From patchwork Wed Jun 7 10:05:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 104447 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp285045rwl; Wed, 7 Jun 2023 04:41:30 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6yEJXz9EFF/W2WxnW04Ex443SKLBLlKnl0mBCX0tDIS33c9TktVxnHwLjstL79NDruOf67 X-Received: by 2002:a54:4004:0:b0:39a:b9ae:47fd with SMTP id x4-20020a544004000000b0039ab9ae47fdmr5363100oie.11.1686138090618; Wed, 07 Jun 2023 04:41:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686138090; cv=none; d=google.com; s=arc-20160816; b=RRKgPexYxX1sLtLUsIZTxPwsVUsQeID7YGgkQiQCkLIdutoPtwmQ40SqPQvRUG89OB zoRFBfanwbrvU78XyqC/hiwPFY/fEwEIa8zDGqL7845qiZg551SGJxNGLgcaeVB9zqUZ GpqWbfZRy/N3RB3SCkZQiUmZ1W2+f11aYosko8lSKSAWYQww3xiaULsIkO4pB5+G0z4A w7c8W2dRYtwg+qvjlJxN5XLvzGTrjbWGIRAtgqxMc4NHxvdOykSfJYvkBOlr2KOeLCb/ 9TPdsR5n9J6AgngRRKDFs6xjvXa9++0MkyyPbsiZ4L34euGJ1nPBkBcyxS07RoILs3km J5pA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=hwn+Z8QZZqns+A3sDJY8Oeu9ICAZJLLOl1ZG5doW01s=; b=I3oET9Iis4lCint7mBIT6FsDmn6q6IQYVqXjg4Q3fuqzVSffQ1CMhQPgIs9cPcAsvz KWoP/unC4xgMAMqhXg0juQcuEd0ODzMOt3KSqF4t6gR6JHuFBQKLsHV6ZjeoAPaCW7Tw U7Fqc8P1PBEfUtIFqUfakdWR8qM23A2fwJUsP5KFomTGPJvfDB/O1Dx1a6n2YmAPrrMR AI++1XWIzjLTPl06CtgwNfzKez0UUZrSvmdLniQBOZ3Fz/JfKdkOZtkjav1Eru/xbwtH SoLWfZSDVtzzotZtLOnVCusFbUvM+5yn3thLuqxSeJwjtwCRYn86osT6BMCFoAhO+rDH D44w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=dCocfCn5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id jn15-20020a170903050f00b001a6b273fef3si8595835plb.442.2023.06.07.04.41.17; Wed, 07 Jun 2023 04:41:30 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=dCocfCn5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240262AbjFGLRR (ORCPT + 99 others); Wed, 7 Jun 2023 07:17:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52128 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239049AbjFGLRG (ORCPT ); Wed, 7 Jun 2023 07:17:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2C0D1BD; Wed, 7 Jun 2023 04:17:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 36DF763DBA; Wed, 7 Jun 2023 11:17:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 865BFC43444; Wed, 7 Jun 2023 11:17:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1686136623; bh=SWgB+GJxunV8+GIcdNuLA2VAu98d93P4jlBSJxTcTc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dCocfCn5G6R1dJgV4Mmgd6QmoqMqRFKA44H9gGa/fGqbDWMqfznlnu83eU4rX3cpv 2g3YmLmKhzdK4uBPsKEf5RRJy2gDbmp3VzLjfoipyHazynVJbqidDhMtYqzgdoEmdE hAQSBAK6dLwMOUWcB4LV6Fn39BYBcLwNJUr9X4uiMCKDyZ3UG25cqpgZDhiYHCgV1N qEiiv2znG3AMjklFQRR021NlKqKMNAhGwtv7xM71Bn2dkvgxHcTKYuNAmnD9NWk+8V BX9bCPRAjwtMTs4eSxvQ2DD8l0t1+mWji/1z4wHfAqtoNNTCp0uxrnbgg+6xhe4Wan ZW0mkD4+vxNXQ== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1q6rAM-0008LS-ET; Wed, 07 Jun 2023 13:17:26 +0200 From: Johan Hovold To: Thinh Nguyen Cc: Greg Kroah-Hartman , Andy Gross , Bjorn Andersson , Konrad Dybcio , Krishna Kurapati , Manivannan Sadhasivam , linux-usb@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Sandeep Maheswaram Subject: [PATCH 1/2] USB: dwc3: qcom: fix NULL-deref on suspend Date: Wed, 7 Jun 2023 12:05:39 +0200 Message-Id: <20230607100540.31045-2-johan+linaro@kernel.org> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20230607100540.31045-1-johan+linaro@kernel.org> References: <20230607100540.31045-1-johan+linaro@kernel.org> MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768043310618535599?= X-GMAIL-MSGID: =?utf-8?q?1768043934823282859?= The Qualcomm dwc3 glue driver is currently accessing the driver data of the child core device during suspend and on wakeup interrupts. This is clearly a bad idea as the child may not have probed yet or could have been unbound from its driver. The first such layering violation was part of the initial version of the driver, but this was later made worse when the hack that accesses the driver data of the grand child xhci device to configure the wakeup interrupts was added. Fixing this properly is not that easily done, so add a sanity check to make sure that the child driver data is non-NULL before dereferencing it for now. Note that this relies on subtleties like the fact that driver core is making sure that the parent is not suspended while the child is probing. Reported-by: Manivannan Sadhasivam Link: https://lore.kernel.org/all/20230325165217.31069-4-manivannan.sadhasivam@linaro.org/ Fixes: d9152161b4bf ("usb: dwc3: Add Qualcomm DWC3 glue layer driver") Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable@vger.kernel.org # 3.18: a872ab303d5d: "usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup" Cc: Sandeep Maheswaram Cc: Krishna Kurapati Signed-off-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam Acked-by: Thinh Nguyen --- drivers/usb/dwc3/dwc3-qcom.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c index 959fc925ca7c..79b22abf9727 100644 --- a/drivers/usb/dwc3/dwc3-qcom.c +++ b/drivers/usb/dwc3/dwc3-qcom.c @@ -308,7 +308,16 @@ static void dwc3_qcom_interconnect_exit(struct dwc3_qcom *qcom) /* Only usable in contexts where the role can not change. */ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) { - struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3); + struct dwc3 *dwc; + + /* + * FIXME: Fix this layering violation. + */ + dwc = platform_get_drvdata(qcom->dwc3); + + /* Core driver may not have probed yet. */ + if (!dwc) + return false; return dwc->xhci; } From patchwork Wed Jun 7 10:05:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 104449 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp286586rwl; Wed, 7 Jun 2023 04:44:24 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4hOcM5uaYsDQPF++7LOARjNopvX3HOkvyoaTZicoonvAz6mpOFbKZ4ZnI9g3gPsfzwIARH X-Received: by 2002:a17:902:d510:b0:1b1:c90e:b7c0 with SMTP id b16-20020a170902d51000b001b1c90eb7c0mr5370995plg.59.1686138264697; Wed, 07 Jun 2023 04:44:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686138264; cv=none; d=google.com; s=arc-20160816; b=XPORR+YFwt7GsBxgcBfIDVWoI7+rh7fDInv5DFzEnkM1dnZFVe5avPWnwbP3/cK4Bf x/dgTQeokt3qQLI6zLRVR+70jTADUoSi807yUu+2/r+HOKp2vRPOwHCCtcHUdKOW/pVO QnjCG+6np5/cKxqxGBKMW9UratIIj2Xy66YEzQ4iREQ3jWGCpkPayL8ET/rmFYxnflET ecwnG0bxKmdrZozvsOWr/Rm71ZouBCfJgC7js1K2onuSITiYpWbszJvwhDAyhBr7B0K8 QY0jOtSyD1ju+LRRriVSwQUB6XvqDuTs2Wzj8drJn/UyD/swzPcccyp5RS3LJje3qlKw s8AQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=v1KVUZpGWLipzmiF3UlgbhI1aRzu8skyEMIXD7K69x4=; b=W4zK1TxKHnoAlVuYjqp5OaZuziYuB9TO4P+xkHiWsNxj1mWnHZtBYJ3v/uFlN35Tvr j2/QCRl62/GT1t7VN8eXF8pcq87JrkJG0Xm0SPh15/RUkrwnNwAqsj0qArV+8cErWdni IyYCMat/7Yle0i3RgXViWemlsEzEjtfDruNniql+XCOIpbkurpuSURZuuvb5J84tHGJ/ uf3/eMWG84VTyoLmit53acBADHjlvg6lKd7GtKeXFGG8F42e3lXDcGyyX5536r3+L49t aMtOyVjzNETxAOmmib2zQmUmoUM2/62UB1S0TI6aGUPfrnoIAjo1GSu+L6nVZTMlNGkw O4uw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=hcwjIfmE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l17-20020a170902f69100b001aaf5dcd774si9212306plg.173.2023.06.07.04.44.11; Wed, 07 Jun 2023 04:44:24 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=hcwjIfmE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235429AbjFGLRI (ORCPT + 99 others); Wed, 7 Jun 2023 07:17:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239471AbjFGLRF (ORCPT ); Wed, 7 Jun 2023 07:17:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A42641702; Wed, 7 Jun 2023 04:17:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3FB5263DBD; Wed, 7 Jun 2023 11:17:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90665C43442; Wed, 7 Jun 2023 11:17:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1686136623; bh=PqT7b3LTt1IrPaGyiAZXtxPqgt4zXro8Gw7CXf+6hyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hcwjIfmEFTIUXuUtcgpBMJ4jzU5AmLI03k+n5e24wAmMp/W1YkBJLXXTTEK2axz/9 T5RVxoff/v2jBz79Uir+LB8uZkFWRyks6Q+F30CwBDcQJgIdEyNWW3cIDPa2R4P5RS J6MUJGfI6Q5HqyfmcIrRIak5MNt6+Gi2BtNAXDLaMvzT52dS4jt9jvEjC1v37a5E9e zTdlZJPWBugDtMCH7X3aNaLw8VUD97ukmGLTWHyKuF/02Zq/Zhyl2QX0IQrQjqcdpb euJakyPqO/MwXQV5UurRMzyB6zDzRIo/gm81awExyAXteEMiR11fFc+lkCITXenblb 05+boh6s8h1Bg== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1q6rAM-0008LU-Gz; Wed, 07 Jun 2023 13:17:26 +0200 From: Johan Hovold To: Thinh Nguyen Cc: Greg Kroah-Hartman , Andy Gross , Bjorn Andersson , Konrad Dybcio , Krishna Kurapati , Manivannan Sadhasivam , linux-usb@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Li Jun , Sandeep Maheswaram Subject: [PATCH 2/2] USB: dwc3: fix use-after-free on core driver unbind Date: Wed, 7 Jun 2023 12:05:40 +0200 Message-Id: <20230607100540.31045-3-johan+linaro@kernel.org> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20230607100540.31045-1-johan+linaro@kernel.org> References: <20230607100540.31045-1-johan+linaro@kernel.org> MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768044116950103459?= X-GMAIL-MSGID: =?utf-8?q?1768044116950103459?= Some dwc3 glue drivers are currently accessing the driver data of the child core device directly, which is clearly a bad idea as the child may not have probed yet or may have been unbound from its driver. As a workaround until the glue drivers have been fixed, clear the driver data pointer before allowing the glue parent device to runtime suspend to prevent its driver from accessing data that has been freed during unbind. Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver") Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable@vger.kernel.org # 5.12 Cc: Li Jun Cc: Sandeep Maheswaram Cc: Krishna Kurapati Signed-off-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam Acked-by: Thinh Nguyen --- drivers/usb/dwc3/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index 7b2ce013cc5b..d68958e151a7 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -1929,6 +1929,11 @@ static int dwc3_remove(struct platform_device *pdev) pm_runtime_disable(&pdev->dev); pm_runtime_dont_use_autosuspend(&pdev->dev); pm_runtime_put_noidle(&pdev->dev); + /* + * HACK: Clear the driver data, which is currently accessed by parent + * glue drivers, before allowing the parent to suspend. + */ + platform_set_drvdata(pdev, NULL); pm_runtime_set_suspended(&pdev->dev); dwc3_free_event_buffers(dwc);