@@ -651,8 +651,10 @@ int xhci_run(struct usb_hcd *hcd)
xhci_dbg_trace(xhci, trace_xhci_dbg_init, "xhci_run");
ret = xhci_try_enable_msi(hcd);
- if (ret)
+ if (ret) {
+ xhci_mem_cleanup(xhci);
return ret;
+ }
temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
temp_64 &= ~ERST_PTR_MASK;
@@ -683,8 +685,10 @@ int xhci_run(struct usb_hcd *hcd)
struct xhci_command *command;
command = xhci_alloc_command(xhci, false, GFP_KERNEL);
- if (!command)
+ if (!command) {
+ xhci_mem_cleanup(xhci);
return -ENOMEM;
+ }
ret = xhci_queue_vendor_command(xhci, command, 0, 0, 0,
TRB_TYPE(TRB_NEC_GET_FW));
xhci_pci_setup() is assigned to hc_driver.reset; xhci_run() is assigned to hc_driver.start(); xhci_stop() is assigned to hc_driver.stop(). xhci_pci_setup() calls xhci_gen_setup, which calls xhci_init(). And xhci_init() calls xhci_mem_init() to allocate resources. xhci_stop() calls xhci_mem_cleanup(), to release the resources allocated in xhci_mem_init() (also namely xhci_pci_setup()). xhci_run() can fail, because xhci_try_enable_msi() or xhci_alloc_command() in this function can fail. In drivers/usb/core/hcd.c: retval = hcd->driver->reset(hcd); if (retval < 0) { ...... goto err_hcd_driver_setup; } ...... retval = hcd->driver->start(hcd); if (retval < 0) { ...... goto err_hcd_driver_start; } ....... hcd->driver->stop(hcd); hcd->state = HC_STATE_HALT; clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); del_timer_sync(&hcd->rh_timer); err_hcd_driver_start: if (usb_hcd_is_primary_hcd(hcd) && hcd->irq > 0) free_irq(irqnum, hcd); err_request_irq: err_hcd_driver_setup: err_set_rh_speed: usb_put_invalidate_rhdev(hcd); err_allocate_root_hub: usb_deregister_bus(&hcd->self); err_register_bus: hcd_buffer_destroy(hcd); err_create_buf: usb_phy_roothub_power_off(hcd->phy_roothub); err_usb_phy_roothub_power_on: usb_phy_roothub_exit(hcd->phy_roothub); Thus, when hcd->driver->reset() succeeds and hcd->driver->start() fails, hcd->driver->stop() is not called. Namely, when xhci_pci_setup() successfully allocates resources, and xhci_run() fails, xhci_stop() is not called to release the resources. For this reason, resource leaks occur in this case. The ehci driver, uhci driver and ohci driver do not have such bugs: In the ehci driver, ehci_run() (namely hcd->driver->start()) never fails. In the uhci driver, all the resources are allocated in uhci_start (namely hcd->driver->start()), and no resources are allocated in uhci_pci_init() (namely hcd->driver->reset()). In the ohci driver, ohci_setup() (namely hcd->driver->reset()) also allocates resources. But when ohci_start() (namely hcd->driver->start()) is going to fail, ohci_stop() is directly called to release the resources allocated by ohci_setup(). Referring to the ohci driver, to fix these resource leaks, xhci_mem_cleanup() is called in error handling code of xhci_run(), to release the allocated resources. These bugs are found by a runtime fuzzing tool named FIZZER written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- drivers/usb/host/xhci.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)