This is a note to let you know that I've just added the patch titled
USB: dwc3: fix use-after-free on core driver unbind
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-dwc3-fix-use-after-free-on-core-driver-unbind.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From e3dbb657571509044be15184a13134fa7c1fdca1 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@xxxxxxxxxx>
Date: Wed, 7 Jun 2023 12:05:40 +0200
Subject: USB: dwc3: fix use-after-free on core driver unbind
From: Johan Hovold <johan+linaro@xxxxxxxxxx>
commit e3dbb657571509044be15184a13134fa7c1fdca1 upstream.
Some dwc3 glue drivers are currently accessing the driver data of the
child core device directly, which is clearly a bad idea as the child may
not have probed yet or may have been unbound from its driver.
As a workaround until the glue drivers have been fixed, clear the driver
data pointer before allowing the glue parent device to runtime suspend
to prevent its driver from accessing data that has been freed during
unbind.
Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver")
Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
Cc: stable@xxxxxxxxxxxxxxx # 5.12
Cc: Li Jun <jun.li@xxxxxxx>
Cc: Sandeep Maheswaram <quic_c_sanm@xxxxxxxxxxx>
Cc: Krishna Kurapati <quic_kriskura@xxxxxxxxxxx>
Signed-off-by: Johan Hovold <johan+linaro@xxxxxxxxxx>
Acked-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
Message-ID: <20230607100540.31045-3-johan+linaro@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/dwc3/core.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1982,6 +1982,11 @@ static int dwc3_remove(struct platform_d
pm_runtime_allow(&pdev->dev);
pm_runtime_disable(&pdev->dev);
pm_runtime_put_noidle(&pdev->dev);
+ /*
+ * HACK: Clear the driver data, which is currently accessed by parent
+ * glue drivers, before allowing the parent to suspend.
+ */
+ platform_set_drvdata(pdev, NULL);
pm_runtime_set_suspended(&pdev->dev);
dwc3_free_event_buffers(dwc);
Patches currently in stable-queue which might be from johan+linaro@xxxxxxxxxx are
queue-6.1/usb-dwc3-qcom-fix-null-deref-on-suspend.patch
queue-6.1/usb-dwc3-fix-use-after-free-on-core-driver-unbind.patch
