• Dmitry Osipenko's avatar
    usb: otg-fsm: Fix hrtimer list corruption · bf88fef0
    Dmitry Osipenko authored
    The HNP work can be re-scheduled while it's still in-fly. This results in
    re-initialization of the busy work, resetting the hrtimer's list node of
    the work and crashing kernel with null dereference within kernel/timer
    once work's timer is expired. It's very easy to trigger this problem by
    re-plugging USB cable quickly. Initialize HNP work only once to fix this
    trouble.
    
     Unable to handle kernel NULL pointer dereference at virtual address 00000126)
     ...
     PC is at __run_timers.part.0+0x150/0x228
     LR is at __next_timer_interrupt+0x51/0x9c
     ...
     (__run_timers.part.0) from [<c0187a2b>] (run_timer_softirq+0x2f/0x50)
     (run_timer_softirq) from [<c01013ad>] (__do_softirq+0xd5/0x2f0)
     (__do_softirq) from [<c012589b>] (irq_exit+0xab/0xb8)
     (irq_exit) from [<c0170341>] (handle_domain_irq+0x45/0x60)
     (handle_domain_irq) from [<c04c4a43>] (gic_handle_irq+0x6b/0x7c)
     (gic_handle_irq) from [<c0100b65>] (__irq_svc+0x65/0xac)
    
    Cc: stable@vger.kernel.org
    Acked-by: default avatarPeter Chen <peter.chen@kernel.org>
    Signed-off-by: default avatarDmitry Osipenko <digetx@gmail.com>
    Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    bf88fef0
usb-otg-fsm.c 11.7 KB