linux-kernel-test/drivers/usb
Julius Werner 68e5254adb xhci: fix null-pointer dereference when destroying half-built segment rings
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
the tail to head at the end (forming a ring). When it bails out for OOM
reasons half-way through, it tries to destroy its half-built list with
xhci_free_segments_for_ring(), even though it is not a ring yet. This
causes a null-pointer dereference upon hitting the last element.

Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
the output parameters to be valid upon this kind of OOM failure, and
calls xhci_ring_free() on them. Since the (incomplete) list/ring should
already be destroyed in that case, this would lead to a use after free.

This patch fixes those issues by having xhci_alloc_segments_for_ring()
destroy its half-built, non-circular list manually and destroying the
invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().

This patch should be backported to kernels as old as 2.6.31, that
contains the commit 0ebbab3742 "USB: xhci:
Ring allocation and initialization."

A separate patch will need to be developed for kernels older than 3.4,
since the ring allocation code was refactored in that kernel.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
2012-11-12 11:45:29 -08:00
..
atm Merge branch 'for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq 2012-10-02 09:54:49 -07:00
c67x00
chipidea USB: EHCI: miscellaneous cleanups for the library conversion 2012-11-11 18:06:48 -08:00
class usb: acm: fix the computation of the number of data bits 2012-10-17 13:45:49 -07:00
core USB: report submission of active URBs 2012-11-11 18:10:46 -08:00
dwc3 usb: dwc3: patches for v3.8 2012-11-11 17:22:01 -08:00
early fix build of EHCI debug port code when USB_CHIPIDEA but !USB_EHCI_HCD 2012-11-02 10:13:33 -07:00
gadget usb: gadget: patches for v3.8 2012-11-11 17:31:53 -08:00
host xhci: fix null-pointer dereference when destroying half-built segment rings 2012-11-12 11:45:29 -08:00
image
misc Merge 3.7-rc3 into usb-next. 2012-10-29 09:04:39 -07:00
mon mm: kill vma flag VM_RESERVED and mm->reserved_vm counter 2012-10-09 16:22:19 +09:00
musb usb: gadget: patches for v3.8 2012-11-11 17:31:53 -08:00
otg usb: phy: mv_otg: use module_platform_driver macro 2012-10-16 12:49:12 +03:00
phy usb: phy: add R-Car USB phy driver 2012-11-01 12:17:53 +02:00
renesas_usbhs usb: gadget: patches for v3.8 2012-11-11 17:31:53 -08:00
serial USB: option: idVendor and idProduct are __le16 2012-10-31 12:58:12 -07:00
storage USB: ums_realtek: fix build warning 2012-10-30 13:22:22 -07:00
wusbcore WUSB: remove an unnused variable 2012-10-22 11:33:34 -07:00
Kconfig ARM: soc: general cleanups 2012-10-01 18:19:05 -07:00
Makefile usb: phy: Fix Kconfig dependency for Phy drivers 2012-06-26 16:14:33 -07:00
README
usb-common.c
usb-skeleton.c USB: usb-skeleton.c: fix compilation error and restored kref_put on fail in skel_open 2012-10-24 14:40:50 -07:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("khubd").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.