kernel/ucsi-oops-fixes.patch

Received-SPF: pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) client-ip=134.134.136.126;
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hans de Goede <hdegoede@redhat.com>,
	linux-usb@vger.kernel.org,
	stable@vger.kernel.org
Subject: [PATCH 1/2] usb: typec: ucsi: displayport: Fix NULL pointer dereference
Date: Wed, 11 Mar 2020 16:00:05 +0300
Message-Id: <20200311130006.41288-2-heikki.krogerus@linux.intel.com>
In-Reply-To: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
References: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

If the registration of the DisplayPort was not successful,
or if the port does not support DisplayPort alt mode in the
first place, the function ucsi_displayport_remove_partner()
will fail with NULL pointer dereference when it attempts to
access the driver data.

Adding a check to the function to make sure there really is
driver data for the device before modifying it.

Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Reported-by: Andrea Gagliardi La Gala <andrea.lagala@gmail.com>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=3D206365
Cc: stable@vger.kernel.org
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
 drivers/usb/typec/ucsi/displayport.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/=
displayport.c
index 0f1273ae086c..261131c9e37c 100644
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -271,6 +271,9 @@ void ucsi_displayport_remove_partner(struct typec_altmo=
de *alt)
 =09=09return;
=20
 =09dp =3D typec_altmode_get_drvdata(alt);
+=09if (!dp)
+=09=09return;
+
 =09dp->data.conf =3D 0;
 =09dp->data.status =3D 0;
 =09dp->initialized =3D false;
--=20
2.25.1

Delivered-To: hdegoede@gapps.redhat.com
Received: by 2002:ac9:3cca:0:0:0:0:0 with SMTP id x10csp668601ocf;
        Wed, 11 Mar 2020 06:00:21 -0700 (PDT)
X-Google-Smtp-Source: ADFU+vsGhdWLjQ3QpxqWj6WbYOo0YlQLm+xaXhCA9qDlbUCuTwO0DTYoUpCtv/Wic/3KISqZC1e0
X-Received: by 2002:a17:906:90d9:: with SMTP id v25mr2356602ejw.73.1583931621591;
        Wed, 11 Mar 2020 06:00:21 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1583931621; cv=none;
        d=google.com; s=arc-20160816;
        b=TLDfI22LVNxWmkmYrQN2uyHHPtPhg7WoBmf4iRg+OckIGdycsI9lsHbEayPwTnavnh
         zh/vP7ADiHK/CgvjRmi23hCcrqZchwKPBXKVGyfsW3uVNSuKzUHc/hvUeH4kyDpUkYei
         DYmbgn+d4egWgMwPcnILYiOOXOVCRXM5fx2dZ1fce9PUl2XNCZ2WVg4a9oRUD1sTUpSM
         5bSTil75+tWtb8iWaE6mjnA9QGdt8Fro9J5c96ieLXGDeBnn17yqeV0z2x5041uCzomd
         VjYisvIyCmgwyrP/1rmcNiefcXT8cywY6VDBXT4iZokr9E+Uc9oaWlrr68Dknu0L9Sps
         kikQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=content-transfer-encoding:mime-version:references:in-reply-to
         :message-id:date:subject:cc:to:from:delivered-to;
        bh=2VcPAoJ6MUqHi98RX96U06C9ISBArMXJM424R6yWYho=;
        b=pgfElkmeiDab/DIqnu1P0nT7ENBYKSc1y7f0xD7a3nxknW4dRVi0JTJB0U0LlWHKMi
         oD+hUOzkTK7A6WFPHHQYUBwWaP1l4YyV9NttwwdNGvqJ3QPLaSRMGE1o8GMviHmTCinS
         wyoSx18HZANbQFED3KSI0XOvRPCxnItDbLtvd8xCCddAHkEoBJSWO2xMCxaTmiw9OrjP
         bJnzeQzbmEnLwTiYz/v9cwb99Rmnu8L6I/wgdbdso92c3YTO2jSCcEZcwsXOZOrrwfvB
         OpyJ9yZ53djiEcP9IXwuMIIuwGoo3jiRzoBTKYVvD6m/w+RUWNqyiadKfEC81qIjtM8e
         L0sA==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=heikki.krogerus@linux.intel.com
Return-Path: <heikki.krogerus@linux.intel.com>
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com. [207.211.31.120])
        by mx.google.com with ESMTPS id n15si1068927ejy.114.2020.03.11.06.00.21
        for <hdegoede@gapps.redhat.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 11 Mar 2020 06:00:21 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) client-ip=134.134.136.126;
Authentication-Results: mx.google.com;
       spf=pass (google.com: best guess record for domain of heikki.krogerus@linux.intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=heikki.krogerus@linux.intel.com
Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com
 [66.187.233.88]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-457-hFBicEuyOd600736mXrw_g-1; Wed, 11 Mar 2020 09:00:19 -0400
X-MC-Unique: hFBicEuyOd600736mXrw_g-1
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B396080029A
	for <hdegoede@gapps.redhat.com>; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Received: by smtp.corp.redhat.com (Postfix)
	id B09DA2037E5A; Wed, 11 Mar 2020 13:00:18 +0000 (UTC)
Delivered-To: hdegoede@redhat.com
Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id AA6B62026D67
	for <hdegoede@redhat.com>; Wed, 11 Mar 2020 13:00:17 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0FD8B8001EA
	for <hdegoede@redhat.com>; Wed, 11 Mar 2020 13:00:17 +0000 (UTC)
Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) (Using
 TLS) by relay.mimecast.com with ESMTP id
 us-mta-60-lllq3BsjPKu9X3G8f-NF5Q-1; Wed, 11 Mar 2020 09:00:14 -0400
X-MC-Unique: lllq3BsjPKu9X3G8f-NF5Q-1
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from fmsmga001.fm.intel.com ([10.253.24.23])
  by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Mar 2020 06:00:13 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.70,540,1574150400";
   d="scan'208";a="353878533"
Received: from black.fi.intel.com (HELO black.fi.intel.com.) ([10.237.72.28])
  by fmsmga001.fm.intel.com with ESMTP; 11 Mar 2020 06:00:11 -0700
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hans de Goede <hdegoede@redhat.com>,
	linux-usb@vger.kernel.org,
	stable@vger.kernel.org
Subject: [PATCH 2/2] usb: typec: ucsi: displayport: Fix a potential race during registration
Date: Wed, 11 Mar 2020 16:00:06 +0300
Message-Id: <20200311130006.41288-3-heikki.krogerus@linux.intel.com>
In-Reply-To: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
References: <20200311130006.41288-1-heikki.krogerus@linux.intel.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: linux.intel.com
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

