Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-13 06:32:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
03715ea2e3
linux/drivers
History
Jack Pham 03715ea2e3 usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL 
There exists a possible scenario in which dwc3_gadget_init() can fail:
during during host -> peripheral mode switch in dwc3_set_mode(), and
a pending gadget driver fails to bind.  Then, if the DRD undergoes
another mode switch from peripheral->host the resulting
dwc3_gadget_exit() will attempt to reference an invalid and dangling
dwc->gadget pointer as well as call dma_free_coherent() on unmapped
DMA pointers.

The exact scenario can be reproduced as follows:
 - Start DWC3 in peripheral mode
 - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)
 - Run FunctionFS userspace application (open EPs, write descriptors, etc)
 - Bind gadget driver to DWC3's UDC
 - Switch DWC3 to host mode
   => dwc3_gadget_exit() is called. usb_del_gadget() will put the
	ConfigFS driver instance on the gadget_driver_pending_list
 - Stop FunctionFS application (closes the ep files)
 - Switch DWC3 to peripheral mode
   => dwc3_gadget_init() fails as usb_add_gadget() calls
	check_pending_gadget_drivers() and attempts to rebind the UDC
	to the ConfigFS gadget but fails with -19 (-ENODEV) because the
	FFS instance is not in FFS_ACTIVE state (userspace has not
	re-opened and written the descriptors yet, i.e. desc_ready!=0).
 - Switch DWC3 back to host mode
   => dwc3_gadget_exit() is called again, but this time dwc->gadget
	is invalid.

Although it can be argued that userspace should take responsibility
for ensuring that the FunctionFS application be ready prior to
allowing the composite driver bind to the UDC, failure to do so
should not result in a panic from the kernel driver.

Fix this by setting dwc->gadget to NULL in the failure path of
dwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out
unless the gadget pointer is valid.

Fixes: e81a7018d9 ("usb: dwc3: allocate gadget structure dynamically")
Cc: <stable@vger.kernel.org>
Reviewed-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Link: https://lore.kernel.org/r/20210528160405.17550-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-02 16:50:54 +02:00
..
accessibility TTY/Serial driver updates for 5.13-rc1 2021-04-26 11:20:10 -07:00
acpi TTY / Serial driver fixes for 5.13-rc4 2021-05-29 06:25:16 -10:00
amba
android binder: Return EFAULT if we fail BINDER_ENABLE_ONEWAY_SPAM_DETECTION 2021-05-13 20:35:26 +02:00
ata pci-v5.13-changes 2021-05-05 13:24:11 -07:00
atm atm: firestream: Use fallthrough pseudo-keyword 2021-05-07 16:01:08 -07:00
auxdisplay treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
base drivers: base: Reduce device link removal code duplication 2021-05-21 22:12:14 +02:00
bcma bcma: remove unused function 2021-04-18 09:36:56 +03:00
block block-5.13-2021-05-14 2021-05-15 08:52:30 -07:00
bluetooth Networking changes for 5.13. 2021-04-29 11:57:23 -07:00
bus ARM: SoC drivers for v5.13 2021-04-26 12:11:52 -07:00
cdrom cdrom: gdrom: initialize global variable at init time 2021-05-13 18:58:44 +02:00
char Char/misc driver fixes for 5.13-rc3 2021-05-20 06:31:52 -10:00
clk clk: Skip clk provider registration when np is NULL 2021-05-11 08:47:25 +02:00
clocksource clocksource/drivers/hyper-v: Re-enable VDSO_CLOCKMODE_HVCLOCK on X86 2021-05-14 14:55:13 +02:00
comedi staging: comedi: move out of staging directory 2021-04-15 09:26:25 +02:00
connector
counter
