target/linux/generic/pending-4.4/082-0002-usb-core-usb_alloc_dev-fix-setting-of-portnum.patch

   1 From 7222c832254a75dcd67d683df75753d4a4e125bb Mon Sep 17 00:00:00 2001
   2 From: Nicolai Stange <nicstange@gmail.com>
   3 Date: Thu, 17 Mar 2016 23:53:02 +0100
   4 Subject: [PATCH] usb/core: usb_alloc_dev(): fix setting of ->portnum
   5
   6 With commit 69bec7259853 ("USB: core: let USB device know device node"),
   7 the port1 argument of usb_alloc_dev() gets overwritten as follows:
   8
   9   ... usb_alloc_dev(..., unsigned port1)
  10   {
  11     ...
  12     if (!parent->parent) {
  13       port1 = usb_hcd_find_raw_port_number(..., port1);
  14     }
  15     ...
  16   }
  17
  18 Later on, this now overwritten port1 gets assigned to ->portnum:
  19
  20   dev->portnum = port1;
  21
  22 However, since xhci_find_raw_port_number() isn't idempotent, the
  23 aforementioned commit causes a number of KASAN splats like the following:
  24
  25   BUG: KASAN: slab-out-of-bounds in xhci_find_raw_port_number+0x98/0x170
  26                                        at addr ffff8801d9311670
  27   Read of size 8 by task kworker/2:1/87
  28   [...]
  29   Workqueue: usb_hub_wq hub_event
  30    0000000000000188 000000005814b877 ffff8800cba17588 ffffffff8191447e
  31    0000000041b58ab3 ffffffff82a03209 ffffffff819143a2 ffffffff82a252f4
  32    ffff8801d93115e0 0000000000000188 ffff8801d9311628 ffff8800cba17588
  33   Call Trace:
  34    [<ffffffff8191447e>] dump_stack+0xdc/0x15e
  35    [<ffffffff819143a2>] ? _atomic_dec_and_lock+0xa2/0xa2
  36    [<ffffffff814e2cd1>] ? print_section+0x61/0xb0
  37    [<ffffffff814e4939>] print_trailer+0x179/0x2c0
  38    [<ffffffff814f0d84>] object_err+0x34/0x40
  39    [<ffffffff814f4388>] kasan_report_error+0x2f8/0x8b0
  40    [<ffffffff814eb91e>] ? __slab_alloc+0x5e/0x90
  41    [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130
  42    [<ffffffff814f5091>] kasan_report+0x71/0xa0
  43    [<ffffffff814ec082>] ? kmem_cache_alloc_trace+0x212/0x560
  44    [<ffffffff81d99468>] ? xhci_find_raw_port_number+0x98/0x170
  45    [<ffffffff814f33d4>] __asan_load8+0x64/0x70
  46    [<ffffffff81d99468>] xhci_find_raw_port_number+0x98/0x170
  47    [<ffffffff81db0105>] xhci_setup_addressable_virt_dev+0x235/0xa10
  48    [<ffffffff81d9ea51>] xhci_setup_device+0x3c1/0x1430
  49    [<ffffffff8121cddd>] ? trace_hardirqs_on+0xd/0x10
  50    [<ffffffff81d9fac0>] ? xhci_setup_device+0x1430/0x1430
  51    [<ffffffff81d9fad3>] xhci_address_device+0x13/0x20
  52    [<ffffffff81d2081a>] hub_port_init+0x55a/0x1550
  53    [<ffffffff81d28705>] hub_event+0xef5/0x24d0
  54    [<ffffffff81d27810>] ? hub_port_debounce+0x2f0/0x2f0
  55    [<ffffffff8195e1ee>] ? debug_object_deactivate+0x1be/0x270
  56    [<ffffffff81210203>] ? print_rt_rq+0x53/0x2d0
  57    [<ffffffff8121657d>] ? trace_hardirqs_off+0xd/0x10
  58    [<ffffffff8226acfb>] ? _raw_spin_unlock_irqrestore+0x5b/0x60
  59    [<ffffffff81250000>] ? irq_domain_set_hwirq_and_chip+0x30/0xb0
  60    [<ffffffff81256339>] ? debug_lockdep_rcu_enabled+0x39/0x40
  61    [<ffffffff812178c0>] ? __lock_is_held+0x90/0x130
  62    [<ffffffff81196877>] process_one_work+0x567/0xec0
  63   [...]
  64
  65 Afterwards, xhci reports some functional errors:
  66
  67   xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
  68                                 code 0x11.
  69   xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
  70                                 code 0x11.
  71   usb 4-3: device not accepting address 2, error -22
  72
  73 Fix this by not overwriting the port1 argument in usb_alloc_dev(), but
  74 storing the raw port number as required by OF in an additional variable,
  75 raw_port.
  76
  77 Fixes: 69bec7259853 ("USB: core: let USB device know device node")
  78 Signed-off-by: Nicolai Stange <nicstange@gmail.com>
  79 Acked-by: Alan Stern <stern@rowland.harvard.edu>
  80 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  81 ---
  82  drivers/usb/core/usb.c | 5 +++--
  83  1 file changed, 3 insertions(+), 2 deletions(-)
  84
  85 --- a/drivers/usb/core/usb.c
  86 +++ b/drivers/usb/core/usb.c
  87 @@ -423,6 +423,7 @@ struct usb_device *usb_alloc_dev(struct
  88         struct usb_device *dev;
  89         struct usb_hcd *usb_hcd = bus_to_hcd(bus);
  90         unsigned root_hub = 0;
  91 +       unsigned raw_port = port1;
  92
  93         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
  94         if (!dev)
  95 @@ -497,11 +498,11 @@ struct usb_device *usb_alloc_dev(struct
  96
  97                 if (!parent->parent) {
  98                         /* device under root hub's port */
  99 -                       port1 = usb_hcd_find_raw_port_number(usb_hcd,
 100 +                       raw_port = usb_hcd_find_raw_port_number(usb_hcd,
 101                                 port1);
 102                 }
 103                 dev->dev.of_node = usb_of_get_child_node(parent->dev.of_node,
 104 -                               port1);
 105 +                               raw_port);
 106
 107                 /* hub driver sets up TT records */
 108         }