Re: Possible race in 4.14 xhci stack

Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> · Fri, 23 Jul 2021 22:43:43 +0300

On 21.7.2021 11.14, Greg KH wrote:
> On Wed, Jul 21, 2021 at 07:51:58AM +0000, Schmid, Carsten wrote:
>> Hi Greg,
>>
>>>> Hi Mathias,
>>>>
>>>> i got a NULL pointer deref in the usbfs and analyzed it.
>>>> The connected device seemed to have trouble on USB transmissions.
>>>> However, I have the impression that there is a race between finishing URB handling and disconnection of devices.
>>>> In detail:
>>>> [ 4979.029666] xhci_hcd 0000:00:15.0: USB transfer error. Maybe the USB cable is bad?
>>>
>>> Did your cable die?
>>>
>>> And 4.14 is quite old, what about 5.13?
>>>
>>> thanks,
>>>
>>> greg k-h
>>
>> That was reported from a device in the field.
>> Yes, a defective cable is bad, but shouldn't the kernel's health avoid a NULL pointer deref?
> 
> Yes, I am not disagreeing about that, patches always welcome :)

Current kernel already has a cure for the symptom, avoiding the NULL pointer deref:

struct xhci_ring *xhci_triad_to_transfer_ring(...)
{
	struct xhci_virt_ep *ep;

	ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
	if (!ep)
		return NULL;
	...
}

I'm still on vacation next week, but after that we could look closer at the root cause.

Thanks,
Mathias