948ff2f214
commit bf88fef0b6f1488abeca594d377991171c00e52a upstream. The HNP work can be re-scheduled while it's still in-fly. This results in re-initialization of the busy work, resetting the hrtimer's list node of the work and crashing kernel with null dereference within kernel/timer once work's timer is expired. It's very easy to trigger this problem by re-plugging USB cable quickly. Initialize HNP work only once to fix this trouble. Unable to handle kernel NULL pointer dereference at virtual address 00000126) ... PC is at __run_timers.part.0+0x150/0x228 LR is at __next_timer_interrupt+0x51/0x9c ... (__run_timers.part.0) from [<c0187a2b>] (run_timer_softirq+0x2f/0x50) (run_timer_softirq) from [<c01013ad>] (__do_softirq+0xd5/0x2f0) (__do_softirq) from [<c012589b>] (irq_exit+0xab/0xb8) (irq_exit) from [<c0170341>] (handle_domain_irq+0x45/0x60) (handle_domain_irq) from [<c04c4a43>] (gic_handle_irq+0x6b/0x7c) (gic_handle_irq) from [<c0100b65>] (__irq_svc+0x65/0xac) Cc: stable@vger.kernel.org Acked-by: Peter Chen <peter.chen@kernel.org> Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| audio-v2.h | ||
| audio-v3.h | ||
| audio.h | ||
| c67x00.h | ||
| ccid.h | ||
| cdc-wdm.h | ||
| cdc.h | ||
| cdc_ncm.h | ||
| ch9.h | ||
| chipidea.h | ||
| composite.h | ||
| ehci-dbgp.h | ||
| ehci_def.h | ||
| ehci_pdriver.h | ||
| ezusb.h | ||
| functionfs.h | ||
| g_hid.h | ||
| gadget.h | ||
| gadget_configfs.h | ||
| hcd.h | ||
| input.h | ||
| iowarrior.h | ||
| irda.h | ||
| isp116x.h | ||
| isp1301.h | ||
| isp1362.h | ||
| isp1760.h | ||
| m66592.h | ||
| musb-ux500.h | ||
| musb.h | ||
| net2280.h | ||
| of.h | ||
| ohci_pdriver.h | ||
| otg-fsm.h | ||
| otg.h | ||
| pd.h | ||
| pd_ado.h | ||
| pd_bdo.h | ||
| pd_ext_sdb.h | ||
| pd_vdo.h | ||
| phy.h | ||
| phy_companion.h | ||
| quirks.h | ||
| r8a66597.h | ||
| renesas_usbhs.h | ||
| rndis_host.h | ||
| role.h | ||
| serial.h | ||
| sl811.h | ||
| storage.h | ||
| tcpm.h | ||
| tegra_usb_phy.h | ||
| typec.h | ||
| typec_altmode.h | ||
| typec_dp.h | ||
| typec_mux.h | ||
| typec_tbt.h | ||
| uas.h | ||
| ulpi.h | ||
| usb338x.h | ||
| usb_phy_generic.h | ||
| usbnet.h | ||
| xhci-dbgp.h | ||