Locking the connector in ucsi_register_displayport() to make
sure that nothing can access the displayport alternate mode
before the function has finished and the alternate mode is
actually ready.

Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc: stable@vger.kernel.org
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
 drivers/usb/typec/ucsi/displayport.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/=
displayport.c
index 261131c9e37c..048381c058a5 100644
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -288,6 +288,8 @@ struct typec_altmode *ucsi_register_displayport(struct =
ucsi_connector *con,
 =09struct typec_altmode *alt;
 =09struct ucsi_dp *dp;
=20
+=09mutex_lock(&con->lock);
+
 =09/* We can't rely on the firmware with the capabilities. */
 =09desc->vdo |=3D DP_CAP_DP_SIGNALING | DP_CAP_RECEPTACLE;
=20
@@ -296,12 +298,15 @@ struct typec_altmode *ucsi_register_displayport(struc=
t ucsi_connector *con,
 =09desc->vdo |=3D all_assignments << 16;
=20
 =09alt =3D typec_port_register_altmode(con->port, desc);
-=09if (IS_ERR(alt))
+=09if (IS_ERR(alt)) {
+=09=09mutex_unlock(&con->lock);
 =09=09return alt;
+=09}
=20
 =09dp =3D devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL);
 =09if (!dp) {
 =09=09typec_unregister_altmode(alt);
+=09=09mutex_unlock(&con->lock);
 =09=09return ERR_PTR(-ENOMEM);
 =09}
=20
@@ -314,5 +319,7 @@ struct typec_altmode *ucsi_register_displayport(struct =
ucsi_connector *con,
 =09alt->ops =3D &ucsi_displayport_ops;
 =09typec_altmode_set_drvdata(alt, dp);
=20
+=09mutex_unlock(&con->lock);
+
 =09return alt;
 }
--=20
2.25.1