lkml.org 
[lkml]   [2019]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 30/91] usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests
    Date
    From: Guenter Roeck <linux@roeck-us.net>

    commit 88d02c9ba2e83fc22d37ccb1f11c62ea6fc9ae50 upstream.

    TCPM may receive PD messages associated with unknown or unsupported
    alternate modes. If that happens, calls to typec_match_altmode()
    will return NULL. The tcpm code does not currently take this into
    account. This results in crashes.

    Unable to handle kernel NULL pointer dereference at virtual address 000001f0
    pgd = 41dad9a1
    [000001f0] *pgd=00000000
    Internal error: Oops: 5 [#1] THUMB2
    Modules linked in: tcpci tcpm
    CPU: 0 PID: 2338 Comm: kworker/u2:0 Not tainted 5.1.18-sama5-armv7-r2 #6
    Hardware name: Atmel SAMA5
    Workqueue: 2-0050 tcpm_pd_rx_handler [tcpm]
    PC is at typec_altmode_attention+0x0/0x14
    LR is at tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm]
    ...
    [<c03fbee8>] (typec_altmode_attention) from [<bf8030fb>]
    (tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm])
    [<bf8030fb>] (tcpm_pd_rx_handler [tcpm]) from [<c012082b>]
    (process_one_work+0x123/0x2a8)
    [<c012082b>] (process_one_work) from [<c0120a6d>]
    (worker_thread+0xbd/0x3b0)
    [<c0120a6d>] (worker_thread) from [<c012431f>] (kthread+0xcf/0xf4)
    [<c012431f>] (kthread) from [<c01010f9>] (ret_from_fork+0x11/0x38)

    Ignore PD messages if the associated alternate mode is not supported.

    Fixes: e9576fe8e605c ("usb: typec: tcpm: Support for Alternate Modes")
    Cc: stable <stable@vger.kernel.org>
    Reported-by: Douglas Gilbert <dgilbert@interlog.com>
    Cc: Douglas Gilbert <dgilbert@interlog.com>
    Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
    Tested-by: Douglas Gilbert <dgilbert@interlog.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Link: https://lore.kernel.org/r/1564761822-13984-1-git-send-email-linux@roeck-us.net
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/typec/tcpm.c | 36 +++++++++++++++++++++++-------------
    1 file changed, 23 insertions(+), 13 deletions(-)

    --- a/drivers/usb/typec/tcpm.c
    +++ b/drivers/usb/typec/tcpm.c
    @@ -1108,7 +1108,8 @@ static int tcpm_pd_svdm(struct tcpm_port
    break;
    case CMD_ATTENTION:
    /* Attention command does not have response */
    - typec_altmode_attention(adev, p[1]);
    + if (adev)
    + typec_altmode_attention(adev, p[1]);
    return 0;
    default:
    break;
    @@ -1160,20 +1161,26 @@ static int tcpm_pd_svdm(struct tcpm_port
    }
    break;
    case CMD_ENTER_MODE:
    - typec_altmode_update_active(pdev, true);
    + if (adev && pdev) {
    + typec_altmode_update_active(pdev, true);

    - if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
    - response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE);
    - response[0] |= VDO_OPOS(adev->mode);
    - return 1;
    + if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
    + response[0] = VDO(adev->svid, 1,
    + CMD_EXIT_MODE);
    + response[0] |= VDO_OPOS(adev->mode);
    + return 1;
    + }
    }
    return 0;
    case CMD_EXIT_MODE:
    - typec_altmode_update_active(pdev, false);
    + if (adev && pdev) {
    + typec_altmode_update_active(pdev, false);

    - /* Back to USB Operation */
    - WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
    - NULL));
    + /* Back to USB Operation */
    + WARN_ON(typec_altmode_notify(adev,
    + TYPEC_STATE_USB,
    + NULL));
    + }
    break;
    default:
    break;
    @@ -1183,8 +1190,10 @@ static int tcpm_pd_svdm(struct tcpm_port
    switch (cmd) {
    case CMD_ENTER_MODE:
    /* Back to USB Operation */
    - WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
    - NULL));
    + if (adev)
    + WARN_ON(typec_altmode_notify(adev,
    + TYPEC_STATE_USB,
    + NULL));
    break;
    default:
    break;
    @@ -1195,7 +1204,8 @@ static int tcpm_pd_svdm(struct tcpm_port
    }

    /* Informing the alternate mode drivers about everything */
    - typec_altmode_vdm(adev, p[0], &p[1], cnt);
    + if (adev)
    + typec_altmode_vdm(adev, p[0], &p[1], cnt);

    return rlen;
    }

    \
     
     \ /
      Last update: 2019-08-14 19:26    [W:4.052 / U:0.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site