From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
To: u-boot@lists.denx.de
Subject: [PATCH v1 11/11] usb: kbd: destroy device after console is stopped
Date: Thu, 11 Feb 2021 17:09:44 +0200 [thread overview]
Message-ID: <20210211150944.73252-11-andriy.shevchenko@linux.intel.com> (raw)
In-Reply-To: <20210211150944.73252-1-andriy.shevchenko@linux.intel.com>
In case of IOMUX enabled it assumes that console devices in the list
are available to get them stopped properly via ->stop() callback.
However, the USB keyboard driver violates this assumption and tries
to play tricks so the device get destroyed while being listed as
an active console.
Swap the order of device deregistration and IOMUX update along with
converting to use iomux_replace_device() jelper to avoid the use-after-free.
Fixes: 3cbcb2892809 ("usb: Fix usb_kbd_deregister when console-muxing is used")
Fixes: 8a8348703081 ("dm: usb: Add a remove() method for USB keyboards")
Reported-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
common/usb_kbd.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/common/usb_kbd.c b/common/usb_kbd.c
index b316807844b1..60c6027e048d 100644
--- a/common/usb_kbd.c
+++ b/common/usb_kbd.c
@@ -617,12 +617,12 @@ int usb_kbd_deregister(int force)
if (dev) {
usb_kbd_dev = (struct usb_device *)dev->priv;
data = usb_kbd_dev->privptr;
- if (stdio_deregister_dev(dev, force) != 0)
- return 1;
#if CONFIG_IS_ENABLED(CONSOLE_MUX)
- if (iomux_doenv(stdin, env_get("stdin")) != 0)
+ if (iomux_replace_device(stdin, DEVNAME, force ? "nulldev" : ""))
return 1;
#endif
+ if (stdio_deregister_dev(dev, force) != 0)
+ return 1;
#ifdef CONFIG_SYS_USB_EVENT_POLL_VIA_INT_QUEUE
destroy_int_queue(usb_kbd_dev, data->intq);
#endif
@@ -660,16 +660,16 @@ static int usb_kbd_remove(struct udevice *dev)
goto err;
}
data = udev->privptr;
- if (stdio_deregister_dev(sdev, true)) {
- ret = -EPERM;
- goto err;
- }
#if CONFIG_IS_ENABLED(CONSOLE_MUX)
- if (iomux_doenv(stdin, env_get("stdin"))) {
+ if (iomux_replace_device(stdin, DEVNAME, "nulldev")) {
ret = -ENOLINK;
goto err;
}
#endif
+ if (stdio_deregister_dev(sdev, true)) {
+ ret = -EPERM;
+ goto err;
+ }
#ifdef CONFIG_SYS_USB_EVENT_POLL_VIA_INT_QUEUE
destroy_int_queue(udev, data->intq);
#endif
--
2.30.0
next prev parent reply other threads:[~2021-02-11 15:09 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-11 15:09 [PATCH v1 01/11] stdio: Get rid of dead code, i.e. stdio_deregister() Andy Shevchenko
2021-02-11 15:09 ` [PATCH v1 02/11] stdio: Split out nulldev_register() and move it under #if Andy Shevchenko
2021-02-16 21:56 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 03/11] stdio: Introduce a new helper stdio_file_to_flags() Andy Shevchenko
2021-02-16 21:56 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 04/11] console: Switch to use stdio_file_to_flags() Andy Shevchenko
2021-02-16 21:56 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 05/11] console: Set console device counter in console_devices_set() Andy Shevchenko
2021-02-16 21:57 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 06/11] console: Set file and devices at one go Andy Shevchenko
2021-02-16 21:57 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 07/11] IOMUX: Switch to use stdio_file_to_flags() Andy Shevchenko
2021-02-16 21:57 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 08/11] IOMUX: Split out iomux_match_device() helper Andy Shevchenko
2021-02-16 21:57 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 09/11] IOMUX: Split out for_each_console_dev() helper macro Andy Shevchenko
2021-02-16 21:57 ` Tom Rini
2021-02-11 15:09 ` [PATCH v1 10/11] IOMUX: Introduce iomux_replace_device() Andy Shevchenko
2021-02-16 21:57 ` Tom Rini
2021-02-11 15:09 ` Andy Shevchenko [this message]
2021-02-16 21:57 ` [PATCH v1 11/11] usb: kbd: destroy device after console is stopped Tom Rini
2021-02-16 21:56 ` [PATCH v1 01/11] stdio: Get rid of dead code, i.e. stdio_deregister() Tom Rini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210211150944.73252-11-andriy.shevchenko@linux.intel.com \
--to=andriy.shevchenko@linux.intel.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox