linux-kernel - Re: [PATCH] usb: phy: Initialize struct usb_phy list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2025112139-resale-upward-3366@gregkh>
Date: Fri, 21 Nov 2025 15:09:04 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Diogo Ivo <diogo.ivo@...nico.ulisboa.pt>
Cc: Felipe Balbi <felipe.balbi@...ux.intel.com>,
	Baolin Wang <baolin.wang@...ux.alibaba.com>,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH] usb: phy: Initialize struct usb_phy list_head

On Thu, Nov 13, 2025 at 02:59:06PM +0000, Diogo Ivo wrote:
> When executing usb_add_phy() and usb_add_phy_dev() it is possible that
> usb_add_extcon() fails (for example with -EPROBE_DEFER), in which case
> the usb_phy does not get added to phy_list via
> list_add_tail(&x->head, phy_list).
> 
> Then, when the driver that tried to add the phy receives the error
> propagated from usb_add_extcon() and calls into usb_remove_phy() to
> undo the partial registration there will be an unconditional call to
> list_del(&x->head) which is notinitialized and leads to a NULL pointer
> dereference.
> 
> Fix this by initializing x->head before usb_add_extcon() has a chance to
> fail.
> 
> Fixes: 7d21114dc6a2d53 ("usb: phy: Introduce one extcon device into usb phy")
> Cc: stable@...r.kernel.org
> Signed-off-by: Diogo Ivo <diogo.ivo@...nico.ulisboa.pt>
> ---
>  drivers/usb/phy/phy.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
> index e1435bc59662..5a9b9353f343 100644
> --- a/drivers/usb/phy/phy.c
> +++ b/drivers/usb/phy/phy.c
> @@ -646,6 +646,8 @@ int usb_add_phy(struct usb_phy *x, enum usb_phy_type type)
>  		return -EINVAL;
>  	}
>  
> +	INIT_LIST_HEAD(&x->head);
> +
>  	usb_charger_init(x);
>  	ret = usb_add_extcon(x);
>  	if (ret)
> @@ -696,6 +698,8 @@ int usb_add_phy_dev(struct usb_phy *x)
>  		return -EINVAL;
>  	}
>  
> +	INIT_LIST_HEAD(&x->head);
> +
>  	usb_charger_init(x);
>  	ret = usb_add_extcon(x);
>  	if (ret)
> 

Shouldn't you be also removing an existing call to INIT_LIST_HEAD()
somewhere?  This is not "moving" the code, it is adding it.

thanks,

greg k-h