diff options
| author | Joe Lawrence <[email protected]> | 2016-02-03 17:51:12 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2016-02-05 01:00:10 +0000 |
| commit | 89140fdaf11aec81e93d5590a993720f2ef0d26e (patch) | |
| tree | c7abad88a88cfe4fe2d599eff868a59e18f16f17 /fs/btrfs/dev-replace.c | |
| parent | Merge tag 'fixes-for-v4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/g... (diff) | |
| download | kernel-89140fdaf11aec81e93d5590a993720f2ef0d26e.tar.gz kernel-89140fdaf11aec81e93d5590a993720f2ef0d26e.zip | |
xhci: harden xhci_find_next_ext_cap against device removal
xhci_find_next_ext_cap doesn't check for PCI hotplug removal and may use
the PCI master abort bit pattern (~0) to calculate a new PCI address
offset to read/write. The has lead to reproducable crashes when testing
surprise removal during device initialization on a Stratus platform, at
least after commit d5ddcdf4d672 ("xhci: rework xhci extended capability
list parsing functions").
The crash is repeatable on a Stratus platform when injecting hardware
faults to induce xHCI host controller hotplug during driver
initialization. If a PCI read in xhci_find_next_ext_cap returns the
master abort pattern, quirk_usb_handoff_xhci may start using a bogus
ext_cap_offset to start searching more bogus PCI addresses.
Signed-off-by: Joe Lawrence <[email protected]>
Acked-by: Mathias Nyman <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'fs/btrfs/dev-replace.c')
0 files changed, 0 insertions, 0 deletions