linux-kernel - [PATCH v2] usb: phy: Initialize struct usb_phy list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251121-diogo-smaug_typec-v2-1-5c37c1169d57@tecnico.ulisboa.pt>
Date: Fri, 21 Nov 2025 18:16:36 +0000
From: Diogo Ivo <diogo.ivo@...nico.ulisboa.pt>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
 Felipe Balbi <felipe.balbi@...ux.intel.com>, 
 Baolin Wang <baolin.wang@...ux.alibaba.com>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, 
 stable@...r.kernel.org, Diogo Ivo <diogo.ivo@...nico.ulisboa.pt>
Subject: [PATCH v2] usb: phy: Initialize struct usb_phy list_head

As part of the registration of a new 'struct usb_phy' with the USB PHY core
via either usb_add_phy(struct usb_phy *x, ...) or usb_add_phy_dev(struct
usb_phy *x) these functions call list_add_tail(&x->head, phy_list) in
order for the new instance x to be stored in phy_list, a static list
kept internally by the core.

After 7d21114dc6a2 ("usb: phy: Introduce one extcon device into usb phy")
when executing either of the registration functions above it is possible
that usb_add_extcon() fails, leading to either function returning before
the call to list_add_tail(), leaving x->head uninitialized.

Then, when a driver tries to undo the failed registration by calling
usb_remove_phy(struct usb_phy *x) there will be an unconditional call to
list_del(&x->head) acting on an uninitialized variable, and thus a
possible NULL pointer dereference.

Fix this by initializing x->head before usb_add_extcon() has a
chance to fail. Note that this was not needed before 7d21114dc6a2 since
list_add_phy() was executed unconditionally and it guaranteed that x->head
was initialized.

Fixes: 7d21114dc6a2 ("usb: phy: Introduce one extcon device into usb phy")
Cc: stable@...r.kernel.org
Signed-off-by: Diogo Ivo <diogo.ivo@...nico.ulisboa.pt>
---
Changes in v2:
- Adjust Fixes: sha1 to 12 digits
- Reword commit message to clarify the need to introduce
  INIT_LIST_HEAD()
- Link to v1: https://lore.kernel.org/r/20251113-diogo-smaug_typec-v1-1-f1aa3b48620d@tecnico.ulisboa.pt
---
 drivers/usb/phy/phy.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index e1435bc59662..5a9b9353f343 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -646,6 +646,8 @@ int usb_add_phy(struct usb_phy *x, enum usb_phy_type type)
 		return -EINVAL;
 	}

+	INIT_LIST_HEAD(&x->head);
+
 	usb_charger_init(x);
 	ret = usb_add_extcon(x);
 	if (ret)
@@ -696,6 +698,8 @@ int usb_add_phy_dev(struct usb_phy *x)
 		return -EINVAL;
 	}

+	INIT_LIST_HEAD(&x->head);
+
 	usb_charger_init(x);
 	ret = usb_add_extcon(x);
 	if (ret)

---
base-commit: b612b9a01026a268af6a191180e846ad121d1eab
change-id: 20251113-diogo-smaug_typec-56b2059b892b

Best regards,
-- 
Diogo Ivo <diogo.ivo@...nico.ulisboa.pt>