Skip to content

Commit e3dbb65

Browse files
jhovoldgregkh
authored andcommitted
USB: dwc3: fix use-after-free on core driver unbind
Some dwc3 glue drivers are currently accessing the driver data of the child core device directly, which is clearly a bad idea as the child may not have probed yet or may have been unbound from its driver. As a workaround until the glue drivers have been fixed, clear the driver data pointer before allowing the glue parent device to runtime suspend to prevent its driver from accessing data that has been freed during unbind. Fixes: 6dd2565 ("usb: dwc3: add imx8mp dwc3 glue layer driver") Fixes: 6895ea5 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable@vger.kernel.org # 5.12 Cc: Li Jun <jun.li@nxp.com> Cc: Sandeep Maheswaram <quic_c_sanm@quicinc.com> Cc: Krishna Kurapati <quic_kriskura@quicinc.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Message-ID: <20230607100540.31045-3-johan+linaro@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent d2d6935 commit e3dbb65

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

drivers/usb/dwc3/core.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1929,6 +1929,11 @@ static int dwc3_remove(struct platform_device *pdev)
19291929
pm_runtime_disable(&pdev->dev);
19301930
pm_runtime_dont_use_autosuspend(&pdev->dev);
19311931
pm_runtime_put_noidle(&pdev->dev);
1932+
/*
1933+
* HACK: Clear the driver data, which is currently accessed by parent
1934+
* glue drivers, before allowing the parent to suspend.
1935+
*/
1936+
platform_set_drvdata(pdev, NULL);
19321937
pm_runtime_set_suspended(&pdev->dev);
19331938

19341939
dwc3_free_event_buffers(dwc);

0 commit comments

Comments
 (0)