Skip to contentSkip to conversation

xhci: Add an assertion to check for virt_dev=0 bug.

PATCH In review Matt Evans 2 participants 2 messages Mar 25, 2011 – Mar 28, 2011

Subsystems (2)
USB USB xHCI driver
lore
Share & tools
lore

Matt Evans

author
#0 lore raw

PATCH 4/5 xhci: Add an assertion to check for virt_dev=0 bug.

During a "plug-unplug" stress test on an NEC xHCI card, a null pointer dereference was observed. xhci_address_device() dereferenced a null virt_dev (possibly an erroneous udev->slot_id?); this patch adds a WARN_ON & message to aid debug if it can be recreated.

Signed-off-by Matt Evans <[email protected]>
---
 drivers/usb/host/xhci.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)
drivers/usb/host/xhci.c +11 -0
index 88e6298..7d43456 100644
@@ -2542,6 +2542,17 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
 
 	virt_dev = xhci->devs[udev->slot_id];
 
+	if (WARN_ON(!virt_dev)) {
+		/*
+		 * In plug/unplug torture test with an NEC controller,
+		 * a zero-dereference was observed once due to virt_dev = 0.
+		 * Print useful debug rather than crash if it is observed again!
+		 */
+		xhci_warn(xhci, "Virt dev invalid for slot_id 0x%x!\n",
+			udev->slot_id);
+		return -EINVAL;
+	}
+
 	slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->in_ctx);
 	/*
 	 * If this is the first Set Address since device plug-in or
Signature · 1 line
1.7.0.4
#1 lore raw
Quoted 4 lines · Matt Evans

During a "plug-unplug" stress test on an NEC xHCI card, a null pointer dereference was observed. xhci_address_device() dereferenced a null virt_dev (possibly an erroneous udev->slot_id?); this patch adds a WARN_ON & message to aid debug if it can be recreated.

Hmm, that's interesting. I haven't seen any null pointer dereferences during my tests, but perhaps I'm not being ADDH enough about randomly unplugging devices. :) Let me know if you trigger this again.

Sarah Sharp

Quoted 30 lines
Signed-off-by Matt Evans <[email protected]>
---
 drivers/usb/host/xhci.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)
drivers/usb/host/xhci.c +11 -0
index 88e6298..7d43456 100644
@@ -2542,6 +2542,17 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
 
 	virt_dev = xhci->devs[udev->slot_id];
 
+	if (WARN_ON(!virt_dev)) {
+		/*
+		 * In plug/unplug torture test with an NEC controller,
+		 * a zero-dereference was observed once due to virt_dev = 0.
+		 * Print useful debug rather than crash if it is observed again!
+		 */
+		xhci_warn(xhci, "Virt dev invalid for slot_id 0x%x!\n",
+			udev->slot_id);
+		return -EINVAL;
+	}
+
 	slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->in_ctx);
 	/*
 	 * If this is the first Set Address since device plug-in or
Signature · 1 line
1.7.0.4