linux/drivers/usb
Douglas Anderson 16e8021881 usb: dwc2: host: Avoid use of chan->qh after qh freed
When poking around with USB devices with slub_debug enabled, I found
another obvious use after free.  Turns out that in dwc2_hc_n_intr() I
was in a state when the contents of chan->qh was filled with 0x6b,
indicating that chan->qh was freed but chan still had a reference to
it.

Let's make sure that whenever we free qh we also make sure we remove a
reference from its channel.

The bug fixed here doesn't appear to be new--I believe I just got lucky
and happened to see it while stress testing.

Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2016-03-04 15:14:40 +02:00
..
atm USB: cxacru: fix an bounds check warning 2016-02-03 13:52:10 -08:00
c67x00 c67x00-hcd: use USB_DT_HUB 2015-04-03 19:03:16 +02:00
chipidea usb: chipidea: otg: add A idle to B disconnect timer 2016-03-04 15:14:38 +02:00
class usb: usbtmc: Fix disconnect/poll interaction 2016-02-20 20:21:53 -08:00
common usb: common: otg-fsm: add HNP polling support 2016-03-04 15:14:36 +02:00
core Merge 4.5-rc6 into usb-next 2016-03-01 16:13:54 -08:00
dwc2 usb: dwc2: host: Avoid use of chan->qh after qh freed 2016-03-04 15:14:40 +02:00
dwc3 usb: dwc3: Validate the maximum_speed parameter 2016-03-04 15:14:38 +02:00
early
gadget usb: gadget: composite: handle otg status selector request from OTG host 2016-03-04 15:14:36 +02:00
host usb: fsl: drop USB_FSL_MPH_DR_OF Kconfig symbol 2016-03-04 15:14:29 +02:00
image scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
isp1760 usb: isp1760: udc: add ep capabilities support 2015-08-04 12:26:55 -05:00
misc usb/misc/chaoskey: introduce an URB for asynchronous reads 2016-02-20 20:12:21 -08:00
mon usb: core: rename mutex usb_bus_list_lock to usb_bus_idr_lock 2016-02-06 21:55:57 -08:00
musb usb: musb: sunxi: support module autoloading 2016-03-04 15:14:38 +02:00
phy usb: phy: phy-am335x: remove include of regulator/consumer.h 2016-03-04 15:14:31 +02:00
renesas_usbhs usb: renesas_usbhs: Don't check CSSTS bit if peripheral mode 2016-03-04 15:14:28 +02:00
serial USB: option: add "4G LTE usb-modem U901" 2016-02-18 13:08:03 +01:00
storage usb: storage: use usb_store_dbg instead of US_DEBUGPX 2016-02-20 20:21:53 -08:00
usbip usb: usbip: Fix possible deadlocks reported by lockdep 2016-02-03 13:52:10 -08:00
wusbcore USB: core, wusbcore: use bus_to_hcd 2016-01-24 21:00:33 -08:00
Kconfig
Makefile usb: fsl: drop USB_FSL_MPH_DR_OF Kconfig symbol 2016-03-04 15:14:29 +02:00
README
usb-skeleton.c

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.