UPSTREAM: USB: dwc3: fix use-after-free on core driver unbind
Some dwc3 glue drivers are currently accessing the driver data of the child core device directly, which is clearly a bad idea as the child may not have probed yet or may have been unbound from its driver. As a workaround until the glue drivers have been fixed, clear the driver data pointer before allowing the glue parent device to runtime suspend to prevent its driver from accessing data that has been freed during unbind. Bug: 254441685 Fixes: 6dd25659 ("usb: dwc3: add imx8mp dwc3 glue layer driver") Fixes: 6895ea55 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable@vger.kernel.org # 5.12 Cc: Li Jun <jun.li@nxp.com> Cc: Sandeep Maheswaram <quic_c_sanm@quicinc.com> Cc: Krishna Kurapati <quic_kriskura@quicinc.com> Signed-off-by:Johan Hovold <johan+linaro@kernel.org> Acked-by:
Thinh Nguyen <Thinh.Nguyen@synopsys.com> Reviewed-by:
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Message-ID: <20230607100540.31045-3-johan+linaro@kernel.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e3dbb657) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: I9c546e159867e0a9271c56d8340daa1506436855
Loading
Please sign in to comment