[5.4,44/98] phy: tegra: xusb: Fix dangling pointer on probe failure

From: Marc Zyngier <maz@kernel.org>

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit eb9c4dd9bdfdebaa13846c16a8c79b5b336066b6 ]

If, for some reason, the xusb PHY fails to probe, it leaves
a dangling pointer attached to the platform device structure.

This would normally be harmless, but the Tegra XHCI driver then
goes and extract that pointer from the PHY device. Things go
downhill from there:

    8.752082] [004d554e5145533c] address between user and kernel address ranges
[    8.752085] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[    8.752088] Modules linked in: max77620_regulator(E+) xhci_tegra(E+) sdhci_tegra(E+) xhci_hcd(E) sdhci_pltfm(E) cqhci(E) fixed(E) usbcore(E) scsi_mod(E) sdhci(E) host1x(E+)
[    8.752103] CPU: 4 PID: 158 Comm: systemd-udevd Tainted: G S      W   E     5.9.0-rc7-00298-gf6337624c4fe #1980
[    8.752105] Hardware name: NVIDIA Jetson TX2 Developer Kit (DT)
[    8.752108] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--)
[    8.752115] pc : kobject_put+0x1c/0x21c
[    8.752120] lr : put_device+0x20/0x30
[    8.752121] sp : ffffffc012eb3840
[    8.752122] x29: ffffffc012eb3840 x28: ffffffc010e82638
[    8.752125] x27: ffffffc008d56440 x26: 0000000000000000
[    8.752128] x25: ffffff81eb508200 x24: 0000000000000000
[    8.752130] x23: ffffff81eb538800 x22: 0000000000000000
[    8.752132] x21: 00000000fffffdfb x20: ffffff81eb538810
[    8.752134] x19: 3d4d554e51455300 x18: 0000000000000020
[    8.752136] x17: ffffffc008d00270 x16: ffffffc008d00c94
[    8.752138] x15: 0000000000000004 x14: ffffff81ebd4ae90
[    8.752140] x13: 0000000000000000 x12: ffffff81eb86a4e8
[    8.752142] x11: ffffff81eb86a480 x10: ffffff81eb862fea
[    8.752144] x9 : ffffffc01055fb28 x8 : ffffff81eb86a4a8
[    8.752146] x7 : 0000000000000001 x6 : 0000000000000001
[    8.752148] x5 : ffffff81dff8bc38 x4 : 0000000000000000
[    8.752150] x3 : 0000000000000001 x2 : 0000000000000001
[    8.752152] x1 : 0000000000000002 x0 : 3d4d554e51455300
[    8.752155] Call trace:
[    8.752157]  kobject_put+0x1c/0x21c
[    8.752160]  put_device+0x20/0x30
[    8.752164]  tegra_xusb_padctl_put+0x24/0x3c
[    8.752170]  tegra_xusb_probe+0x8b0/0xd10 [xhci_tegra]
[    8.752174]  platform_drv_probe+0x60/0xb4
[    8.752176]  really_probe+0xf0/0x504
[    8.752179]  driver_probe_device+0x100/0x170
[    8.752181]  device_driver_attach+0xcc/0xd4
[    8.752183]  __driver_attach+0xb0/0x17c
[    8.752185]  bus_for_each_dev+0x7c/0xd4
[    8.752187]  driver_attach+0x30/0x3c
[    8.752189]  bus_add_driver+0x154/0x250
[    8.752191]  driver_register+0x84/0x140
[    8.752193]  __platform_driver_register+0x54/0x60
[    8.752197]  tegra_xusb_init+0x40/0x1000 [xhci_tegra]
[    8.752201]  do_one_initcall+0x54/0x2d0
[    8.752205]  do_init_module+0x68/0x29c
[    8.752207]  load_module+0x2178/0x26c0
[    8.752209]  __do_sys_finit_module+0xb0/0x120
[    8.752211]  __arm64_sys_finit_module+0x2c/0x40
[    8.752215]  el0_svc_common.constprop.0+0x80/0x240
[    8.752218]  do_el0_svc+0x30/0xa0
[    8.752220]  el0_svc+0x18/0x50
[    8.752223]  el0_sync_handler+0x90/0x318
[    8.752225]  el0_sync+0x158/0x180
[    8.752230] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (3940f000)
[    8.752232] ---[ end trace 90f6c89d62d85ff5 ]---

Reset the pointer on probe failure fixes the issue.

