git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From d18d5143d6b474d84a5a7823194e9f413619352d Mon Sep 17 00:00:00 2001
   2 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   3 Date: Fri, 30 Aug 2024 15:47:42 +0200
   4 Subject: usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"
   5
   6 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   7
   8 In commit b16abab1fb64 ("usb: typec: tcpm: unregister existing source
   9 caps before re-registration"), quilt, and git, applied the diff to the
  10 incorrect function, which would cause bad problems if exercised in a
  11 device with these capabilities.
  12
  13 Fix this all up (including the follow-up fix in commit 04c05d50fa79
  14 ("usb: typec: tcpm: fix use-after-free case in
  15 tcpm_register_source_caps") to be in the correct function.
  16
  17 Fixes: 04c05d50fa79 ("usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps")
  18 Fixes: b16abab1fb64 ("usb: typec: tcpm: unregister existing source caps before re-registration")
  19 Reported-by: Charles Yo <charlesyo@google.com>
  20 Cc: Kyle Tso <kyletso@google.com>
  21 Cc: Amit Sunil Dhamne <amitsd@google.com>
  22 Cc: Ondrej Jirman <megi@xff.cz>
  23 Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
  24 Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
  25 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26 ---
  27  drivers/usb/typec/tcpm/tcpm.c |   14 +++++++-------
  28  1 file changed, 7 insertions(+), 7 deletions(-)
  29 --- a/drivers/usb/typec/tcpm/tcpm.c
  30 +++ b/drivers/usb/typec/tcpm/tcpm.c
  31 @@ -2403,7 +2403,7 @@ static int tcpm_register_source_caps(str
  32  {
  33         struct usb_power_delivery_desc desc = { port->negotiated_rev };
  34         struct usb_power_delivery_capabilities_desc caps = { };
  35 -       struct usb_power_delivery_capabilities *cap;
  36 +       struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
  37
  38         if (!port->partner_pd)
  39                 port->partner_pd = usb_power_delivery_register(NULL, &desc);
  40 @@ -2413,6 +2413,11 @@ static int tcpm_register_source_caps(str
  41         memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
  42         caps.role = TYPEC_SOURCE;
  43
  44 +       if (cap) {
  45 +               usb_power_delivery_unregister_capabilities(cap);
  46 +               port->partner_source_caps = NULL;
  47 +       }
  48 +
  49         cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
  50         if (IS_ERR(cap))
  51                 return PTR_ERR(cap);
  52 @@ -2426,7 +2431,7 @@ static int tcpm_register_sink_caps(struc
  53  {
  54         struct usb_power_delivery_desc desc = { port->negotiated_rev };
  55         struct usb_power_delivery_capabilities_desc caps = { };
  56 -       struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
  57 +       struct usb_power_delivery_capabilities *cap;
  58
  59         if (!port->partner_pd)
  60                 port->partner_pd = usb_power_delivery_register(NULL, &desc);
  61 @@ -2436,11 +2441,6 @@ static int tcpm_register_sink_caps(struc
  62         memcpy(caps.pdo, port->sink_caps, sizeof(u32) * port->nr_sink_caps);
  63         caps.role = TYPEC_SINK;
  64
  65 -       if (cap) {
  66 -               usb_power_delivery_unregister_capabilities(cap);
  67 -               port->partner_source_caps = NULL;
  68 -       }
  69 -
  70         cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
  71         if (IS_ERR(cap))
  72                 return PTR_ERR(cap);