Re: typec_altmode_release → refcount_t: underflow; use-after-free.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dear Christian,


Am 29.01.24 um 20:06 schrieb Christian A. Ehrhardt:

On Mon, Jan 29, 2024 at 12:57:11PM +0100, Paul Menzel wrote:

I noticed the message first time with Linux 6.6.8 on December 26th, and also
with 6.6.11, 6.7 and 6.7.1. I am unsure how to reproduce it though.

Here the trace from Linux 6.7.1-1~exp1:

```
[    0.000000] Linux version 6.7-amd64 (debian-kernel@xxxxxxxxxxxxxxxx) (x86_64-linux-gnu-gcc-13 (Debian 13.2.0-10) 13.2.0, GNU ld (GNU Binutils for Debian) 2.41.90.20240115) #1 SMP PREEMPT_DYNAMIC Debian 6.7.1-1~exp1 (2024-01-22)
[…]
[    0.000000] DMI: Dell Inc. XPS 13 9360/0596KF, BIOS 2.21.0 06/02/2022
[…]
[ 9068.294345] ucsi_acpi USBC000:00: failed to re-enable notifications (-110)
[ 9068.499156] ------------[ cut here ]------------
[ 9068.499172] refcount_t: underflow; use-after-free.
[ 9068.499199] WARNING: CPU: 0 PID: 5598 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110

[…]
[ 9068.499517] Call Trace:
[ 9068.499521]  <TASK>
[ 9068.499522]  ? refcount_warn_saturate+0xbe/0x110
[ 9068.499526]  ? __warn+0x81/0x130
[ 9068.499533]  ? refcount_warn_saturate+0xbe/0x110
[ 9068.499545]  ? report_bug+0x171/0x1a0
[ 9068.499549]  ? console_unlock+0x78/0x120
[ 9068.499553]  ? handle_bug+0x3c/0x80
[ 9068.499557]  ? exc_invalid_op+0x17/0x70
[ 9068.499565]  ? asm_exc_invalid_op+0x1a/0x20
[ 9068.499570]  ? refcount_warn_saturate+0xbe/0x110
[ 9068.499576]  typec_altmode_release+0x49/0xc0 [typec]
[ 9068.499615]  device_release+0x34/0x90
[ 9068.499624]  kobject_put+0x78/0x190
[ 9068.499629]  ucsi_unregister_altmodes+0x41/0xa0 [typec_ucsi]
[ 9068.499648]  ucsi_unregister_partner.part.0+0x77/0xa0 [typec_ucsi]
[ 9068.499662]  ucsi_handle_connector_change+0x1bb/0x310 [typec_ucsi]
[ 9068.499671]  process_one_work+0x171/0x340
[ 9068.499676]  worker_thread+0x27b/0x3a0
[ 9068.499679]  ? __pfx_worker_thread+0x10/0x10
[ 9068.499681]  kthread+0xe5/0x120
[ 9068.499690]  ? __pfx_kthread+0x10/0x10
[ 9068.499693]  ret_from_fork+0x31/0x50
[ 9068.499698]  ? __pfx_kthread+0x10/0x10
[ 9068.499700]  ret_from_fork_asm+0x1b/0x30
[ 9068.499714]  </TASK>
[ 9068.499715] ---[ end trace 0000000000000000 ]---
```

Please find the full output of `dmesg` attached.

This should be fixed by

| commit 5962ded777d689cd8bf04454273e32228d7fb71f
| Author: RD Babiera <rdbabiera@xxxxxxxxxx>
| Date:   Wed Jan 3 18:17:55 2024 +0000
|
|     usb: typec: class: fix typec_altmode_put_partner to put plugs

which is in mainline and 6.7.2.

Awesome. Thank you for mentioning this, and nice timing, as the commit referenced in the Fixed-by tag is from v4.19-rc1 from August 2018. ;-)


Kind regards,

Paul




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux