From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDFB7C19F2D for ; Sat, 6 Aug 2022 14:33:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231701AbiHFOdW (ORCPT ); Sat, 6 Aug 2022 10:33:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229853AbiHFOdV (ORCPT ); Sat, 6 Aug 2022 10:33:21 -0400 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B298BDF4A for ; Sat, 6 Aug 2022 07:33:20 -0700 (PDT) Received: by mail-pj1-x102b.google.com with SMTP id v16-20020a17090abb9000b001f25244c65dso10710654pjr.2 for ; Sat, 06 Aug 2022 07:33:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=hZsvYReDneXNRGD9Ri34paDQng4soD5qGv+2z4J+I+w=; b=BdBZ4Li3Y94+2gVjZ+pujBDNmGjjbCDMKXkFvYwiTEb8Ix5BRMQdNPuQ1P5WpuVGvo T+le9Aa3wkjezzc0VqshtWfp/4eGgMu5P9NNyT4ZbEs9yXueWZB1lN1sNXQfJpoQ8+DW pzwBzVsdOYf+gjRfbjNVV/jqoMmq6d1Rnsevf5FE7PDVIrHoMrume6P+gyY/1o5lzitr rkOcHK7xrr6sOrTP5LxKKkepkeSpc6OLDEs2pNETIMP+Z0gFDqkcz3z9hhTfeFiTuzHN KJBXn38JJu+tu1+RL02y8qxRzMIgWtRJ4GpOtWnue/5E/ZGyZH6J9rJpZRQRdbG49ybj /7Jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=hZsvYReDneXNRGD9Ri34paDQng4soD5qGv+2z4J+I+w=; b=SFPHLrQh12H8aSSTTKNby4Ho5uhvXP6pEp2FACX9FEXDSnsX+O555SgiQxqkKVPde6 DnGQWhBW+gPWqyseiLeWhNF7WBNmmRXaZirilH/PfXxdyL5067e+ikBE9Q+V2vn2OXWa QeTJAcnHOmEiKoPEqXqB/sKY1QCTf9gnSHC0bT/eZreqO7uNpddee0BMwrGdQuuOb9EH jNFjdFtTnNjG8rKI5Gm0BnsWyR82yJiY4pwRrVNncN6zicoZLu+cB3ihqSi93qtbMJXU LHan3DqOeD5aQBKYZ7TL0LYOqAf8jLwLpD8rgRGX6G/ZHJRbboQqXUWmMsr38oh4pod9 zV2w== X-Gm-Message-State: ACgBeo23fKm/bNts51IPioM2XnpcyWAF5l6+xr3T6AFwRkdl0HaKiEM5 UV/o4kKNJthBgR0nRR34Ljat X-Google-Smtp-Source: AA6agR7biwjrZH3fe7nViG6ekyA+bwZh0nAc43cXMOLRCFfNZu4KhPzA4sp8F60devRIaLBglDCOug== X-Received: by 2002:a17:902:e94f:b0:16d:847b:3343 with SMTP id b15-20020a170902e94f00b0016d847b3343mr11470880pll.103.1659796400131; Sat, 06 Aug 2022 07:33:20 -0700 (PDT) Received: from thinkpad ([117.202.188.20]) by smtp.gmail.com with ESMTPSA id 134-20020a62198c000000b0052ab764fa78sm5048238pfz.185.2022.08.06.07.33.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Aug 2022 07:33:19 -0700 (PDT) Date: Sat, 6 Aug 2022 20:03:11 +0530 From: Manivannan Sadhasivam To: Johan Hovold Cc: Greg Kroah-Hartman , Felipe Balbi , Rob Herring , Krzysztof Kozlowski , Andy Gross , Bjorn Andersson , Konrad Dybcio , Krishna Kurapati , Stephen Boyd , Doug Anderson , Matthias Kaehlcke , Pavankumar Kondeti , quic_ppratap@quicinc.com, quic_vpulyala@quicinc.com, linux-arm-msm@vger.kernel.org, linux-usb@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH v2 4/9] usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup Message-ID: <20220806143311.GE14384@thinkpad> References: <20220804151001.23612-1-johan+linaro@kernel.org> <20220804151001.23612-5-johan+linaro@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220804151001.23612-5-johan+linaro@kernel.org> Precedence: bulk List-ID: X-Mailing-List: devicetree@vger.kernel.org On Thu, Aug 04, 2022 at 05:09:56PM +0200, Johan Hovold wrote: > The Qualcomm dwc3 runtime-PM implementation checks the xhci > platform-device pointer in the wakeup-interrupt handler to determine > whether the controller is in host mode and if so triggers a resume. > > After a role switch in OTG mode the xhci platform-device would have been > freed and the next wakeup from runtime suspend would access the freed > memory. > > Note that role switching is executed from a freezable workqueue, which > guarantees that the pointer is stable during suspend. > > Also note that runtime PM has been broken since commit 2664deb09306 > ("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which > incidentally also prevents this issue from being triggered. > > Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") > Cc: stable@vger.kernel.org # 4.18 > Signed-off-by: Johan Hovold It'd be good to mention the introduction of dwc3_qcom_is_host() function. Initially I thought it is used in a single place, but going through the rest of the patches reveals that it is used later on. Reviewed-by: Manivannan Sadhasivam Thanks, Mani > --- > > Changes in v2 > - new patch > > drivers/usb/dwc3/dwc3-qcom.c | 14 +++++++++++++- > drivers/usb/dwc3/host.c | 1 + > 2 files changed, 14 insertions(+), 1 deletion(-) > > diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c > index e9364141661b..6884026b9fad 100644 > --- a/drivers/usb/dwc3/dwc3-qcom.c > +++ b/drivers/usb/dwc3/dwc3-qcom.c > @@ -298,6 +298,14 @@ static void dwc3_qcom_interconnect_exit(struct dwc3_qcom *qcom) > icc_put(qcom->icc_path_apps); > } > > +/* Only usable in contexts where the role can not change. */ > +static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) > +{ > + struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3); > + > + return dwc->xhci; > +} > + > static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom) > { > struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3); > @@ -460,7 +468,11 @@ static irqreturn_t qcom_dwc3_resume_irq(int irq, void *data) > if (qcom->pm_suspended) > return IRQ_HANDLED; > > - if (dwc->xhci) > + /* > + * This is safe as role switching is done from a freezable workqueue > + * and the wakeup interrupts are disabled as part of resume. > + */ > + if (dwc3_qcom_is_host(qcom)) > pm_runtime_resume(&dwc->xhci->dev); > > return IRQ_HANDLED; > diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c > index f56c30cf151e..f6f13e7f1ba1 100644 > --- a/drivers/usb/dwc3/host.c > +++ b/drivers/usb/dwc3/host.c > @@ -135,4 +135,5 @@ int dwc3_host_init(struct dwc3 *dwc) > void dwc3_host_exit(struct dwc3 *dwc) > { > platform_device_unregister(dwc->xhci); > + dwc->xhci = NULL; > } > -- > 2.35.1 > -- மணிவண்ணன் சதாசிவம்