Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
To:     mathias.nyman@intel.com, gregkh@linuxfoundation.org
Cc:     linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [PATCH] usb: xhci: Possible resource leaks when xhci_run() fails
Date:   Wed, 15 May 2019 09:50:33 +0800
Message-Id: <20190515015033.21113-1-baijiaju1990@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

xhci_pci_setup() is assigned to hc_driver.reset;
xhci_run() is assigned to hc_driver.start();
xhci_stop() is assigned to hc_driver.stop().

xhci_pci_setup() calls xhci_gen_setup, which calls xhci_init(). And
xhci_init() calls xhci_mem_init() to allocate resources.

xhci_stop() calls xhci_mem_cleanup(), to release the resources allocated
in xhci_mem_init() (also namely xhci_pci_setup()).

xhci_run() can fail, because xhci_try_enable_msi() or
xhci_alloc_command() in this function can fail.

In drivers/usb/core/hcd.c:
    retval = hcd->driver->reset(hcd);
    if (retval < 0) {
        ......
        goto err_hcd_driver_setup;
    }
    ......
    retval = hcd->driver->start(hcd);
    if (retval < 0) {
        ......
        goto err_hcd_driver_start;
    }
    .......
    hcd->driver->stop(hcd);
    hcd->state = HC_STATE_HALT;
    clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
    del_timer_sync(&hcd->rh_timer);
err_hcd_driver_start:
    if (usb_hcd_is_primary_hcd(hcd) && hcd->irq > 0)
        free_irq(irqnum, hcd);
err_request_irq:
err_hcd_driver_setup:
err_set_rh_speed:
    usb_put_invalidate_rhdev(hcd);
err_allocate_root_hub:
    usb_deregister_bus(&hcd->self);
err_register_bus:
    hcd_buffer_destroy(hcd);
err_create_buf:
    usb_phy_roothub_power_off(hcd->phy_roothub);
err_usb_phy_roothub_power_on:
    usb_phy_roothub_exit(hcd->phy_roothub);

Thus, when hcd->driver->reset() succeeds and hcd->driver->start() fails,
hcd->driver->stop() is not called.

Namely, when xhci_pci_setup() successfully allocates resources, and
xhci_run() fails, xhci_stop() is not called to release the resources.
For this reason, resource leaks occur in this case.

The ehci driver, uhci driver and ohci driver do not have such bugs:
In the ehci driver, ehci_run() (namely hcd->driver->start()) never
fails.
In the uhci driver, all the resources are allocated in uhci_start
(namely hcd->driver->start()), and no resources are allocated in
uhci_pci_init() (namely hcd->driver->reset()).
In the ohci driver, ohci_setup() (namely hcd->driver->reset()) also
allocates resources. But when ohci_start() (namely hcd->driver->start())
is going to fail, ohci_stop() is directly called to release the
resources allocated by ohci_setup().

Referring to the ohci driver, to fix these resource leaks,
xhci_mem_cleanup() is called in error handling code of xhci_run(),
to release the allocated resources.

These bugs are found by a runtime fuzzing tool named FIZZER written by
us.


Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
 drivers/usb/host/xhci.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7fa58c99f126..d18893cf03cb 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -651,8 +651,10 @@ int xhci_run(struct usb_hcd *hcd)
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "xhci_run");
 
 	ret = xhci_try_enable_msi(hcd);
-	if (ret)
+	if (ret) {
+		xhci_mem_cleanup(xhci);
 		return ret;
+	}
 
 	temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
 	temp_64 &= ~ERST_PTR_MASK;
@@ -683,8 +685,10 @@ int xhci_run(struct usb_hcd *hcd)
 		struct xhci_command *command;
 
 		command = xhci_alloc_command(xhci, false, GFP_KERNEL);
-		if (!command)
+		if (!command) {
+			xhci_mem_cleanup(xhci);
 			return -ENOMEM;
+		}
 
 		ret = xhci_queue_vendor_command(xhci, command, 0, 0, 0,
 				TRB_TYPE(TRB_NEC_GET_FW));
-- 
2.17.0