lkml.org 
[lkml]   [2022]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH stable-5.15 2/3] usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
    On Tue, Sep 06, 2022 at 02:07:01PM +0200, Johan Hovold wrote:
    > From: Johan Hovold <johan+linaro@kernel.org>
    >
    > commit a872ab303d5ddd4c965f9cd868677781a33ce35a upstream.
    >
    > The Qualcomm dwc3 runtime-PM implementation checks the xhci
    > platform-device pointer in the wakeup-interrupt handler to determine
    > whether the controller is in host mode and if so triggers a resume.
    >
    > After a role switch in OTG mode the xhci platform-device would have been
    > freed and the next wakeup from runtime suspend would access the freed
    > memory.
    >
    > Note that role switching is executed from a freezable workqueue, which
    > guarantees that the pointer is stable during suspend.
    >
    > Also note that runtime PM has been broken since commit 2664deb09306
    > ("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which
    > incidentally also prevents this issue from being triggered.
    >
    > Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
    > Cc: stable@vger.kernel.org # 4.18
    > Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
    > Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    > Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
    > Link: https://lore.kernel.org/r/20220804151001.23612-5-johan+linaro@kernel.org
    > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    > [ johan: adjust context for 5.15 ]
    > Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
    > ---
    > drivers/usb/dwc3/dwc3-qcom.c | 14 +++++++++++++-
    > drivers/usb/dwc3/host.c | 1 +
    > 2 files changed, 14 insertions(+), 1 deletion(-)

    This one did not apply to 5.4.y or 4.19.y :(

    \
     
     \ /
      Last update: 2022-09-06 14:20    [W:7.246 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site