github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-20 19:01:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
185a4caeec
linux/drivers/usb/fotg210
History
Dawei Feng b9399d25fb usb: free iso schedules on failed submit 
EHCI and FOTG210 isochronous submits build an ehci_iso_sched before
linking the URB to the endpoint queue, and keep the staged schedule in
urb->hcpriv until iso_stream_schedule() and the link helpers consume it.
If the controller is no longer accessible, or usb_hcd_link_urb_to_ep()
fails, submit jumps to done_not_linked before that handoff happens and
leaks the staged schedule still attached to urb->hcpriv.

Free the staged schedule from done_not_linked when submit fails before
the URB is linked and clear urb->hcpriv after the free.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. As we do not have an
EHCI host controller with a USB isochronous device to test with, no
runtime testing was able to be performed.

Fixes: 8de9840265 ("[PATCH] USB: Fix USB suspend/resume crasher (#2)")
Fixes: e9df41c5c5 ("USB: make HCDs responsible for managing endpoint queues")
Fixes: 7d50195f6c ("usb: host: Faraday fotg210-hcd driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260630071419.349161-1-dawei.feng@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-08 13:30:38 +02:00
..
fotg210-core.c USB: Use str_enable_disable-like helpers 2025-01-15 18:28:13 +01:00
fotg210-hcd.c usb: free iso schedules on failed submit 2026-07-08 13:30:38 +02:00
fotg210-hcd.h usb: fotg210: Acquire memory resource in core 2023-01-19 14:10:43 +01:00
fotg210-udc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fotg210-udc.h fotg210-udc: Improve device initialization 2023-01-24 18:12:18 +01:00
fotg210.h usb: fotg210-udc: Implement VBUS session 2023-01-19 14:10:44 +01:00
Kconfig usb: fotg210: fix a Kconfig spelling mistake 2023-01-25 15:43:24 +01:00
Makefile usb: fotg210: Use *-y instead of *-objs in Makefile 2024-05-10 10:36:35 +01:00