Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 23 Jul 2020 10:41:31 +0200
From:   "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
To:     WeitaoWang-oc <WeitaoWang-oc@zhaoxin.com>
Cc:     Alex Williamson <alex.williamson@redhat.com>,
        "mathias.nyman@linux.intel.com" <mathias.nyman@linux.intel.com>,
        "ulf.hansson@linaro.org" <ulf.hansson@linaro.org>,
        "vkoul@kernel.org" <vkoul@kernel.org>,
        "hslester96@gmail.com" <hslester96@gmail.com>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "Carsten_Schmid@mentor.com" <Carsten_Schmid@mentor.com>,
        "efremov@linux.com" <efremov@linux.com>,
        "Tony W. Wang(XA-RD)" <TonyWWang@zhaoxin.com>,
        "Cobe Chen(BJ-RD)" <CobeChen@zhaoxin.com>,
        "Tim Guo(BJ-RD)" <TimGuo@zhaoxin.com>,
        "wwt8723@163.com" <wwt8723@163.com>
Subject: Re: =?utf-8?B?562U5aSNOiBbUEFUQ0g=?= =?utf-8?Q?=5D?= USB:Fix kernel
 NULL pointer when unbind UHCI form vfio-pci
Message-ID: <20200723084131.GA1753458@kroah.com>
References: <1595419068-4812-1-git-send-email-WeitaoWang-oc@zhaoxin.com>
 <20200722215313.5a842b93@x1.home>
 <371b3697614e4034aed8e9f340a7dbf1@zhaoxin.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <371b3697614e4034aed8e9f340a7dbf1@zhaoxin.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Jul 23, 2020 at 08:36:25AM +0000, WeitaoWang-oc wrote:
> 
> On Thu,23 July 2020 04:18:00 +0000 Alex wrote:
> > On Wed, 22 Jul 2020 19:57:48 +0800
> > WeitaoWangoc <WeitaoWang-oc@zhaoxin.com> wrote:
> > 
> > >  drivers/usb/core/hcd-pci.c | 5 +++++
> > >  1 file changed, 5 insertions(+)
> > >
> > > diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
> > > index 1547aa6..484f2a0 100644
> > > --- a/drivers/usb/core/hcd-pci.c
> > > +++ b/drivers/usb/core/hcd-pci.c
> > > @@ -34,6 +34,7 @@ static DECLARE_RWSEM(companions_rwsem);
> > >  #define CL_OHCI                PCI_CLASS_SERIAL_USB_OHCI
> > >  #define CL_EHCI                PCI_CLASS_SERIAL_USB_EHCI
> > >
> > > +#define PCI_DEV_DRV_FLAG       2
> > >  static inline int is_ohci_or_uhci(struct pci_dev *pdev)  {
> > >         return pdev->class == CL_OHCI || pdev->class == CL_UHCI; @@
> > > -68,6 +69,8 @@ static void for_each_companion(struct pci_dev *pdev, struct
> > usb_hcd *hcd,
> > >                 if (companion->class != CL_UHCI && companion->class !=
> > CL_OHCI &&
> > >                                 companion->class != CL_EHCI)
> > >                         continue;
> > > +               if (!(companion->priv_flags & PCI_DEV_DRV_FLAG))
> > 
> > But pci_dev.priv_flags is private data for the driver that currently
> > owns the device, which could be vfio-pci.  This is really no different
> > than assuming the structure at device.driver_data.  If vfio-pci were to
> > make legitimate use of pci_dev.priv_flags, this could simply blow up
> > again.  Should there instead be some sort of registration interface
> > where hcd complaint drivers register their devices and only those
> > registered devices can have their driver private data arbitrarily poked
> > by another driver?  Thanks,
> 
> Thanks for your explanation. Set pci_dev.priv_flags is really not a 
> reasonable approach. Are there any more detailed suggestions 
> to patch this issue?

This is not a kernel issue, it is a "do not do this in this way from
userspace" issue :)

thanks,

greg k-h