git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 13014969cbf07f18d62ceea40bd8ca8ec9d36cec Mon Sep 17 00:00:00 2001
   2 From: Lianqin Hu <hulianqin@vivo.com>
   3 Date: Tue, 17 Dec 2024 07:58:44 +0000
   4 Subject: usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
   5
   6 From: Lianqin Hu <hulianqin@vivo.com>
   7
   8 commit 13014969cbf07f18d62ceea40bd8ca8ec9d36cec upstream.
   9
  10 Considering that in some extreme cases, when performing the
  11 unbinding operation, gserial_disconnect has cleared gser->ioport,
  12 which triggers gadget reconfiguration, and then calls gs_read_complete,
  13 resulting in access to a null pointer. Therefore, ep is disabled before
  14 gserial_disconnect sets port to null to prevent this from happening.
  15
  16 Call trace:
  17  gs_read_complete+0x58/0x240
  18  usb_gadget_giveback_request+0x40/0x160
  19  dwc3_remove_requests+0x170/0x484
  20  dwc3_ep0_out_start+0xb0/0x1d4
  21  __dwc3_gadget_start+0x25c/0x720
  22  kretprobe_trampoline.cfi_jt+0x0/0x8
  23  kretprobe_trampoline.cfi_jt+0x0/0x8
  24  udc_bind_to_driver+0x1d8/0x300
  25  usb_gadget_probe_driver+0xa8/0x1dc
  26  gadget_dev_desc_UDC_store+0x13c/0x188
  27  configfs_write_iter+0x160/0x1f4
  28  vfs_write+0x2d0/0x40c
  29  ksys_write+0x7c/0xf0
  30  __arm64_sys_write+0x20/0x30
  31  invoke_syscall+0x60/0x150
  32  el0_svc_common+0x8c/0xf8
  33  do_el0_svc+0x28/0xa0
  34  el0_svc+0x24/0x84
  35
  36 Fixes: c1dca562be8a ("usb gadget: split out serial core")
  37 Cc: stable <stable@kernel.org>
  38 Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  39 Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
  40 Link: https://lore.kernel.org/r/TYUPR06MB621733B5AC690DBDF80A0DCCD2042@TYUPR06MB6217.apcprd06.prod.outlook.com
  41 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  42 ---
  43  drivers/usb/gadget/function/u_serial.c |    8 ++++----
  44  1 file changed, 4 insertions(+), 4 deletions(-)
  45
  46 --- a/drivers/usb/gadget/function/u_serial.c
  47 +++ b/drivers/usb/gadget/function/u_serial.c
  48 @@ -1398,6 +1398,10 @@ void gserial_disconnect(struct gserial *
  49         /* REVISIT as above: how best to track this? */
  50         port->port_line_coding = gser->port_line_coding;
  51
  52 +       /* disable endpoints, aborting down any active I/O */
  53 +       usb_ep_disable(gser->out);
  54 +       usb_ep_disable(gser->in);
  55 +
  56         port->port_usb = NULL;
  57         gser->ioport = NULL;
  58         if (port->port.count > 0) {
  59 @@ -1409,10 +1413,6 @@ void gserial_disconnect(struct gserial *
  60         spin_unlock(&port->port_lock);
  61         spin_unlock_irqrestore(&serial_port_lock, flags);
  62
  63 -       /* disable endpoints, aborting down any active I/O */
  64 -       usb_ep_disable(gser->out);
  65 -       usb_ep_disable(gser->in);
  66 -
  67         /* finally, free any unused/unusable I/O buffers */
  68         spin_lock_irqsave(&port->port_lock, flags);
  69         if (port->port.count == 0)