cpufreq Fix an idle CPU selection bug, and an AMD Ryzen maximum frequency enumeration bug. 2021-05-15 10:24:48 -07:00
cpuidle
crypto Revert "crypto: cavium/nitrox - add an error message to explain the failure of pci_request_mem_regions" 2021-05-13 17:23:05 +02:00
cxl cxl/mem: Fix memory device capacity probing 2021-04-16 18:21:56 -07:00
dax
dca
devfreq
dio
dma dmaengine: qcom_hidma: comment platform_driver_register call 2021-05-13 18:32:29 +02:00
dma-buf dma-buf: fix unintended pin/unpin warnings 2021-05-20 14:02:27 +02:00
edac x86/msr: Rename MSR_K8_SYSCFG to MSR_AMD64_SYSCFG 2021-05-10 07:51:38 +02:00
eisa
extcon - Core Frameworks 2021-04-28 15:59:13 -07:00
firewire The usual updates from the irq departement: 2021-04-26 09:43:16 -07:00
firmware ARM: SoC fixes for 5.13 2021-05-20 14:46:26 -10:00
fpga ARM: SoC drivers for v5.13 2021-04-26 12:11:52 -07:00
fsi
gnss
gpio gpio: tegra186: Don't set parent IRQ affinity 2021-05-12 13:56:43 +02:00
gpu Merge tag 'drm-intel-fixes-2021-05-27' of ssh://git.freedesktop.org/git/drm/drm-intel into drm-fixes 2021-05-28 13:28:18 +10:00
greybus greybus: es2: fix kernel-doc warnings 2021-04-16 07:26:50 +02:00
hid Merge branch 'for-5.13/warnings' into for-linus 2021-04-29 21:47:22 +02:00
hsi HSI: core: fix resource leaks in hsi_add_client_from_dt() 2021-04-16 00:14:49 +02:00
hv printk changes for 5.13 2021-04-27 18:09:44 -07:00
hwmon Char/misc driver fixes for 5.13-rc3 2021-05-20 06:31:52 -10:00
hwspinlock
hwtracing ARM: 2021-05-01 10:14:08 -07:00
i2c i2c: s3c2410: fix possible NULL pointer deref on read message after write 2021-05-28 10:16:23 +02:00
i3c Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" 2021-04-24 22:21:01 +02:00
ide
idle
iio iio: adc: ad7793: Add missing error code in ad7793_setup() 2021-05-22 08:32:36 +01:00
infiniband Networking fixes for 5.13-rc4, including fixes from bpf, netfilter, 2021-05-26 17:44:49 -10:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2021-05-06 23:37:55 -07:00
interconnect interconnect: qcom: Add missing MODULE_DEVICE_TABLE 2021-05-11 07:26:31 +03:00
iommu iommu/vt-d: Fix sysfs leak in alloc_iommu() 2021-05-27 16:07:08 +02:00
ipack
irqchip irqchip: Remove redundant error printing 2021-05-16 13:07:18 +01:00
isdn Networking fixes for 5.13-rc4, including fixes from bpf, netfilter, 2021-05-26 17:44:49 -10:00
leds leds: lp5523: check return value of lp5xx_read and jump to cleanup code 2021-05-13 17:30:15 +02:00
lightnvm lightnvm: deprecated OCSSD support and schedule it for removal in Linux 5.15 2021-04-13 09:16:12 -06:00
macintosh macintosh/via-pmu: Fix build warning 2021-04-16 23:57:51 +10:00
mailbox - qcom: enable support for SM8350 and SC7280 2021-04-28 16:10:33 -07:00
mcb
md block-5.13-2021-05-28 2021-05-28 14:42:37 -10:00
media media: gspca: properly check for errors in po1030_probe() 2021-05-13 18:58:32 +02:00
memory .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
memstick memstick: r592: ignore kfifo_out() return code again 2021-04-26 11:08:23 +02:00
message scsi: message: fusion: Remove unused local variable 'vtarget' 2021-04-13 01:39:12 -04:00
mfd - Core Frameworks 2021-04-28 15:59:13 -07:00
misc Char/Misc driver fixes for 5.13-rc4 2021-05-29 06:41:50 -10:00
mmc mmc: sdhci-pci-gli: increase 1.8V regulator wait 2021-05-10 14:39:06 +02:00
most Staging/IIO driver updates for 5.13-rc1 2021-04-26 11:14:21 -07:00
mtd mtd: parsers: ofpart: fix parsing subpartitions 2021-05-10 18:34:30 +02:00
mux
net Networking fixes for 5.13-rc4, including fixes from bpf, netfilter, 2021-05-26 17:44:49 -10:00
