From patchwork Wed Dec 5 09:42:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 152882 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp9092819ljp; Wed, 5 Dec 2018 01:45:53 -0800 (PST) X-Google-Smtp-Source: AFSGD/UmQopic/J4NnlpaxTm+lxMB2RqHbvwzfIX1LqbA5ni02Spol8reqClLvTV71mPmqXx5j2F X-Received: by 2002:a62:4156:: with SMTP id o83mr23511275pfa.72.1544003153368; Wed, 05 Dec 2018 01:45:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1544003153; cv=none; d=google.com; s=arc-20160816; b=PlGzs9ae2Xs/Jvj6OT91PcLKAtjATF8cY8efH1W+aUAmy3yVRfJwmcGYaLQh1JmwK2 078RqkDL2dkk8CtY57sAh9VEacMGeB01e0x+edhOkfDnxcX6iv7E5Ge39B57J2j/BSsk U1DpjB9o7n1oeV7pvLVTWi2ykLrVKq2kGbIkWl3cwqWROs2F7OLqvhHBgQ5SrBZsVNdt ACJLeOCYU+hX9a+FeaAU0mWjQuNGBb7toWAtMVc8CAeZLTBFJczAyImcyM5mmY8nAbrb 5VYDMLiEOrtUcuzjkE9ua6x2brzKqy68eAPz8IcqZyfDU82u+bXFLDzM5XaC5pZA6TKW Y8zg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=0mzRNwhTxIg9+jDx1XkNkIL6U8wKN/jpVjKZ9CisywE=; b=Ktb31XSWq5wjpM2M6wKumVrdTqHjUqL80kDHnu5Lu5SuGAFjOlz5w4xaMhegPuOe71 Qx6s70NASLOhbObHruTduexLGU4obxsPkp6YmYxiB0fI5dLoZqzT/RNhmNuq4D0OIS2k cYNxxLfqQVpeZS7RCaGOiRRCuSicaTSN2roXcrm4/PRdDuxQRvZF8pgH/DQGAxizdKA1 jDq0LCYeBXkwLnnYBvBWARPYk8zhlz2p9HVkcK1E1JNTwK09iKkIGWYMhytRPsd93CFc Thgr5kim03RxMl9/SiVwzCEFai30ifNRH91mS1pDtC0my6k2Cd4z1XoppOnbOuEoybs+ LgMg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="1/V4mhlL"; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bg7si19226879plb.149.2018.12.05.01.45.53; Wed, 05 Dec 2018 01:45:53 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="1/V4mhlL"; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728954AbeLEJpw (ORCPT + 15 others); Wed, 5 Dec 2018 04:45:52 -0500 Received: from mail.kernel.org ([198.145.29.99]:50694 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729192AbeLEJpv (ORCPT ); Wed, 5 Dec 2018 04:45:51 -0500 Received: from sasha-vm.mshome.net (unknown [213.57.143.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DD43920878; Wed, 5 Dec 2018 09:45:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544003150; bh=3vGwVMEMlLYDWVhD1VGjQU1Nm5BnbDVeD+MI+GhG7QE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1/V4mhlLN9Kk3Ib4UlVFYmycCDuy129nedM8RZiK9t6aOMp7Wha1ozYflHWZPmWTs d7LjU26Vl7oD2okFAXNwRMDI/rs+6EciIjZs9bacBKb1YAsXzibrPwuAzY8sBvaWZi 9suVQz1SxhoiduSThx1OBm4NDqkkI6CNWQDTTM8I= From: Sasha Levin To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Marek Szyprowski , Felipe Balbi , Sasha Levin , linux-usb@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 45/69] usb: gadget: u_ether: fix unsafe list iteration Date: Wed, 5 Dec 2018 04:42:23 -0500 Message-Id: <20181205094247.6556-45-sashal@kernel.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181205094247.6556-1-sashal@kernel.org> References: <20181205094247.6556-1-sashal@kernel.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marek Szyprowski [ Upstream commit c9287fa657b3328b4549c0ab39ea7f197a3d6a50 ] list_for_each_entry_safe() is not safe for deleting entries from the list if the spin lock, which protects it, is released and reacquired during the list iteration. Fix this issue by replacing this construction with a simple check if list is empty and removing the first entry in each iteration. This is almost equivalent to a revert of the commit mentioned in the Fixes: tag. This patch fixes following issue: --->8--- Unable to handle kernel NULL pointer dereference at virtual address 00000104 pgd = (ptrval) [00000104] *pgd=00000000 Internal error: Oops: 817 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 84 Comm: kworker/1:1 Not tainted 4.20.0-rc2-next-20181114-00009-g8266b35ec404 #1061 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) Workqueue: events eth_work PC is at rx_fill+0x60/0xac LR is at _raw_spin_lock_irqsave+0x50/0x5c pc : [] lr : [] psr: 80000093 sp : ee7fbee8 ip : 00000100 fp : 00000000 r10: 006000c0 r9 : c10b0ab0 r8 : ee7eb5c0 r7 : ee7eb614 r6 : ee7eb5ec r5 : 000000dc r4 : ee12ac00 r3 : ee12ac24 r2 : 00000200 r1 : 60000013 r0 : ee7eb5ec Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 6d5dc04a DAC: 00000051 Process kworker/1:1 (pid: 84, stack limit = 0x(ptrval)) Stack: (0xee7fbee8 to 0xee7fc000) ... [] (rx_fill) from [] (process_one_work+0x200/0x738) [] (process_one_work) from [] (worker_thread+0x2c/0x4c8) [] (worker_thread) from [] (kthread+0x128/0x164) [] (kthread) from [] (ret_from_fork+0x14/0x20) Exception stack(0xee7fbfb0 to 0xee7fbff8) ... ---[ end trace 64480bc835eba7d6 ]--- Fixes: fea14e68ff5e ("usb: gadget: u_ether: use better list accessors") Signed-off-by: Marek Szyprowski Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/gadget/function/u_ether.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) -- 2.17.1 diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index bdbc3fdc7c4f..3a0e4f5d7b83 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -405,12 +405,12 @@ static int alloc_requests(struct eth_dev *dev, struct gether *link, unsigned n) static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags) { struct usb_request *req; - struct usb_request *tmp; unsigned long flags; /* fill unused rxq slots with some skb */ spin_lock_irqsave(&dev->req_lock, flags); - list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) { + while (!list_empty(&dev->rx_reqs)) { + req = list_first_entry(&dev->rx_reqs, struct usb_request, list); list_del_init(&req->list); spin_unlock_irqrestore(&dev->req_lock, flags); @@ -1125,7 +1125,6 @@ void gether_disconnect(struct gether *link) { struct eth_dev *dev = link->ioport; struct usb_request *req; - struct usb_request *tmp; WARN_ON(!dev); if (!dev) @@ -1142,7 +1141,8 @@ void gether_disconnect(struct gether *link) */ usb_ep_disable(link->in_ep); spin_lock(&dev->req_lock); - list_for_each_entry_safe(req, tmp, &dev->tx_reqs, list) { + while (!list_empty(&dev->tx_reqs)) { + req = list_first_entry(&dev->tx_reqs, struct usb_request, list); list_del(&req->list); spin_unlock(&dev->req_lock); @@ -1154,7 +1154,8 @@ void gether_disconnect(struct gether *link) usb_ep_disable(link->out_ep); spin_lock(&dev->req_lock); - list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) { + while (!list_empty(&dev->rx_reqs)) { + req = list_first_entry(&dev->rx_reqs, struct usb_request, list); list_del(&req->list); spin_unlock(&dev->req_lock);