1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
|
Delivered-To: hdegoede@gapps.redhat.com
Received: by 2002:ac9:3cca:0:0:0:0:0 with SMTP id x10csp668580ocf;
Wed, 11 Mar 2020 06:00:20 -0700 (PDT)
X-Google-Smtp-Source: ADFU+vvLKVQ2NCRrbKk+46iEGOgL/dp5kNAySiFCE1BMXIcEIQUMJiy8VDfxwzkL4b/KDmsigoak
X-Received: by 2002:a25:6806:: with SMTP id d6mr2754667ybc.326.1583931620742;
Wed, 11 Mar 2020 06:00:20 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1583931620; cv=none;
d=google.com; s=arc-20160816;
b=GRQ4h+cMvCbklF6XW5Q2mltKo9tJfib6QJHpNf6iNAtnlnvES/vRFnJJTCa601ohr9
C/HY4T0/cN46QA/mdPDIQz1+CMUnRpi7PDYoLeoc8TUMaPY/PU7QG3eQB6Mc8qP608Y9
72lCJ+R+IEaXBUgNAmtiD1DB3C2bi8EctnvQN6JxfAAUU6Qp802Ru2kxmAI24d4GVjF9
+FweOPG0cKBTdc8Al2jDyW7BIlYxtbSa1T/CvPUoNznd7ojx7uzwYegsvvfP9gicpzVa
fEoH1Bhxvx/qURM0GfOO6xsxAX1jG8c58JGoNZLWYCqfA3p/k4FgsLtrWxIHDHC/FG+0
PGGg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:mime-version:references:in-reply-to
:message-id:date:subject:cc:to:from:delivered-to;
bh=QqHHD8kGkQgrKZCRDMePpiviR2jnsd9jIjJ3n7LCR5M=;
b=ycs3X68dm/6atsaad09LdioLoV+Js6lfsdgJsmymghQw7Wtld2MRz3STNMD1QcCD90
sYGhDb0ilsba4RKe2G6hoXDLAau1VFSS6Yam9htpytW2hdea/r1nIG6W1m03UZtZ1wsA
da/jufsdUKNhcKmZJs5Ok0Zk9c3F6Zt/h0IemuKwfFolV6q2EpfpogUH7DQsVZXWEKND
l+apv3mjYqv5rJBRVY1q0H4/pNVuptRX+2Srnj5Siz+982kSAAGgb3WFB3AsS7RyklgX
1Ho+CIco+U0d1wHM9BXylsjvLLjQRQOMklWXHm1qqXPQ0ybhClJmED5sJIr/Jf4mJ0KB
A1Ng==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=heikki.krogerus@linux.intel.com
Return-Path: <heikki.krogerus@linux.intel.com>
Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com. [205.139.110.61])
by mx.google.com with ESMTPS id a15si1271762ybk.78.2020.03.11.06.00.20
for <hdegoede@gapps.redhat.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 11 Mar 2020 06:00:20 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) client-ip=134.134.136.126;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=heikki.krogerus@linux.intel.com
Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com
[66.187.233.88]) (Using TLS) by relay.mimecast.com with ESMTP id
us-mta-456-lABK24RoPMylyDoOfppDdw-1; Wed, 11 Mar 2020 09:00:19 -0400
X-MC-Unique: lABK24RoPMylyDoOfppDdw-1
Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3])
(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by mimecast-mx02.redhat.com (Postfix) with ESMTPS id F06A8185A795
for <hdegoede@gapps.redhat.com>; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Received: by smtp.corp.redhat.com (Postfix)
id ED3AF1134CD6; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Delivered-To: hdegoede@redhat.com
Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19])
by smtp.corp.redhat.com (Postfix) with ESMTPS id E8DE21134CC1
for <hdegoede@redhat.com>; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(No client certificate requested)
by mimecast-mx02.redhat.com (Postfix) with ESMTPS id D4F1980030B
for <hdegoede@redhat.com>; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) (Using
TLS) by relay.mimecast.com with ESMTP id
us-mta-396-cq2xxB_jPiKPJtJzTaqmBA-2; Wed, 11 Mar 2020 09:00:13 -0400
X-MC-Unique: cq2xxB_jPiKPJtJzTaqmBA-2
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from fmsmga001.fm.intel.com ([10.253.24.23])
by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Mar 2020 06:00:11 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.70,540,1574150400";
d="scan'208";a="353878525"
Received: from black.fi.intel.com (HELO black.fi.intel.com.) ([10.237.72.28])
by fmsmga001.fm.intel.com with ESMTP; 11 Mar 2020 06:00:09 -0700
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hans de Goede <hdegoede@redhat.com>,
linux-usb@vger.kernel.org,
stable@vger.kernel.org
Subject: [PATCH 1/2] usb: typec: ucsi: displayport: Fix NULL pointer dereference
Date: Wed, 11 Mar 2020 16:00:05 +0300
Message-Id: <20200311130006.41288-2-heikki.krogerus@linux.intel.com>
In-Reply-To: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
References: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: linux.intel.com
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
If the registration of the DisplayPort was not successful,
or if the port does not support DisplayPort alt mode in the
first place, the function ucsi_displayport_remove_partner()
will fail with NULL pointer dereference when it attempts to
access the driver data.
