| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <7b46779f-3f44-45f4-8884-2f9f625485ae@nvidia.com>
Date: Mon, 24 Jun 2024 14:42:22 +0100
From: Jon Hunter <jonathanh@...dia.com>
To: Jameson Thies <jthies@...gle.com>, heikki.krogerus@...ux.intel.com,
linux-usb@...r.kernel.org
Cc: pmalani@...omium.org, bleung@...gle.com, abhishekpandit@...omium.org,
andersson@...nel.org, dmitry.baryshkov@...aro.org,
fabrice.gasnier@...s.st.com, gregkh@...uxfoundation.org,
hdegoede@...hat.com, neil.armstrong@...aro.org, rajaram.regupathy@...el.com,
saranya.gopal@...el.com, linux-kernel@...r.kernel.org,
Benson Leung <bleung@...omium.org>,
"linux-tegra@...r.kernel.org" <linux-tegra@...r.kernel.org>
Subject: Re: [PATCH v5 4/4] usb: typec: ucsi: Always set number of alternate
modes
On 24/06/2024 13:51, Jon Hunter wrote:
> Hi Jameson,
>
> On 10/05/2024 21:12, Jameson Thies wrote:
>> Providing the number of known alternate modes allows user space to
>> determine when device registration has completed. Always register a
>> number of known alternate modes for the partner and cable plug, even
>> when the number of supported alternate modes is 0.
>>
>> Reviewed-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
>> Reviewed-by: Benson Leung <bleung@...omium.org>
>> Signed-off-by: Jameson Thies <jthies@...gle.com>
>> ---
>> Changes in V5:
>> - None.
>>
>> Changes in V4:
>> - None.
>>
>> Changes in V3:
>> - None.
>>
>> Changes in V2:
>> - None.
>>
>> drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
>> 1 file changed, 11 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/usb/typec/ucsi/ucsi.c
>> b/drivers/usb/typec/ucsi/ucsi.c
>> index bb6e57064513d..52a14bfe4107e 100644
>> --- a/drivers/usb/typec/ucsi/ucsi.c
>> +++ b/drivers/usb/typec/ucsi/ucsi.c
>> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct
>> ucsi_connector *con)
>> /* Ignoring the errors in this case. */
>> if (con->partner_altmode[0]) {
>> num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
>> - if (num_partner_am > 0)
>> - typec_partner_set_num_altmodes(con->partner,
>> num_partner_am);
>> + typec_partner_set_num_altmodes(con->partner, num_partner_am);
>> ucsi_altmode_update_active(con);
>> return 0;
>> + } else {
>> + typec_partner_set_num_altmodes(con->partner, 0);
>> }
>> return ret;
>> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct
>> ucsi_connector *con)
>> static int ucsi_check_cable(struct ucsi_connector *con)
>> {
>> u64 command;
>> - int ret;
>> + int ret, num_plug_am;
>> if (con->cable)
>> return 0;
>> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct
>> ucsi_connector *con)
>> return ret;
>> }
>> + if (con->plug_altmode[0]) {
>> + num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
>> + typec_plug_set_num_altmodes(con->plug, num_plug_am);
>> + } else {
>> + typec_plug_set_num_altmodes(con->plug, 0);
>> + }
>> +
>> return 0;
>> }
>
> I am seeing the following panic on linux-next and bisect is pointing to
> this commit.
>
> [ 16.411135] Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000310
> [ 16.411716] Mem abort info:
> [ 16.411806] ESR = 0x0000000096000044
> [ 16.412147] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 16.412465] SET = 0, FnV = 0
> [ 16.412530] EA = 0, S1PTW = 0
> [ 16.412778] FSC = 0x04: level 0 translation fault
> [ 16.413084] Data abort info:
> [ 16.413149] ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> [ 16.413534] CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> [ 16.414163] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 16.414649] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101b2b000
> [ 16.414784] [0000000000000310] pgd=0000000000000000,
> p4d=0000000000000000
> [ 16.414940] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
> [ 16.414946] Modules linked in: tegra210_adma(+)
> snd_soc_tegra210_ahub(+) drm backlight snd_soc_tegra_audio_graph_card
> snd_soc_audio_graph_card ucsi_ccg typec_ucsi crct10dif_ce
> snd_soc_simple_card_utils typec pwm_fan snd_soc_rt5659(+) snd_soc_rl6231
> ina3221 pwm_tegra tegra_aconnect phy_tegra194_p2u snd_hda_codec_hdmi
> at24 snd_hda_tegra snd_hda_codec snd_hda_core lm90 tegra_xudc host1x
> pcie_tegra194 tegra_bpmp_thermal ip_tables x_tables ipv6
> [ 16.415056] CPU: 0 PID: 290 Comm: kworker/0:4 Not tainted
> 6.10.0-rc4-next-20240617-g76db4c64526c #1
> [ 16.415063] Hardware name: NVIDIA Jetson AGX Xavier Developer Kit (DT)
> [ 16.415067] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [ 16.415082] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS
> BTYPE=--)
> [ 16.415091] pc : typec_plug_set_num_altmodes+0x18/0x6c [typec]
> [ 16.415112] lr : ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> [ 16.415120] sp : ffff8000848bbca0
> [ 16.415123] x29: ffff8000848bbca0 x28: ffff000080e66000 x27:
> ffff80007adc96e8
> [ 16.415140] x26: ffff80007adc96f8 x25: ffff0000834510c0 x24:
> ffff000080e66010
> [ 16.415150] x23: ffff000080e6638c x22: ffff000080e664c0 x21:
> ffff000089c95800
> [ 16.415160] x20: 0000000000000000 x19: 0000000000000000 x18:
> ffffffffffffffff
> [ 16.415170] x17: 1e00000001000000 x16: c203000000000000 x15:
> 00656c6261632d30
> [ 16.415180] x14: ffff800082c922d8 x13: 0000000000000040 x12:
> 0000000000000228
> [ 16.415191] x11: 0000000000000000 x10: 0000000000000000 x9 :
> 0000000000000000
> [ 16.415201] x8 : 3d45505954564544 x7 : 0063657079743d4d x6 :
> 0000000000000000
> [ 16.415212] x5 : ffff0000835ee780 x4 : ffff000080e66288 x3 :
> 0000000000000000
> [ 16.415223] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
> 0000000000000000
> [ 16.415233] Call trace:
> [ 16.415236] typec_plug_set_num_altmodes+0x18/0x6c [typec]
> [ 16.415255] ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> [ 16.415264] ucsi_init_work+0x8b4/0x9b8 [typec_ucsi]
> [ 16.415271] process_one_work+0x150/0x294
> [ 16.415282] worker_thread+0x2f4/0x3fc
> [ 16.415289] kthread+0x118/0x11c
> [ 16.415296] ret_from_fork+0x10/0x20
> [ 16.415310] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b9031001)
> [ 16.521018] ata1: SATA link down (SStatus 0 SControl 300)
> [ 16.524401] ---[ end trace 0000000000000000 ]---
>
>
> I have not looked any further yet, but wanted to report this. If you have
> any thoughts let me know.
It is crashing because 'con->plug' is not initialised when
typec_plug_set_num_altmodes() is called. Do we need to add a check to
see if 'con->plug' is valid in ucsi_check_cable()?
Jon
--
nvpublic
Powered by blists - more mailing lists