nfc NFC: nfcmrvl: fix kernel-doc syntax in file headers 2021-05-23 17:26:38 -07:00
ntb
nubus
nvdimm include: remove pagemap.h from blkdev.h 2021-05-06 19:24:11 -07:00
nvme nvmet: fix false keep-alive timeout when a controller is torn down 2021-05-26 16:18:22 +02:00
nvmem
of of: overlay: Remove redundant assignment to ret 2021-05-03 13:57:56 -05:00
opp
parisc
parport treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
pci more s390 updates for 5.13 merge window 2021-05-06 14:39:50 -07:00
pcmcia
perf ARM: 2021-05-01 10:14:08 -07:00
phy Networking changes for 5.13. 2021-04-29 11:57:23 -07:00
pinctrl linux/kconfig.h: replace IF_ENABLED() with PTR_IF() in <linux/kernel.h> 2021-05-09 00:29:45 +09:00
platform platform/x86: touchscreen_dmi: Add info for the Chuwi Hi10 Pro (CWI529) tablet 2021-05-20 14:11:03 +02:00
pnp
power power supply and reset changes for the v5.13 series 2021-04-28 15:43:58 -07:00
powercap
pps TTY/Serial driver updates for 5.13-rc1 2021-04-26 11:20:10 -07:00
ps3
ptp ptp: ocp: Fix a resource leak in an error handling path 2021-05-12 14:06:33 -07:00
pwm pwm: Changes for v5.13-rc1 2021-05-05 12:53:16 -07:00
rapidio rapidio: handle create_workqueue() failure 2021-05-13 18:32:19 +02:00
ras
regulator - Core Frameworks 2021-04-28 15:59:13 -07:00
remoteproc remoteproc updates for v5.13 2021-05-04 11:13:33 -07:00
reset pci-v5.13-changes 2021-05-05 13:24:11 -07:00
rpmsg
rtc RTC for 5.13 2021-05-03 12:15:21 -07:00
s390 - Fix races in vfio-ccw request handling. 2021-05-29 05:51:53 -10:00
sbus
scsi SCSI fixes on 20210528 2021-05-28 14:47:48 -10:00
sh The usual updates from the irq departement: 2021-04-26 09:43:16 -07:00
siox
slimbus
soc IOMMU Updates for Linux v5.13 2021-05-01 09:33:00 -07:00
soundwire soundwire: qcom: fix handling of qcom,ports-block-pack-mode 2021-05-13 11:14:13 +05:30
spi spi: sc18is602: implement .max_{transfer,message}_size() for the controller 2021-05-21 13:13:33 +01:00
spmi
ssb
staging Second set of IIO fixes for the 5.13 cycle 2021-05-22 09:49:59 +02:00
target scsi: target: iblock: Fix smp_processor_id() BUG messages 2021-05-21 16:40:00 -04:00
tc
tee AMD-TEE reference count loaded TAs 2021-05-17 16:06:02 +02:00
thermal thermal/drivers/qcom: Fix error code in adc_tm5_get_dt_channel_data() 2021-05-27 11:38:34 +02:00
thunderbolt thunderbolt: usb4: Fix NVM read buffer bounds and offset issue 2021-05-20 11:52:58 +03:00
tty TTY / Serial driver fixes for 5.13-rc4 2021-05-29 06:25:16 -10:00
uio uio_hv_generic: Fix another memory leak in error handling paths 2021-05-14 13:26:04 +02:00
usb usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL 2021-06-02 16:50:54 +02:00
vdpa {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table 2021-05-18 23:01:48 -07:00
vfio IOMMU Updates for Linux v5.13 2021-05-01 09:33:00 -07:00
vhost virtio,vhost,vdpa: features, fixes 2021-05-05 13:31:39 -07:00
video video: hgafb: correctly handle card detect failure during probe 2021-05-21 15:04:05 +02:00
virt nitro_enclaves: Fix stale file descriptors on failed usercopy 2021-04-29 19:06:49 +02:00
virtio virtio_pci_modern: correct sparse tags for notify 2021-05-04 04:19:59 -04:00
visorbus
vlynq
vme
w1
watchdog - Core Frameworks 2021-04-28 15:59:13 -07:00
xen xen-pciback: reconfigure also from backend watch handler 2021-05-21 09:55:16 +02:00
zorro
Kconfig staging: comedi: move out of staging directory 2021-04-15 09:26:25 +02:00
Makefile virtio,vhost,vdpa: features, fixes 2021-05-05 13:31:39 -07:00