Adding a check to the function to make sure there really is
driver data for the device before modifying it.
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Reported-by: Andrea Gagliardi La Gala <andrea.lagala@gmail.com>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=3D206365
Cc: stable@vger.kernel.org
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
drivers/usb/typec/ucsi/displayport.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/=
displayport.c
index 0f1273ae086c..261131c9e37c 100644
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -271,6 +271,9 @@ void ucsi_displayport_remove_partner(struct typec_altmo=
de *alt)
=09=09return;
=20
=09dp =3D typec_altmode_get_drvdata(alt);
+=09if (!dp)
+=09=09return;
+
=09dp->data.conf =3D 0;
=09dp->data.status =3D 0;
=09dp->initialized =3D false;
--=20
2.25.1
Delivered-To: hdegoede@gapps.redhat.com
Received: by 2002:ac9:3cca:0:0:0:0:0 with SMTP id x10csp668601ocf;
Wed, 11 Mar 2020 06:00:21 -0700 (PDT)
X-Google-Smtp-Source: ADFU+vsGhdWLjQ3QpxqWj6WbYOo0YlQLm+xaXhCA9qDlbUCuTwO0DTYoUpCtv/Wic/3KISqZC1e0
X-Received: by 2002:a17:906:90d9:: with SMTP id v25mr2356602ejw.73.1583931621591;
Wed, 11 Mar 2020 06:00:21 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1583931621; cv=none;
d=google.com; s=arc-20160816;
b=TLDfI22LVNxWmkmYrQN2uyHHPtPhg7WoBmf4iRg+OckIGdycsI9lsHbEayPwTnavnh
zh/vP7ADiHK/CgvjRmi23hCcrqZchwKPBXKVGyfsW3uVNSuKzUHc/hvUeH4kyDpUkYei
DYmbgn+d4egWgMwPcnILYiOOXOVCRXM5fx2dZ1fce9PUl2XNCZ2WVg4a9oRUD1sTUpSM
5bSTil75+tWtb8iWaE6mjnA9QGdt8Fro9J5c96ieLXGDeBnn17yqeV0z2x5041uCzomd
VjYisvIyCmgwyrP/1rmcNiefcXT8cywY6VDBXT4iZokr9E+Uc9oaWlrr68Dknu0L9Sps
kikQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:mime-version:references:in-reply-to
:message-id:date:subject:cc:to:from:delivered-to;
bh=2VcPAoJ6MUqHi98RX96U06C9ISBArMXJM424R6yWYho=;
b=pgfElkmeiDab/DIqnu1P0nT7ENBYKSc1y7f0xD7a3nxknW4dRVi0JTJB0U0LlWHKMi
oD+hUOzkTK7A6WFPHHQYUBwWaP1l4YyV9NttwwdNGvqJ3QPLaSRMGE1o8GMviHmTCinS
wyoSx18HZANbQFED3KSI0XOvRPCxnItDbLtvd8xCCddAHkEoBJSWO2xMCxaTmiw9OrjP
bJnzeQzbmEnLwTiYz/v9cwb99Rmnu8L6I/wgdbdso92c3YTO2jSCcEZcwsXOZOrrwfvB
OpyJ9yZ53djiEcP9IXwuMIIuwGoo3jiRzoBTKYVvD6m/w+RUWNqyiadKfEC81qIjtM8e
L0sA==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=heikki.krogerus@linux.intel.com
Return-Path: <heikki.krogerus@linux.intel.com>
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com. [207.211.31.120])
by mx.google.com with ESMTPS id n15si1068927ejy.114.2020.03.11.06.00.21
for <hdegoede@gapps.redhat.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 11 Mar 2020 06:00:21 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) client-ip=134.134.136.126;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=heikki.krogerus@linux.intel.com
Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com
[66.187.233.88]) (Using TLS) by relay.mimecast.com with ESMTP id
us-mta-457-hFBicEuyOd600736mXrw_g-1; Wed, 11 Mar 2020 09:00:19 -0400
X-MC-Unique: hFBicEuyOd600736mXrw_g-1
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4])
(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B396080029A
for <hdegoede@gapps.redhat.com>; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Received: by smtp.corp.redhat.com (Postfix)
id B09DA2037E5A; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Delivered-To: hdegoede@redhat.com
Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21])
by smtp.corp.redhat.com (Postfix) with ESMTPS id AA6B62026D67
for <hdegoede@redhat.com>; Wed, 11 Mar 2020 13:00:17 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(No client certificate requested)
by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0FD8B8001EA
for <hdegoede@redhat.com>; Wed, 11 Mar 2020 13:00:17 +0000 (UTC)
Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) (Using
TLS) by relay.mimecast.com with ESMTP id
us-mta-60-lllq3BsjPKu9X3G8f-NF5Q-1; Wed, 11 Mar 2020 09:00:14 -0400
X-MC-Unique: lllq3BsjPKu9X3G8f-NF5Q-1
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from fmsmga001.fm.intel.com ([10.253.24.23])
by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Mar 2020 06:00:13 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.70,540,1574150400";
d="scan'208";a="353878533"
Received: from black.fi.intel.com (HELO black.fi.intel.com.) ([10.237.72.28])
by fmsmga001.fm.intel.com with ESMTP; 11 Mar 2020 06:00:11 -0700
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hans de Goede <hdegoede@redhat.com>,
linux-usb@vger.kernel.org,
stable@vger.kernel.org
Subject: [PATCH 2/2] usb: typec: ucsi: displayport: Fix a potential race during registration
Date: Wed, 11 Mar 2020 16:00:06 +0300
Message-Id: <20200311130006.41288-3-heikki.krogerus@linux.intel.com>
In-Reply-To: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
References: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: linux.intel.com
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Locking the connector in ucsi_register_displayport() to make
sure that nothing can access the displayport alternate mode
before the function has finished and the alternate mode is
actually ready.
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc: stable@vger.kernel.org
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
drivers/usb/typec/ucsi/displayport.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/=
displayport.c
index 261131c9e37c..048381c058a5 100644
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -288,6 +288,8 @@ struct typec_altmode *ucsi_register_displayport(struct =
ucsi_connector *con,
=09struct typec_altmode *alt;
=09struct ucsi_dp *dp;
=20
+=09mutex_lock(&con->lock);
+
=09/* We can't rely on the firmware with the capabilities. */
=09desc->vdo |=3D DP_CAP_DP_SIGNALING | DP_CAP_RECEPTACLE;
=20
@@ -296,12 +298,15 @@ struct typec_altmode *ucsi_register_displayport(struc=
t ucsi_connector *con,
=09desc->vdo |=3D all_assignments << 16;
=20
=09alt =3D typec_port_register_altmode(con->port, desc);
-=09if (IS_ERR(alt))
+=09if (IS_ERR(alt)) {
+=09=09mutex_unlock(&con->lock);
=09=09return alt;
+=09}
=20
=09dp =3D devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL);
=09if (!dp) {
=09=09typec_unregister_altmode(alt);
+=09=09mutex_unlock(&con->lock);
=09=09return ERR_PTR(-ENOMEM);
=09}
=20
@@ -314,5 +319,7 @@ struct typec_altmode *ucsi_register_displayport(struct =
ucsi_connector *con,
=09alt->ops =3D &ucsi_displayport_ops;
=09typec_altmode_set_drvdata(alt, dp);
=20
+=09mutex_unlock(&con->lock);
+
=09return alt;
}
--=20
2.25.1
|
