[PATCH] phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free

[PATCH] phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

The OTG role/VBUS interrupt (rcar_gen3_phy_usb2_irq) and the role sysfs
attribute schedule channel->work (rcar_gen3_phy_usb2_work), whose handler
dereferences the channel (ch->extcon). The channel is devm-allocated, so
it is freed at unbind, but nothing cancels channel->work:
rcar_gen3_phy_usb2_remove() only drops the role sysfs file. A work
scheduled just before unbind can run after the channel has been freed, a
use-after-free.

Cancel the work via devm, registered before the interrupt is requested so
that on unbind devm frees the interrupt first (no new work can be
scheduled) and then runs the cancel action before the channel is freed.

Fixes: 2b38543c8db1 ("phy: rcar-gen3-usb2: add extcon support")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index b5ba751..35e519a 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -1171,6 +1171,13 @@ static int rcar_gen3_phy_usb2_vbus_regulator_register(struct rcar_gen3_chan *cha
 	return rcar_gen3_phy_usb2_vbus_regulator_get_exclusive_enable(channel, enable);
 }
 
+static void rcar_gen3_phy_usb2_cancel_work(void *data)
+{
+	struct rcar_gen3_chan *channel = data;
+
+	cancel_work_sync(&channel->work);
+}
+
 static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -1277,6 +1284,17 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
 		return irq;
 	} else if (irq > 0) {
 		INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
+		/*
+		 * Registered before the IRQ so that, on unbind, devm frees the
+		 * IRQ first (no more work can be scheduled) and then cancels any
+		 * work still pending before the channel is freed.
+		 */
+		ret = devm_add_action_or_reset(dev,
+					       rcar_gen3_phy_usb2_cancel_work,
+					       channel);
+		if (ret < 0)
+			return ret;
+
 		ret = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq,
 				       IRQF_SHARED, dev_name(dev), channel);
 		if (ret < 0)
-- 
2.43.0


-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy

Re: [PATCH] phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] phy: rcar-gen3-usb2: Fixes tag cites 2b38543c8db1 instead of
  c14f8a4032ef
--

commit 897082e52850cdedb7797770d4fb9656cd7713ad
Author: Hyunjung Ko <hj351016@gmail.com>

> phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free
>
> The OTG role/VBUS interrupt (rcar_gen3_phy_usb2_irq) and the role sysfs
> attribute schedule channel->work (rcar_gen3_phy_usb2_work), whose handler
> dereferences the channel (ch->extcon). The channel is devm-allocated, so
> it is freed at unbind, but nothing cancels channel->work:
> rcar_gen3_phy_usb2_remove() only drops the role sysfs file. A work
> scheduled just before unbind can run after the channel has been freed, a
> use-after-free.
>
> Cancel the work via devm, registered before the interrupt is requested so
> that on unbind devm frees the interrupt first (no new work can be
> scheduled) and then runs the cancel action before the channel is freed.
>
> Fixes: 2b38543c8db1 ("phy: rcar-gen3-usb2: add extcon support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>

[Severity: Low]
Should the Fixes tag reference c14f8a4032ef ("phy: rcar-gen3-usb2: fix
mutex_lock calling in interrupt") instead?  Commit 2b38543c8db1 ("phy:
rcar-gen3-usb2: add extcon support") called extcon_set_cable_state_()
synchronously, whereas c14f8a4032ef ("phy: rcar-gen3-usb2: fix mutex_lock
calling in interrupt") introduced channel->work and
rcar_gen3_phy_usb2_work() without canceling the work on unbind.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109091633.1430331-1-hj351016@gmail.com?part=1

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy