linux-kernel - Re: [PATCH] Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAE-0n53UzgtKop5KmkxvBRroO-zFHDUgmWU3di1=Xomtew2NJg@mail.gmail.com>
Date:   Tue, 7 Dec 2021 14:41:26 -0500
From:   Stephen Boyd <swboyd@...omium.org>
To:     Douglas Anderson <dianders@...omium.org>,
        Felipe Balbi <balbi@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Matthias Kaehlcke <mka@...omium.org>,
        Sandeep Maheswaram <quic_c_sanm@...cinc.com>,
        Wesley Cheng <quic_wcheng@...cinc.com>, robdclark@...omium.org,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        linux-arm-msm@...r.kernel.org, Andy Gross <agross@...nel.org>,
        Wesley Cheng <wcheng@...eaurora.org>,
        linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: [PATCH] Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize
 property by default"

Quoting Douglas Anderson (2021-12-07 09:43:41)
> This reverts commit cefdd52fa0455c0555c30927386ee466a108b060.
>
> On sc7180-trogdor class devices with 'fw_devlink=permissive' and KASAN
> enabled, you'll see a Use-After-Free reported at bootup.
>
> The root of the problem is that dwc3_qcom_of_register_core() is adding
> a devm-allocated "tx-fifo-resize" property to its device tree node
> using of_add_property().
>
> The issue is that of_add_property() makes a _permanent_ addition to
> the device tree that lasts until reboot. That means allocating memory
> for the property using "devm" managed memory is a terrible idea since
> that memory will be freed upon probe deferral or device unbinding.
>
> Let's revert the patch since the system is still functional without
> it. The fact that of_add_property() makes a permanent change is extra
> fodder for those folks who were aruging that the device tree isn't
> really the right way to pass information between parts of the
> driver. It is an exercise left to the reader to submit a patch
> re-adding the new feature in a way that makes everyone happier.
>
> Fixes: cefdd52fa045 ("usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default")
> Signed-off-by: Douglas Anderson <dianders@...omium.org>
> ---

Reviewed-by: Stephen Boyd <swboyd@...omium.org>