Commit dda7e89e authored by Mathias Nyman's avatar Mathias Nyman Committed by Greg Kroah-Hartman
Browse files

xhci: Fix root hub port null pointer dereference in xhci tracepoints 



The pointer from a xhci usb virt device to its root hub port
(vdev->rhub_port) is set later when device is addressed, not while
vdev is allocated.

Tracepoints dereferenced this rhub_port pointer when freeing the virt
device, which causes null pointer dereference if tracing is enabled
and device is freed before addressed.

This can happen if tracing is enabled and xhci driver is unloaded before
a device is fully enumerated, or initial enumeration fails and device
is reset and freed before retry.

Don't dereference the rhub_port or show port numbers when tracing
xhci_free_virt_device(). This info is not very useful anyway.

Print the more useful slot id instead

Fixes: 06790c19 ("xhci: replace real & fake port with pointer to root hub port")
Reported-by: default avatarThinh Nguyen <Thinh.Nguyen@synopsys.com>
Closes: https://lore.kernel.org/linux-usb/20240402005007.klv2ij727fkz7rpd@synopsys.com/


Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240404121106.2842417-3-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5bfc311d

drivers/usb/host/xhci-trace.h

+5 −7
Original line number Diff line number Diff line
@@ -172,8 +172,7 @@ DECLARE_EVENT_CLASS(xhci_log_free_virt_dev, 
		__field(void *, vdev)

		__field(unsigned long long, out_ctx)

		__field(unsigned long long, in_ctx)

		__field(int, hcd_portnum)

		__field(int, hw_portnum)

		__field(int, slot_id)

		__field(u16, current_mel)



	),
@@ -181,13 +180,12 @@ DECLARE_EVENT_CLASS(xhci_log_free_virt_dev, 
		__entry->vdev = vdev;

		__entry->in_ctx = (unsigned long long) vdev->in_ctx->dma;

		__entry->out_ctx = (unsigned long long) vdev->out_ctx->dma;

		__entry->hcd_portnum = (int) vdev->rhub_port->hcd_portnum;

		__entry->hw_portnum = (int) vdev->rhub_port->hw_portnum;

		__entry->slot_id = (int) vdev->slot_id;

		__entry->current_mel = (u16) vdev->current_mel;

		),

	TP_printk("vdev %p ctx %llx | %llx hcd_portnum %d hw_portnum %d current_mel %d",

		__entry->vdev, __entry->in_ctx, __entry->out_ctx,

		__entry->hcd_portnum, __entry->hw_portnum, __entry->current_mel

	TP_printk("vdev %p slot %d ctx %llx | %llx current_mel %d",

		__entry->vdev, __entry->slot_id, __entry->in_ctx,

		__entry->out_ctx, __entry->current_mel

	)

);