linux-kernel - Re: [PATCH v3 2/9] usb: typec: Add retimer handle to port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Jul 2022 12:39:49 +0300
From:   Sergey Shtylyov <s.shtylyov@....ru>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:     Prashant Malani <pmalani@...omium.org>,
        <linux-kernel@...r.kernel.org>, <linux-usb@...r.kernel.org>,
        <chrome-platform@...ts.linux.dev>, <bleung@...omium.org>,
        <heikki.krogerus@...ux.intel.com>,
        Daisuke Nojiri <dnojiri@...omium.org>,
        "Dustin L. Howett" <dustin@...ett.net>,
        Guenter Roeck <groeck@...omium.org>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Sebastian Reichel <sebastian.reichel@...labora.com>,
        Tzung-Bi Shih <tzungbi@...nel.org>
Subject: Re: [PATCH v3 2/9] usb: typec: Add retimer handle to port

On 7/8/22 12:21 PM, Greg Kroah-Hartman wrote:
[...]
>>> Similar to mux and orientation switch, add a handle for registered
>>> retimer to the port, so that it has handles to the various switches
>>> connected to it.
>>>
>>> Signed-off-by: Prashant Malani <pmalani@...omium.org>
>>> ---
>>>
>>> Changes since v2:
>>> - No changes.
>>>
>>> Changes since v1:
>>> - Relinquish retimer reference during typec_release.
>>>
>>>  drivers/usb/typec/class.c | 9 +++++++++
>>>  drivers/usb/typec/class.h | 1 +
>>>  2 files changed, 10 insertions(+)
>>>
>>> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
>>> index 9062836bb638..f08e32d552b4 100644
>>> --- a/drivers/usb/typec/class.c
>>> +++ b/drivers/usb/typec/class.c
>> [...]
>>> @@ -2249,6 +2251,13 @@ struct typec_port *typec_register_port(struct device *parent,
>>>  		return ERR_PTR(ret);
>>>  	}
>>>  
>>> +	port->retimer = typec_retimer_get(&port->dev);
>>> +	if (IS_ERR(port->retimer)) {
>>> +		ret = PTR_ERR(port->retimer);
>>> +		put_device(&port->dev);
>>> +		return ERR_PTR(ret);
>>
>>    Why convert it to and fro, and not just return port->retimer?
> 
> That would be a use-after-free as port might now be gone.

   Ah, indeed!
   It would also ensue an explicit pointer cast...

> thanks,
> 
> greg k-h

MBR, Sergey