]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
USB: dwc3: fix use-after-free on core driver unbind
authorJohan Hovold <johan+linaro@kernel.org>
Wed, 7 Jun 2023 10:05:40 +0000 (12:05 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 21 Jun 2023 14:02:12 +0000 (16:02 +0200)
commit9184183f20e2731dac4b95bed14c25f0df5c74b4
tree404d20649f6740ce7aae32cdd3d36258cacc562a
parent81ebc532ae3610e65b7737a2d669a5f6fb8756b0
USB: dwc3: fix use-after-free on core driver unbind

commit e3dbb657571509044be15184a13134fa7c1fdca1 upstream.

Some dwc3 glue drivers are currently accessing the driver data of the
child core device directly, which is clearly a bad idea as the child may
not have probed yet or may have been unbound from its driver.

As a workaround until the glue drivers have been fixed, clear the driver
data pointer before allowing the glue parent device to runtime suspend
to prevent its driver from accessing data that has been freed during
unbind.

Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver")
Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
Cc: stable@vger.kernel.org # 5.12
Cc: Li Jun <jun.li@nxp.com>
Cc: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
Cc: Krishna Kurapati <quic_kriskura@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Message-ID: <20230607100540.31045-3-johan+linaro@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/dwc3/core.c