From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
To: Badhri Jagan Sridharan <badhri@google.com>
Cc: gregkh@linuxfoundation.org, linux@roeck-us.net,
heikki.krogerus@linux.intel.com, kyletso@google.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
rdbabiera@google.com, amitsd@google.com, stable@vger.kernel.org,
frank.wang@rock-chips.com, broonie@kernel.org
Subject: Re: [PATCH v3] usb: typec: tcpm: Check for port partner validity before consuming it
Date: Mon, 29 Apr 2024 14:26:50 +0300 [thread overview]
Message-ID: <sfy7bt7ygmjt2qvs2auxpz63rrvampj3vjyakt7rs77asnhqka@jsymy45qvbxb> (raw)
In-Reply-To: <20240427202812.3435268-1-badhri@google.com>
On Sat, Apr 27, 2024 at 08:28:12PM +0000, Badhri Jagan Sridharan wrote:
> typec_register_partner() does not guarantee partner registration
> to always succeed. In the event of failure, port->partner is set
> to the error value or NULL. Given that port->partner validity is
> not checked, this results in the following crash:
>
> Unable to handle kernel NULL pointer dereference at virtual address xx
> pc : run_state_machine+0x1bc8/0x1c08
> lr : run_state_machine+0x1b90/0x1c08
> ..
> Call trace:
> run_state_machine+0x1bc8/0x1c08
> tcpm_state_machine_work+0x94/0xe4
> kthread_worker_fn+0x118/0x328
> kthread+0x1d0/0x23c
> ret_from_fork+0x10/0x20
>
> To prevent the crash, check for port->partner validity before
> derefencing it in all the call sites.
>
> Cc: stable@vger.kernel.org
> Fixes: c97cd0b4b54e ("usb: typec: tcpm: set initial svdm version based on pd revision")
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> ---
> drivers/usb/typec/tcpm/tcpm.c | 30 +++++++++++++++++++++++-------
> 1 file changed, 23 insertions(+), 7 deletions(-)
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
--
With best wishes
Dmitry
prev parent reply other threads:[~2024-04-29 11:26 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-27 20:28 [PATCH v3] usb: typec: tcpm: Check for port partner validity before consuming it Badhri Jagan Sridharan
2024-04-29 8:28 ` Heikki Krogerus
2024-04-29 11:26 ` Dmitry Baryshkov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sfy7bt7ygmjt2qvs2auxpz63rrvampj3vjyakt7rs77asnhqka@jsymy45qvbxb \
--to=dmitry.baryshkov@linaro.org \
--cc=amitsd@google.com \
--cc=badhri@google.com \
--cc=broonie@kernel.org \
--cc=frank.wang@rock-chips.com \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=kyletso@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=rdbabiera@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.