Re: [PATCH v2 5/7] usb: dwc3: add xhci-reset-on-resume property for power-loss resume

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds stack read in dwc3_host_init due to missing NULL terminator in props array
- [High] Use-After-Free due to dangling pointer when xHCI initialization fails
--

commit a0d50bed63a440d17232b616205b33080bdd0057
Author: Faisal Hassan <faisal.hassan@oss.qualcomm.com>

usb: dwc3: add xhci-reset-on-resume property for power-loss resume

This commit adds a new device property "xhci-reset-on-resume" that enables
the XHCI_RESET_ON_RESUME quirk for controllers needing complete
reinitialization after power loss during system suspend. It also updates
the dwc3 core to manage this quirk via software properties.

> diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
> index c5674161b2b08..1402520140862 100644
> --- a/drivers/usb/dwc3/host.c
> +++ b/drivers/usb/dwc3/host.c
> @@ -130,7 +130,7 @@ static int dwc3_host_get_irq(struct dwc3 *dwc)
>  
>  int dwc3_host_init(struct dwc3 *dwc)
>  {
> -	struct property_entry	props[6];
> +	struct property_entry	props[7];

[Severity: High]
This is a pre-existing issue, but does this array need an extra element for
a NULL terminator?

If all the conditional properties evaluate to true (usb3-lpm-capable,
usb2-lpm-disable, xhci-reset-on-resume-quirk, and quirk-broken-port-ped),
prop_idx reaches 7 and all 7 elements are populated.

When device_create_managed_software_node() copies the properties, it iterates
until it encounters a NULL name field.

Since there is no zero-initialized sentinel element at the end of the array,
could this lead to an out-of-bounds read on the stack?

>  	struct platform_device	*xhci;
>  	int			ret, irq;
>  	int			prop_idx = 0;

[ ... ]

> @@ -174,6 +174,9 @@ int dwc3_host_init(struct dwc3 *dwc)
>  	if (dwc->usb2_lpm_disable)
>  		props[prop_idx++] = PROPERTY_ENTRY_BOOL("usb2-lpm-disable");
>  
> +	if (dwc->xhci_reset_on_resume)
> +		props[prop_idx++] = PROPERTY_ENTRY_BOOL("xhci-reset-on-resume-quirk");
> +

[Severity: High]
This isn't a bug introduced by this patch, but does the error handling in
dwc3_host_init() leave a dangling pointer?

Earlier in dwc3_host_init(), the allocated device is assigned to dwc->xhci:

	dwc->xhci = xhci;

If a subsequent initialization step fails, the error path frees the device:

err:
	platform_device_put(xhci);
	return ret;

However, dwc->xhci is never cleared to NULL. When a subsequent role switch or
teardown occurs, dwc3_host_exit() dereferences this freed pointer and calls
platform_device_unregister(dwc->xhci).

Could this lead to a use-after-free if memory allocation or initialization
fails during a USB role switch?

>  	/**
>  	 * WORKAROUND: dwc3 revisions <=3.00a have a limitation
>  	 * where Port Disable command doesn't work.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903153827.3463313-1-faisal.hassan@oss.qualcomm.com?part=5