Patch "USB: dwc3: qcom: fix NULL-deref on suspend" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    USB: dwc3: qcom: fix NULL-deref on suspend

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-dwc3-qcom-fix-null-deref-on-suspend.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 158ae93cd6ac2dc4ff5be66d492793e8bc7db1d5
Author: Johan Hovold <johan+linaro@xxxxxxxxxx>
Date:   Wed Jun 7 12:05:39 2023 +0200

    USB: dwc3: qcom: fix NULL-deref on suspend
    
    [ Upstream commit d2d69354226de0b333d4405981f3d9c41ba8430a ]
    
    The Qualcomm dwc3 glue driver is currently accessing the driver data of
    the child core device during suspend and on wakeup interrupts. This is
    clearly a bad idea as the child may not have probed yet or could have
    been unbound from its driver.
    
    The first such layering violation was part of the initial version of the
    driver, but this was later made worse when the hack that accesses the
    driver data of the grand child xhci device to configure the wakeup
    interrupts was added.
    
    Fixing this properly is not that easily done, so add a sanity check to
    make sure that the child driver data is non-NULL before dereferencing it
    for now.
    
    Note that this relies on subtleties like the fact that driver core is
    making sure that the parent is not suspended while the child is probing.
    
    Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
    Link: https://lore.kernel.org/all/20230325165217.31069-4-manivannan.sadhasivam@xxxxxxxxxx/
    Fixes: d9152161b4bf ("usb: dwc3: Add Qualcomm DWC3 glue layer driver")
    Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
    Cc: stable@xxxxxxxxxxxxxxx      # 3.18: a872ab303d5d: "usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup"
    Cc: Sandeep Maheswaram <quic_c_sanm@xxxxxxxxxxx>
    Cc: Krishna Kurapati <quic_kriskura@xxxxxxxxxxx>
    Signed-off-by: Johan Hovold <johan+linaro@xxxxxxxxxx>
    Acked-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
    Message-ID: <20230607100540.31045-2-johan+linaro@xxxxxxxxxx>
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index e872e8baf0662..8c3ab9bfbb9e6 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -193,7 +193,16 @@ static int dwc3_qcom_register_extcon(struct dwc3_qcom *qcom)
 /* Only usable in contexts where the role can not change. */
 static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
 {
-	struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
+	struct dwc3 *dwc;
+
+	/*
+	 * FIXME: Fix this layering violation.
+	 */
+	dwc = platform_get_drvdata(qcom->dwc3);
+
+	/* Core driver may not have probed yet. */
+	if (!dwc)
+		return false;
 
 	return dwc->xhci;
 }



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux