linux-kernel - Re: [PATCH 2/2] USB: dwc3: fix use-after-free on core driver unbind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230608130246.GF5672@thinkpad>
Date:   Thu, 8 Jun 2023 18:32:46 +0530
From:   Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
To:     Johan Hovold <johan+linaro@...nel.org>
Cc:     Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Andy Gross <agross@...nel.org>,
        Bjorn Andersson <andersson@...nel.org>,
        Konrad Dybcio <konrad.dybcio@...aro.org>,
        Krishna Kurapati <quic_kriskura@...cinc.com>,
        linux-usb@...r.kernel.org, linux-arm-msm@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Li Jun <jun.li@....com>,
        Sandeep Maheswaram <quic_c_sanm@...cinc.com>
Subject: Re: [PATCH 2/2] USB: dwc3: fix use-after-free on core driver unbind

On Wed, Jun 07, 2023 at 12:05:40PM +0200, Johan Hovold wrote:
> Some dwc3 glue drivers are currently accessing the driver data of the
> child core device directly, which is clearly a bad idea as the child may
> not have probed yet or may have been unbound from its driver.
> 
> As a workaround until the glue drivers have been fixed, clear the driver
> data pointer before allowing the glue parent device to runtime suspend
> to prevent its driver from accessing data that has been freed during
> unbind.
> 
> Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver")
> Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
> Cc: stable@...r.kernel.org      # 5.12
> Cc: Li Jun <jun.li@....com>
> Cc: Sandeep Maheswaram <quic_c_sanm@...cinc.com>
> Cc: Krishna Kurapati <quic_kriskura@...cinc.com>
> Signed-off-by: Johan Hovold <johan+linaro@...nel.org>
> ---
>  drivers/usb/dwc3/core.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index 7b2ce013cc5b..d68958e151a7 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -1929,6 +1929,11 @@ static int dwc3_remove(struct platform_device *pdev)
>  	pm_runtime_disable(&pdev->dev);
>  	pm_runtime_dont_use_autosuspend(&pdev->dev);
>  	pm_runtime_put_noidle(&pdev->dev);
> +	/*
> +	 * HACK: Clear the driver data, which is currently accessed by parent
> +	 * glue drivers, before allowing the parent to suspend.
> +	 */
> +	platform_set_drvdata(pdev, NULL);

This is required because you have seen the glue driver going to runtime suspend
once the below pm_runtime_set_suspended() is completed?

- Mani

>  	pm_runtime_set_suspended(&pdev->dev);
>  
>  	dwc3_free_event_buffers(dwc);
> -- 
> 2.39.3
> 

-- 
மணிவண்ணன் சதாசிவம்