linux-kernel - Re: [PATCH v4] usb: typec: class: fix typec_altmode_put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZZW40CsR+Ruu8dDS@cae.in-ulm.de>
Date: Wed, 3 Jan 2024 20:43:12 +0100
From: Christian Ehrhardt <lk@...e.de>
To: RD Babiera <rdbabiera@...gle.com>
Cc: heikki.krogerus@...ux.intel.com, gregkh@...uxfoundation.org,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH v4] usb: typec: class: fix typec_altmode_put_partner to
 put plugs

On Wed, Jan 03, 2024 at 06:17:55PM +0000, RD Babiera wrote:
> When typec_altmode_put_partner is called by a plug altmode upon release,
> the port altmode the plug belongs to will not remove its reference to the
> plug. The check to see if the altmode being released is a plug evaluates
> against the released altmode's partner instead of the calling altmode, so
> change adev in typec_altmode_put_partner to properly refer to the altmode
> being released.
> 
> Because typec_altmode_set_partner calls get_device() on the port altmode,
> add partner_adev that points to the port altmode in typec_put_partner to
> call put_device() on. typec_altmode_set_partner is not called for port
> altmodes, so add a check in typec_altmode_release to prevent
> typec_altmode_put_partner() calls on port altmode release.
> 
> Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> Cc: stable@...r.kernel.org
> Co-developed-by: Christian A. Ehrhardt <lk@...e.de>
> Signed-off-by: Christian A. Ehrhardt <lk@...e.de>
> Signed-off-by: RD Babiera <rdbabiera@...gle.com>

I was able to reproduce the bug of the original report from here

https://lore.kernel.org/all/CAP-bSRb3SXpgo_BEdqZB-p1K5625fMegRZ17ZkPE1J8ZYgEHDg@mail.gmail.com/

(with some hacks) and verified that this change on top of a revert
of b17b7fe6dd (already in linux-usb) fixes the original bug.
The test does not excercise the code that deals with cable plugs,
though. Thus:

Tested-by: Christian A. Ehrhardt <lk@...e.de>

Given that this is otherwise a 6.7 regression it might be
a good idea to consider this for 6.7?

> ---
> Changes since v3:
> * added partner_adev to properly put_device() on port altmode.
> ---
>  drivers/usb/typec/class.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> index 4d11f2b536fa..015aa9253353 100644
> --- a/drivers/usb/typec/class.c
> +++ b/drivers/usb/typec/class.c
> @@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode *altmode)
>  {
>  	struct altmode *partner = altmode->partner;
>  	struct typec_altmode *adev;
> +	struct typec_altmode *partner_adev;
>  
>  	if (!partner)
>  		return;
>  
> -	adev = &partner->adev;
> +	adev = &altmode->adev;
> +	partner_adev = &partner->adev;
>  
>  	if (is_typec_plug(adev->dev.parent)) {
>  		struct typec_plug *plug = to_typec_plug(adev->dev.parent);
> @@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *altmode)
>  	} else {
>  		partner->partner = NULL;
>  	}
> -	put_device(&adev->dev);
> +	put_device(&partner_adev->dev);
>  }
>  
>  /**
> @@ -497,7 +499,8 @@ static void typec_altmode_release(struct device *dev)
>  {
>  	struct altmode *alt = to_altmode(to_typec_altmode(dev));
>  
> -	typec_altmode_put_partner(alt);
> +	if (!is_typec_port(dev->parent))
> +		typec_altmode_put_partner(alt);
>  
>  	altmode_id_remove(alt->adev.dev.parent, alt->id);
>  	kfree(alt);
> 
> base-commit: e7d3b9f28654dbfce7e09f8028210489adaf6a33
> -- 
> 2.43.0.472.g3155946c3a-goog
> 
> 

regards   Christian