linux-kernel - [PATCH v5 3/3] usb: gadget: udc: core: Prevent UDC from starting when unbound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230531040203.19295-3-badhri@google.com>
Date:   Wed, 31 May 2023 04:02:03 +0000
From:   Badhri Jagan Sridharan <badhri@...gle.com>
To:     gregkh@...uxfoundation.org, stern@...land.harvard.edu,
        colin.i.king@...il.com, xuetao09@...wei.com,
        quic_eserrao@...cinc.com, water.zhangjiantao@...wei.com,
        peter.chen@...escale.com, balbi@...com, francesco@...cini.it,
        alistair@...stair23.me, stephan@...hold.net, bagasdotme@...il.com,
        luca@...tu.xyz
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org, Badhri Jagan Sridharan <badhri@...gle.com>,
        stable <stable@...nel.org>
Subject: [PATCH v5 3/3] usb: gadget: udc: core: Prevent UDC from starting when unbound

UDC should neither be started nor pulled up unless the gadget driver is
bound. The new flag "allow_start" is now set by gadget_bind_driver()
and cleared by gadget_unbind_driver(). usb_gadget_udc_start_locked()
now checks whether allow_start is set before starting the UDC by
invoking the ->udc_start() callback.

Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets")
Cc: stable <stable@...nel.org>
Signed-off-by: Badhri Jagan Sridharan <badhri@...gle.com>
---
v5 is the first version in this series.
---
 drivers/usb/gadget/udc/core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 6ffe5fda8bb7..ac9d6186815d 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -37,6 +37,8 @@ static const struct bus_type gadget_bus_type;
  * @vbus: for udcs who care about vbus status, this value is real vbus status;
  * for udcs who do not care about vbus status, this value is always true
  * @started: the UDC's started state. True if the UDC had started.
+ * @allow_start: Indicates whether UDC is allowed to start. Set/cleared by gadget_(un)bind_driver()
+ * after gadget driver is bound or unbound.
  * @connect_lock: protects udc->vbus, udc->started, gadget->connect, gadget->deactivate related
  * functions. usb_gadget_connect_locked, usb_gadget_disconnect_locked,
  * usb_udc_connect_control_locked, usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are
@@ -52,6 +54,7 @@ struct usb_udc {
 	struct list_head		list;
 	bool				vbus;
 	bool				started;
+	bool				allow_start;
 	struct work_struct		vbus_work;
 	struct mutex			connect_lock;
 };
@@ -1204,6 +1207,9 @@ static inline int usb_gadget_udc_start_locked(struct usb_udc *udc)
 	if (udc->started) {
 		dev_err(&udc->dev, "UDC had already started\n");
 		return -EBUSY;
+	} else if (!udc->allow_start) {
+		dev_err(&udc->dev, "UDC not allowed to start. Is gadget driver bound ?\n");
+		return -EIO;
 	}
 
 	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
@@ -1590,6 +1596,7 @@ static int gadget_bind_driver(struct device *dev)
 		goto err_bind;
 
 	mutex_lock(&udc->connect_lock);
+	udc->allow_start = true;
 	ret = usb_gadget_udc_start_locked(udc);
 	if (ret) {
 		mutex_unlock(&udc->connect_lock);
@@ -1630,6 +1637,7 @@ static void gadget_unbind_driver(struct device *dev)
 
 	cancel_work_sync(&udc->vbus_work);
 	mutex_lock(&udc->connect_lock);
+	udc->allow_start = false;
 	usb_gadget_disconnect_locked(gadget);
 	usb_gadget_disable_async_callbacks(udc);
 	if (gadget->irq)
-- 
2.41.0.rc0.172.g3f132b7071-goog