555] sd 0:0:0:0: [sda] tag#18 CDB: opcode=0x93 93 08 00 00 00 00 00 04 28 80 00 00 00 30 00 00
[ 121.204559] print_req_error: I/O error, dev sda, sector 272512
After few reboots with these errors, and the SSD is corrupted.
After blacklisting it, the errors are not seen and the SSD does not get
corrupted any more.
We know that M500IT MG02 and M500DC support this feature, Martin asked
Micron for a list of SSDs which have support for this feature. But there
was no reply. It is best to blacklst all Micron SSDs for now, except the
known two variants, to prevent corrupting other Micron SSDs which do not
support this.
Fixes: 243918be6393 ("libata: Do not blacklist Micron M500DC")
Cc: stable(a)vger.kernel.org
Cc: Martin K. Petersen <martin.petersen(a)oracle.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee(a)gmail.com>
---
v1: Only M500IT MU01 was blacklisted.
v2: Whitelist M500IT BG02 and M500DC and then blacklist all other Micron.
drivers/ata/libata-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8bc71ca61e7f..df5d716c0a07 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4550,7 +4550,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
ATA_HORKAGE_NOLPM, },
/* devices that don't properly handle queued TRIM commands */
- { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ { "Micron_M500DC*", NULL, 0},
+ { "Micron_M500IT_*", "MG02", 0},
+ { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
ATA_HORKAGE_ZERO_AFTER_TRIM, },
{ "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
ATA_HORKAGE_ZERO_AFTER_TRIM, },
--
2.11.0