| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 24 Jun 2024 17:33:32 +0300
From: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
To: Jon Hunter <jonathanh@...dia.com>
Cc: Jameson Thies <jthies@...gle.com>, heikki.krogerus@...ux.intel.com,
linux-usb@...r.kernel.org, pmalani@...omium.org, bleung@...gle.com,
abhishekpandit@...omium.org, andersson@...nel.org,
fabrice.gasnier@...s.st.com, gregkh@...uxfoundation.org, hdegoede@...hat.com,
neil.armstrong@...aro.org, rajaram.regupathy@...el.com,
saranya.gopal@...el.com, linux-kernel@...r.kernel.org,
Benson Leung <bleung@...omium.org>,
"linux-tegra@...r.kernel.org" <linux-tegra@...r.kernel.org>
Subject: Re: [PATCH v5 4/4] usb: typec: ucsi: Always set number of alternate modes
On Mon, 24 Jun 2024 at 16:42, Jon Hunter <jonathanh@...dia.com> wrote:
>
>
> On 24/06/2024 13:51, Jon Hunter wrote:
> > Hi Jameson,
> >
> > On 10/05/2024 21:12, Jameson Thies wrote:
> >> Providing the number of known alternate modes allows user space to
> >> determine when device registration has completed. Always register a
> >> number of known alternate modes for the partner and cable plug, even
> >> when the number of supported alternate modes is 0.
> >>
> >> Reviewed-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
> >> Reviewed-by: Benson Leung <bleung@...omium.org>
> >> Signed-off-by: Jameson Thies <jthies@...gle.com>
> >> ---
> >> Changes in V5:
> >> - None.
> >>
> >> Changes in V4:
> >> - None.
> >>
> >> Changes in V3:
> >> - None.
> >>
> >> Changes in V2:
> >> - None.
> >>
> >> drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
> >> 1 file changed, 11 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/drivers/usb/typec/ucsi/ucsi.c
> >> b/drivers/usb/typec/ucsi/ucsi.c
> >> index bb6e57064513d..52a14bfe4107e 100644
> >> --- a/drivers/usb/typec/ucsi/ucsi.c
> >> +++ b/drivers/usb/typec/ucsi/ucsi.c
> >> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct
> >> ucsi_connector *con)
> >> /* Ignoring the errors in this case. */
> >> if (con->partner_altmode[0]) {
> >> num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
> >> - if (num_partner_am > 0)
> >> - typec_partner_set_num_altmodes(con->partner,
> >> num_partner_am);
> >> + typec_partner_set_num_altmodes(con->partner, num_partner_am);
> >> ucsi_altmode_update_active(con);
> >> return 0;
> >> + } else {
> >> + typec_partner_set_num_altmodes(con->partner, 0);
> >> }
> >> return ret;
> >> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct
> >> ucsi_connector *con)
> >> static int ucsi_check_cable(struct ucsi_connector *con)
> >> {
> >> u64 command;
> >> - int ret;
> >> + int ret, num_plug_am;
> >> if (con->cable)
> >> return 0;
> >> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct
> >> ucsi_connector *con)
> >> return ret;
> >> }
> >> + if (con->plug_altmode[0]) {
> >> + num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
> >> + typec_plug_set_num_altmodes(con->plug, num_plug_am);
> >> + } else {
> >> + typec_plug_set_num_altmodes(con->plug, 0);
> >> + }
> >> +
> >> return 0;
> >> }
> >
> > I am seeing the following panic on linux-next and bisect is pointing to
> > this commit.
