redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

xhci: Fix invalid loop check in xhci_free_tt_info()

Browse source 
xhci_free_tt_info() may access the invalid memory when it removes the
last entry but the list is not empty.  Then tt_next reaches to the
list head but it still tries to check the tt_info of that entry.

This patch fixes the bug and cleans up the messy code by rewriting
with a simple list_for_each_entry_safe().

This patch should be backported to kernels as old as 3.2, that contain
the commit 839c817ce6 "xhci: Store
information about roothubs and TTs."

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reviewed-by: Oliver Neukum <oneukum@suse.de>
Cc: <stable@vger.kernel.org>
This commit is contained in:
Takashi Iwai 2012-06-01 10:06:23 +02:00 committed by Sarah Sharp
parent e25e62aeca
commit 46ed8f00d8
1 changed files with 10 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
drivers/usb/host/xhci-mem.c
View file

@ -793,10 +793,9 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci,
struct xhci_virt_device *virt_dev,
int slot_id)
{
struct list_head *tt;
struct list_head *tt_list_head;
struct list_head *tt_next;
struct xhci_tt_bw_info *tt_info;
struct xhci_tt_bw_info *tt_info, *next;
bool slot_found = false;
/* If the device never made it past the Set Address stage,
* it may not have the real_port set correctly.
@ -808,34 +807,16 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci,
}
tt_list_head = &(xhci->rh_bw[virt_dev->real_port - 1].tts);
if (list_empty(tt_list_head))
return;
list_for_each(tt, tt_list_head) {
tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
if (tt_info->slot_id == slot_id)
list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
/* Multi-TT hubs will have more than one entry */
if (tt_info->slot_id == slot_id) {
slot_found = true;
list_del(&tt_info->tt_list);
kfree(tt_info);
} else if (slot_found) {
break;
}
}
/* Cautionary measure in case the hub was disconnected before we
* stored the TT information.
*/
if (tt_info->slot_id != slot_id)
return;
tt_next = tt->next;
tt_info = list_entry(tt, struct xhci_tt_bw_info,
tt_list);
/* Multi-TT hubs will have more than one entry */
do {
list_del(tt);
kfree(tt_info);
tt = tt_next;
if (list_empty(tt_list_head))
break;
tt_next = tt->next;
tt_info = list_entry(tt, struct xhci_tt_bw_info,
tt_list);
} while (tt_info->slot_id == slot_id);
}
int xhci_alloc_tt_info(struct xhci_hcd *xhci,