linux-kernel - Re: [PATCH] usb: dwc3: qcom: Make sure core device is fully initialized before it is used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Jun 2020 12:49:13 -0700
From:   Stephen Boyd <swboyd@...omium.org>
To:     Andy Gross <agross@...nel.org>, Felipe Balbi <balbi@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Matthias Kaehlcke <mka@...omium.org>
Cc:     linux-arm-msm@...r.kernel.org,
        Manu Gautam <mgautam@...eaurora.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        Sandeep Maheswaram <sanm@...eaurora.org>,
        Doug Anderson <dianders@...omium.org>,
        Matthias Kaehlcke <mka@...omium.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>
Subject: Re: [PATCH] usb: dwc3: qcom: Make sure core device is fully initialized before it is used

Quoting Matthias Kaehlcke (2020-06-16 13:37:37)
> dwc3_qcom_of_register_core() uses of_platform_populate() to add
> the dwc3 core device. The driver core will try to probe the device,
> however this might fail (e.g. due to deferred probing) and
> of_platform_populate() would still return 0 if the device was
> successully added to the platform bus. Verify that the core device
> is actually bound to its driver before using it, defer probing of the
> dwc3_qcom device if the core device isn't ready (yet).
> 
> Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver").
> Signed-off-by: Matthias Kaehlcke <mka@...omium.org>
> ---
> depends on:
>   https://lore.kernel.org/patchwork/patch/1251661/ ("driver core:Export
>     the symbol device_is_bound")
> 
>  drivers/usb/dwc3/dwc3-qcom.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
> index 1dfd024cd06b..5a9036b050c6 100644
> --- a/drivers/usb/dwc3/dwc3-qcom.c
> +++ b/drivers/usb/dwc3/dwc3-qcom.c
> @@ -537,6 +537,16 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev)
>                 return -ENODEV;
>         }
>  
> +       /*
> +        * A successful return from of_platform_populate() only guarantees that
> +        * the core device was added to the platform bus, however it might not
> +        * be bound to its driver (e.g. due to deferred probing). This driver
> +        * requires the core device to be fully initialized, so defer probing
> +        * if it isn't ready (yet).
> +        */
> +       if (!device_is_bound(&qcom->dwc3->dev))
> +               return -EPROBE_DEFER;

Isn't this still broken? i.e. the dwc3 core driver may bind much later
and then device_is_bound() will return an error here and then we'll
return to the caller, dwc3_qcom_probe(), and that will depopulate the
device with of_platform_depopulate(). It seems like we need to run some
sort of wait for driver to be bound function instead of a one-shot check
for the driver being bound.

> +
>         return 0;

Also, what about acpi? That has the same problem but it isn't covered by
the dwc3_qcom_of_register_core() function.