git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From d18d5143d6b474d84a5a7823194e9f413619352d Mon Sep 17 00:00:00 2001
   2 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   3 Date: Fri, 30 Aug 2024 15:47:42 +0200
   4 Subject: usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"
   5
   6 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   7
   8 In commit b16abab1fb64 ("usb: typec: tcpm: unregister existing source
   9 caps before re-registration"), quilt, and git, applied the diff to the
  10 incorrect function, which would cause bad problems if exercised in a
  11 device with these capabilities.
  12
  13 Fix this all up (including the follow-up fix in commit 04c05d50fa79
  14 ("usb: typec: tcpm: fix use-after-free case in
  15 tcpm_register_source_caps") to be in the correct function.
  16
  17 Fixes: 04c05d50fa79 ("usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps")
  18 Fixes: b16abab1fb64 ("usb: typec: tcpm: unregister existing source caps before re-registration")
  19 Reported-by: Charles Yo <charlesyo@google.com>
  20 Cc: Kyle Tso <kyletso@google.com>
  21 Cc: Amit Sunil Dhamne <amitsd@google.com>
  22 Cc: Ondrej Jirman <megi@xff.cz>
  23 Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
  24 Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
  25 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  27 ---
  28  drivers/usb/typec/tcpm/tcpm.c |   14 +++++++-------
  29  1 file changed, 7 insertions(+), 7 deletions(-)
  30
  31 --- a/drivers/usb/typec/tcpm/tcpm.c
  32 +++ b/drivers/usb/typec/tcpm/tcpm.c
  33 @@ -2403,7 +2403,7 @@ static int tcpm_register_source_caps(str
  34  {
  35         struct usb_power_delivery_desc desc = { port->negotiated_rev };
  36         struct usb_power_delivery_capabilities_desc caps = { };
  37 -       struct usb_power_delivery_capabilities *cap;
  38 +       struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
  39
  40         if (!port->partner_pd)
  41                 port->partner_pd = usb_power_delivery_register(NULL, &desc);
  42 @@ -2413,6 +2413,11 @@ static int tcpm_register_source_caps(str
  43         memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
  44         caps.role = TYPEC_SOURCE;
  45
  46 +       if (cap) {
  47 +               usb_power_delivery_unregister_capabilities(cap);
  48 +               port->partner_source_caps = NULL;
  49 +       }
  50 +
  51         cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
  52         if (IS_ERR(cap))
  53                 return PTR_ERR(cap);
  54 @@ -2426,7 +2431,7 @@ static int tcpm_register_sink_caps(struc
  55  {
  56         struct usb_power_delivery_desc desc = { port->negotiated_rev };
  57         struct usb_power_delivery_capabilities_desc caps = { };
  58 -       struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
  59 +       struct usb_power_delivery_capabilities *cap;
  60
  61         if (!port->partner_pd)
  62                 port->partner_pd = usb_power_delivery_register(NULL, &desc);
  63 @@ -2436,11 +2441,6 @@ static int tcpm_register_sink_caps(struc
  64         memcpy(caps.pdo, port->sink_caps, sizeof(u32) * port->nr_sink_caps);
  65         caps.role = TYPEC_SINK;
  66
  67 -       if (cap) {
  68 -               usb_power_delivery_unregister_capabilities(cap);
  69 -               port->partner_source_caps = NULL;
  70 -       }
  71 -
  72         cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
  73         if (IS_ERR(cap))
  74                 return PTR_ERR(cap);