lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.14 220/252] usb: xhci-mtk: fix use-after-free of mtk->hcd
    Date
    From: Chunfeng Yun <chunfeng.yun@mediatek.com>

    [ Upstream commit 7f85c16f40d8be5656fb3476909db5c3a5a9c6ea ]

    BUG: KASAN: use-after-free in usb_hcd_is_primary_hcd+0x38/0x60
    Call trace:
    dump_backtrace+0x0/0x3dc
    show_stack+0x20/0x2c
    dump_stack+0x15c/0x1d4
    print_address_description+0x7c/0x510
    kasan_report+0x164/0x1ac
    __asan_report_load8_noabort+0x44/0x50
    usb_hcd_is_primary_hcd+0x38/0x60
    xhci_mtk_runtime_suspend+0x68/0x148
    pm_generic_runtime_suspend+0x90/0xac
    __rpm_callback+0xb8/0x1f4
    rpm_callback+0x54/0x1d0
    rpm_suspend+0x4e0/0xc84
    __pm_runtime_suspend+0xc4/0x114
    xhci_mtk_probe+0xa58/0xd00

    This may happen when probe fails, needn't suspend it synchronously,
    fix it by using pm_runtime_put_noidle().

    Reported-by: Pi Hsun <pihsun@google.com>
    Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
    Link: https://lore.kernel.org/r/1629189389-18779-3-git-send-email-chunfeng.yun@mediatek.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/host/xhci-mtk.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
    index 2548976bcf05..cb27569186a0 100644
    --- a/drivers/usb/host/xhci-mtk.c
    +++ b/drivers/usb/host/xhci-mtk.c
    @@ -569,7 +569,7 @@ static int xhci_mtk_probe(struct platform_device *pdev)
    xhci_mtk_ldos_disable(mtk);

    disable_pm:
    - pm_runtime_put_sync_autosuspend(dev);
    + pm_runtime_put_noidle(dev);
    pm_runtime_disable(dev);
    return ret;
    }
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-09 14:11    [W:2.705 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site