Commit a6cbc280 authored by Johan Hovold's avatar Johan Hovold Committed by Lee Jones
Browse files

UPSTREAM: USB: dwc3: fix use-after-free on core driver unbind



Some dwc3 glue drivers are currently accessing the driver data of the
child core device directly, which is clearly a bad idea as the child may
not have probed yet or may have been unbound from its driver.

As a workaround until the glue drivers have been fixed, clear the driver
data pointer before allowing the glue parent device to runtime suspend
to prevent its driver from accessing data that has been freed during
unbind.

Bug: 254441685
Fixes: 6dd25659 ("usb: dwc3: add imx8mp dwc3 glue layer driver")
Fixes: 6895ea55 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
Cc: stable@vger.kernel.org      # 5.12
Cc: Li Jun <jun.li@nxp.com>
Cc: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
Cc: Krishna Kurapati <quic_kriskura@quicinc.com>
Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
Acked-by: default avatarThinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Message-ID: <20230607100540.31045-3-johan+linaro@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit e3dbb657)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
Change-Id: I90545119fbb7b0ae4c0fad1f292fbcccd02e6681
parent c4bf56c0
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment