On Wed, 27 Jul 2016, Viresh Kumar wrote:
> If the hub gets disconnected while the core is still activating it, this
> can result in leaking memory of few USB structures.
>
> This will happen if we have done a kref_get() from hub_activate() and
> scheduled a delayed work item for HUB_INIT2/3. Now if hub_disconnect()
> gets called before the delayed work expires, then we will cancel the
> work from hub_quiesce(), but wouldn't do a kref_put(). And so the
> unbalance.
>
> kmemleak reports this as (with the commit e50293ef9775 backported to
> 3.10 kernel with other changes, though the same is true for mainline as
> well):
...
> Fix this by putting the reference in hub_quiesce() if we canceled a
> pending work.
>
> CC: <stable@xxxxxxxxxxxxxxx> #4.4+
> Fixes: e50293ef9775 ("USB: fix invalid memory access in hub_activate()")
> Signed-off-by: Viresh Kumar <viresh.kumar@xxxxxxxxxx>
> ---
> Greg,
>
> This is tested over 3.10 with backported patches only, sorry didn't had
> a mainline setup to test this out. :(
Arg. This is exactly the sort of thing I should have foreseen when
writing the earlier commit.
> drivers/usb/core/hub.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
> index bee13517676f..3173693fa8e3 100644
> --- a/drivers/usb/core/hub.c
> +++ b/drivers/usb/core/hub.c
> @@ -1315,7 +1315,8 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
> struct usb_device *hdev = hub->hdev;
> int i;
>
> - cancel_delayed_work_sync(&hub->init_work);
> + if (cancel_delayed_work_sync(&hub->init_work))
> + kref_put(&hub->kref, hub_release);
>
> /* hub_wq and related activity won't re-trigger */
> hub->quiescing = 1;
Another possibility is to remove the cancel_delayed_work_sync call
entirely. Either way, you can add
Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
Alan Stern
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