> >
> > [ 16.411135] Unable to handle kernel NULL pointer dereference at
> > virtual address 0000000000000310
> > [ 16.411716] Mem abort info:
> > [ 16.411806] ESR = 0x0000000096000044
> > [ 16.412147] EC = 0x25: DABT (current EL), IL = 32 bits
> > [ 16.412465] SET = 0, FnV = 0
> > [ 16.412530] EA = 0, S1PTW = 0
> > [ 16.412778] FSC = 0x04: level 0 translation fault
> > [ 16.413084] Data abort info:
> > [ 16.413149] ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> > [ 16.413534] CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> > [ 16.414163] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> > [ 16.414649] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101b2b000
> > [ 16.414784] [0000000000000310] pgd=0000000000000000,
> > p4d=0000000000000000
> > [ 16.414940] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
> > [ 16.414946] Modules linked in: tegra210_adma(+)
> > snd_soc_tegra210_ahub(+) drm backlight snd_soc_tegra_audio_graph_card
> > snd_soc_audio_graph_card ucsi_ccg typec_ucsi crct10dif_ce
> > snd_soc_simple_card_utils typec pwm_fan snd_soc_rt5659(+) snd_soc_rl6231
> > ina3221 pwm_tegra tegra_aconnect phy_tegra194_p2u snd_hda_codec_hdmi
> > at24 snd_hda_tegra snd_hda_codec snd_hda_core lm90 tegra_xudc host1x
> > pcie_tegra194 tegra_bpmp_thermal ip_tables x_tables ipv6
> > [ 16.415056] CPU: 0 PID: 290 Comm: kworker/0:4 Not tainted
> > 6.10.0-rc4-next-20240617-g76db4c64526c #1
> > [ 16.415063] Hardware name: NVIDIA Jetson AGX Xavier Developer Kit (DT)
> > [ 16.415067] Workqueue: events_long ucsi_init_work [typec_ucsi]
> > [ 16.415082] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS
> > BTYPE=--)
> > [ 16.415091] pc : typec_plug_set_num_altmodes+0x18/0x6c [typec]
> > [ 16.415112] lr : ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> > [ 16.415120] sp : ffff8000848bbca0
> > [ 16.415123] x29: ffff8000848bbca0 x28: ffff000080e66000 x27:
> > ffff80007adc96e8
> > [ 16.415140] x26: ffff80007adc96f8 x25: ffff0000834510c0 x24:
> > ffff000080e66010
> > [ 16.415150] x23: ffff000080e6638c x22: ffff000080e664c0 x21:
> > ffff000089c95800
> > [ 16.415160] x20: 0000000000000000 x19: 0000000000000000 x18:
> > ffffffffffffffff
> > [ 16.415170] x17: 1e00000001000000 x16: c203000000000000 x15:
> > 00656c6261632d30
> > [ 16.415180] x14: ffff800082c922d8 x13: 0000000000000040 x12:
> > 0000000000000228
> > [ 16.415191] x11: 0000000000000000 x10: 0000000000000000 x9 :
> > 0000000000000000
> > [ 16.415201] x8 : 3d45505954564544 x7 : 0063657079743d4d x6 :
> > 0000000000000000
> > [ 16.415212] x5 : ffff0000835ee780 x4 : ffff000080e66288 x3 :
> > 0000000000000000
> > [ 16.415223] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
> > 0000000000000000
> > [ 16.415233] Call trace:
> > [ 16.415236] typec_plug_set_num_altmodes+0x18/0x6c [typec]
> > [ 16.415255] ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> > [ 16.415264] ucsi_init_work+0x8b4/0x9b8 [typec_ucsi]
> > [ 16.415271] process_one_work+0x150/0x294
> > [ 16.415282] worker_thread+0x2f4/0x3fc
> > [ 16.415289] kthread+0x118/0x11c
> > [ 16.415296] ret_from_fork+0x10/0x20
> > [ 16.415310] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b9031001)
> > [ 16.521018] ata1: SATA link down (SStatus 0 SControl 300)
> > [ 16.524401] ---[ end trace 0000000000000000 ]---
> >
> >
> > I have not looked any further yet, but wanted to report this. If you have
> > any thoughts let me know.
>
>
> It is crashing because 'con->plug' is not initialised when
> typec_plug_set_num_altmodes() is called. Do we need to add a check to
> see if 'con->plug' is valid in ucsi_check_cable()?
Yes. Either of con->calbe and con->plug can be NULL.
--
With best wishes
Dmitry
Powered by blists - more mailing lists