public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Marek Szyprowski <m.szyprowski@samsung.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>,
	hminas@synopsys.com, linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 14/38] usb: dwc2: gadget: don't reset gadget's driver->bus
Date: Tue,  7 Jun 2022 13:58:09 -0400	[thread overview]
Message-ID: <20220607175835.480735-14-sashal@kernel.org> (raw)
In-Reply-To: <20220607175835.480735-1-sashal@kernel.org>

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]

UDC driver should not touch gadget's driver internals, especially it
should not reset driver->bus. This wasn't harmful so far, but since
commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
subsystem got it's own bus and messing with ->bus triggers the
following NULL pointer dereference:

dwc2 12480000.hsotg: bound driver g_ether
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: ...
CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
Hardware name: Samsung Exynos (Flattened Device Tree)
PC is at module_add_driver+0x44/0xe8
LR is at sysfs_do_create_link_sd+0x84/0xe0
...
Process modprobe (pid: 620, stack limit = 0x(ptrval))
...
 module_add_driver from bus_add_driver+0xf4/0x1e4
 bus_add_driver from driver_register+0x78/0x10c
 driver_register from usb_gadget_register_driver_owner+0x40/0xb4
 usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
 do_one_initcall from do_init_module+0x44/0x1c8
 do_init_module from load_module+0x19b8/0x1b9c
 load_module from sys_finit_module+0xdc/0xfc
 sys_finit_module from ret_fast_syscall+0x0/0x54
Exception stack(0xf1771fa8 to 0xf1771ff0)
...
dwc2 12480000.hsotg: new device is high-speed
---[ end trace 0000000000000000 ]---

Fix this by removing driver->bus entry reset.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/gadget.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index ec54971063f8..64485f82dc5b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -4518,7 +4518,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
 
 	WARN_ON(hsotg->driver);
 
-	driver->driver.bus = NULL;
 	hsotg->driver = driver;
 	hsotg->gadget.dev.of_node = hsotg->dev->of_node;
 	hsotg->gadget.speed = USB_SPEED_UNKNOWN;
-- 
2.35.1


  parent reply	other threads:[~2022-06-07 19:37 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-07 17:57 [PATCH AUTOSEL 5.10 01/38] iio: dummy: iio_simple_dummy: check the return value of kstrdup() Sasha Levin
2022-06-07 17:57 ` [PATCH AUTOSEL 5.10 02/38] staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Sasha Levin
2022-06-07 17:57 ` [PATCH AUTOSEL 5.10 03/38] iio: st_sensors: Add a local lock for protecting odr Sasha Levin
2022-06-07 17:57 ` [PATCH AUTOSEL 5.10 04/38] lkdtm/usercopy: Expand size of "out of frame" object Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 05/38] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 06/38] tty: Fix a possible resource leak in icom_probe Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 07/38] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 08/38] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 09/38] USB: host: isp116x: check return value after calling platform_get_resource() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 10/38] drivers: tty: serial: Fix deadlock in sa1100_set_termios() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 11/38] drivers: usb: host: Fix deadlock in oxu_bus_suspend() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 12/38] USB: hcd-pci: Fully suspend across freeze/thaw cycle Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 13/38] sysrq: do not omit current cpu when showing backtrace of all active CPUs Sasha Levin
2022-06-07 17:58 ` Sasha Levin [this message]
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 15/38] misc: rtsx: set NULL intfdata when probe fails Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 16/38] extcon: Modify extcon device to be created after driver data is set Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 17/38] clocksource/drivers/sp804: Avoid error on multiple instances Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 18/38] staging: rtl8712: fix uninit-value in usb_read8() and friends Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 19/38] staging: rtl8712: fix uninit-value in r871xu_drv_init() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 20/38] serial: msm_serial: disable interrupts in __msm_console_write() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 21/38] accessiblity: speakup: Add missing misc_deregister in softsynth_probe Sasha Levin
2022-06-08 21:08   ` Pavel Machek
2022-06-12 17:47     ` Sasha Levin
2022-06-12 17:49       ` Samuel Thibault
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 22/38] kernfs: Separate kernfs_pr_cont_buf and rename_lock Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 23/38] watchdog: wdat_wdt: Stop watchdog when rebooting the system Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 24/38] md: don't unregister sync_thread with reconfig_mutex held Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 25/38] md: protect md_unregister_thread from reentrancy Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 26/38] scsi: myrb: Fix up null pointer access on myrb_cleanup() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 27/38] Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 28/38] ceph: allow ceph.dir.rctime xattr to be updatable Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 29/38] drm/radeon: fix a possible null pointer dereference Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 30/38] modpost: fix undefined behavior of is_arm_mapping_symbol() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 31/38] x86/cpu: Elide KCSAN for cpu_has() and friends Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 32/38] jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 33/38] nbd: call genl_unregister_family() first in nbd_cleanup() Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 34/38] nbd: fix race between nbd_alloc_config() and module removal Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 35/38] nbd: fix io hung while disconnecting device Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 36/38] s390/gmap: voluntarily schedule during key setting Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 37/38] cifs: version operations for smb20 unneeded when legacy support disabled Sasha Levin
2022-06-07 17:58 ` [PATCH AUTOSEL 5.10 38/38] nodemask: Fix return values to be unsigned Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220607175835.480735-14-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hminas@synopsys.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=m.szyprowski@samsung.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox