From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Badhri Jagan Sridharan <badhri@google.com>
Cc: gregkh@linuxfoundation.org, linux@roeck-us.net,
kyletso@google.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org, rdbabiera@google.com,
amitsd@google.com, stable@vger.kernel.org,
frank.wang@rock-chips.com, broonie@kernel.org,
dmitry.baryshkov@linaro.org
Subject: Re: [PATCH v3] usb: typec: tcpm: Check for port partner validity before consuming it
Date: Mon, 29 Apr 2024 11:28:28 +0300 [thread overview]
Message-ID: <Zi9aLJS2vlHxwaFP@kuha.fi.intel.com> (raw)
In-Reply-To: <20240427202812.3435268-1-badhri@google.com>
On Sat, Apr 27, 2024 at 08:28:12PM +0000, Badhri Jagan Sridharan wrote:
> typec_register_partner() does not guarantee partner registration
> to always succeed. In the event of failure, port->partner is set
> to the error value or NULL. Given that port->partner validity is
> not checked, this results in the following crash:
>
> Unable to handle kernel NULL pointer dereference at virtual address xx
> pc : run_state_machine+0x1bc8/0x1c08
> lr : run_state_machine+0x1b90/0x1c08
> ..
> Call trace:
> run_state_machine+0x1bc8/0x1c08
> tcpm_state_machine_work+0x94/0xe4
> kthread_worker_fn+0x118/0x328
> kthread+0x1d0/0x23c
> ret_from_fork+0x10/0x20
>
> To prevent the crash, check for port->partner validity before
> derefencing it in all the call sites.
>
> Cc: stable@vger.kernel.org
> Fixes: c97cd0b4b54e ("usb: typec: tcpm: set initial svdm version based on pd revision")
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> ---
> drivers/usb/typec/tcpm/tcpm.c | 30 +++++++++++++++++++++++-------
> 1 file changed, 23 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> index ab6ed6111ed0..e1c6dffe5f8b 100644
> --- a/drivers/usb/typec/tcpm/tcpm.c
> +++ b/drivers/usb/typec/tcpm/tcpm.c
> @@ -1580,7 +1580,8 @@ static void svdm_consume_identity(struct tcpm_port *port, const u32 *p, int cnt)
> port->partner_ident.cert_stat = p[VDO_INDEX_CSTAT];
> port->partner_ident.product = product;
>
> - typec_partner_set_identity(port->partner);
> + if (port->partner)
> + typec_partner_set_identity(port->partner);
>
> tcpm_log(port, "Identity: %04x:%04x.%04x",
> PD_IDH_VID(vdo),
> @@ -1742,6 +1743,9 @@ static void tcpm_register_partner_altmodes(struct tcpm_port *port)
> struct typec_altmode *altmode;
> int i;
>
> + if (!port->partner)
> + return;
> +
> for (i = 0; i < modep->altmodes; i++) {
> altmode = typec_partner_register_altmode(port->partner,
> &modep->altmode_desc[i]);
> @@ -4231,7 +4235,10 @@ static int tcpm_init_vconn(struct tcpm_port *port)
>
> static void tcpm_typec_connect(struct tcpm_port *port)
> {
> + struct typec_partner *partner;
> +
> if (!port->connected) {
> + port->connected = true;
> /* Make sure we don't report stale identity information */
> memset(&port->partner_ident, 0, sizeof(port->partner_ident));
> port->partner_desc.usb_pd = port->pd_capable;
> @@ -4241,9 +4248,13 @@ static void tcpm_typec_connect(struct tcpm_port *port)
> port->partner_desc.accessory = TYPEC_ACCESSORY_AUDIO;
> else
> port->partner_desc.accessory = TYPEC_ACCESSORY_NONE;
> - port->partner = typec_register_partner(port->typec_port,
> - &port->partner_desc);
> - port->connected = true;
> + partner = typec_register_partner(port->typec_port, &port->partner_desc);
> + if (IS_ERR(partner)) {
> + dev_err(port->dev, "Failed to register partner (%ld)\n", PTR_ERR(partner));
> + return;
> + }
> +
> + port->partner = partner;
> typec_partner_set_usb_power_delivery(port->partner, port->partner_pd);
> }
> }
> @@ -4323,9 +4334,11 @@ static void tcpm_typec_disconnect(struct tcpm_port *port)
> port->plug_prime = NULL;
> port->cable = NULL;
> if (port->connected) {
> - typec_partner_set_usb_power_delivery(port->partner, NULL);
> - typec_unregister_partner(port->partner);
> - port->partner = NULL;
> + if (port->partner) {
> + typec_partner_set_usb_power_delivery(port->partner, NULL);
> + typec_unregister_partner(port->partner);
> + port->partner = NULL;
> + }
> port->connected = false;
> }
> }
> @@ -4549,6 +4562,9 @@ static enum typec_cc_status tcpm_pwr_opmode_to_rp(enum typec_pwr_opmode opmode)
>
> static void tcpm_set_initial_svdm_version(struct tcpm_port *port)
> {
> + if (!port->partner)
> + return;
> +
> switch (port->negotiated_rev) {
> case PD_REV30:
> break;
>
> base-commit: 3f12222a4bebeb13ce06ddecc1610ad32fa835dd
> --
> 2.44.0.769.g3c40516874-goog
--
heikki
next prev parent reply other threads:[~2024-04-29 8:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-27 20:28 [PATCH v3] usb: typec: tcpm: Check for port partner validity before consuming it Badhri Jagan Sridharan
2024-04-29 8:28 ` Heikki Krogerus [this message]
2024-04-29 11:26 ` Dmitry Baryshkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Zi9aLJS2vlHxwaFP@kuha.fi.intel.com \
--to=heikki.krogerus@linux.intel.com \
--cc=amitsd@google.com \
--cc=badhri@google.com \
--cc=broonie@kernel.org \
--cc=dmitry.baryshkov@linaro.org \
--cc=frank.wang@rock-chips.com \
--cc=gregkh@linuxfoundation.org \
--cc=kyletso@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=rdbabiera@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.