linux-mainline/drivers/usb/dwc3
Johan Hovold e3dbb65757 USB: dwc3: fix use-after-free on core driver unbind
Some dwc3 glue drivers are currently accessing the driver data of the
child core device directly, which is clearly a bad idea as the child may
not have probed yet or may have been unbound from its driver.

As a workaround until the glue drivers have been fixed, clear the driver
data pointer before allowing the glue parent device to runtime suspend
to prevent its driver from accessing data that has been freed during
unbind.

Fixes: 6dd2565989 ("usb: dwc3: add imx8mp dwc3 glue layer driver")
Fixes: 6895ea55c3 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
Cc: stable@vger.kernel.org      # 5.12
Cc: Li Jun <jun.li@nxp.com>
Cc: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
Cc: Krishna Kurapati <quic_kriskura@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Message-ID: <20230607100540.31045-3-johan+linaro@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-13 11:52:32 +02:00
..
core.c USB: dwc3: fix use-after-free on core driver unbind 2023-06-13 11:52:32 +02:00
core.h usb: dwc3: fix gadget mode suspend interrupt handler issue 2023-05-13 17:30:59 +09:00
debug.h usb: dwc3: Add function suspend and function wakeup support 2023-03-29 10:27:01 +02:00
debugfs.c usb: dwc3: debugfs: Resume dwc3 before accessing registers 2023-05-13 17:56:22 +09:00
drd.c
dwc3-am62.c usb: Add explicit of.h of_platform.h include 2023-04-20 10:12:29 +02:00
dwc3-exynos.c
dwc3-haps.c
dwc3-imx8mp.c
dwc3-keystone.c
dwc3-meson-g12a.c
dwc3-of-simple.c
dwc3-omap.c
dwc3-pci.c Merge 6.3-rc6 into usb-next 2023-04-10 08:56:59 +02:00
dwc3-qcom.c USB: dwc3: qcom: fix NULL-deref on suspend 2023-06-13 11:52:32 +02:00
dwc3-st.c
dwc3-xilinx.c usb: dwc3: xilinx: Remove unused of_gpio,h 2023-02-16 12:45:30 +01:00
ep0.c usb: dwc3: Add function suspend and function wakeup support 2023-03-29 10:27:01 +02:00
gadget.c usb: dwc3: gadget: Reset num TRBs before giving back the request 2023-06-13 11:52:20 +02:00
gadget.h
host.c usb: dwc3: host: remove dead code in dwc3_host_get_irq() 2023-03-29 09:02:25 +02:00
io.h
Kconfig
Makefile
trace.c
trace.h usb: dwc3: change some trace event __dynamic_array() to __get_buf() 2023-03-09 15:35:03 +01:00
ulpi.c