Fixes: 53d2a715c2403 ("phy: Add Tegra XUSB pad controller support")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201013095820.311376-1-maz@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/tegra/xusb.c | 1 +
 1 file changed, 1 insertion(+)

Message ID	20201201084657.265415545@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Marc Zyngier <maz@kernel.org>, Vinod Koul <vkoul@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 44/98] phy: tegra: xusb: Fix dangling pointer on probe failure Date: Tue, 1 Dec 2020 09:53:21 +0100 Message-Id: <20201201084657.265415545@linuxfoundation.org> In-Reply-To: <20201201084652.827177826@linuxfoundation.org> References: <20201201084652.827177826@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,02/98] spi: bcm2835: Fix use-after-free on unbind [5.4,03/98] ipv4: use IS_ENABLED instead of ifdef [5.4,04/98] netfilter: clear skb->next in NF_HOOK_LIST() [5.4,05/98] btrfs: tree-checker: add missing return after error in root_item [5.4,06/98] btrfs: tree-checker: add missing returns after data_ref alignment checks [5.4,07/98] btrfs: dont access possibly stale fs_info data for printing duplicate device [5.4,08/98] btrfs: fix lockdep splat when reading qgroup config on mount [5.4,09/98] wireless: Use linux/stddef.h instead of stddef.h [5.4,10/98] smb3: Call cifs reconnect from demultiplex thread [5.4,11/98] smb3: Avoid Mid pending list corruption [5.4,12/98] smb3: Handle error case during offload read path [5.4,13/98] cifs: fix a memleak with modefromsid [5.4,14/98] KVM: PPC: Book3S HV: XIVE: Fix possible oops when accessing ESB page [5.4,15/98] KVM: arm64: vgic-v3: Drop the reporting of GICR_TYPER.Last for userspace [5.4,16/98] KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint [5.4,17/98] KVM: x86: Fix split-irqchip vs interrupt injection window request [5.4,18/98] trace: fix potenial dangerous pointer [5.4,19/98] arm64: pgtable: Fix pte_accessible() [5.4,20/98] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() [5.4,21/98] HID: uclogic: Add ID for Trust Flex Design Tablet [5.4,22/98] HID: ite: Replace ABS_MISC 120/121 events with touchpad on/off keypresses [5.4,23/98] HID: cypress: Support Varmilo Keyboards media hotkeys [5.4,24/98] HID: add support for Sega Saturn [5.4,25/98] Input: i8042 - allow insmod to succeed on devices without an i8042 controller [5.4,26/98] HID: hid-sensor-hub: Fix issue with devices with no report ID [5.4,27/98] staging: ralink-gdma: fix kconfig dependency bug for DMA_RALINK [5.4,28/98] HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices [5.4,29/98] dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant [5.4,30/98] x86/xen: dont unbind uninitialized lock_kicker_irq [5.4,31/98] HID: logitech-hidpp: Add HIDPP_CONSUMER_VENDOR_KEYS quirk for the Dinovo Edge [5.4,32/98] HID: Add Logitech Dinovo Edge battery quirk [5.4,33/98] proc: dont allow async path resolution of /proc/self components [5.4,34/98] nvme: free sq/cq dbbuf pointers when dbbuf set fails [5.4,35/98] vhost scsi: fix cmd completion race [5.4,36/98] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size [5.4,37/98] scsi: libiscsi: Fix NOP race condition [5.4,38/98] scsi: target: iscsi: Fix cmd abort fabric stop race [5.4,39/98] perf/x86: fix sysfs type mismatches [5.4,40/98] xtensa: uaccess: Add missing __user to strncpy_from_user() prototype [5.4,41/98] net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset [5.4,42/98] bus: ti-sysc: Fix bogus resetdone warning on enable for cpsw [5.4,43/98] ARM: OMAP2+: Manage MPU state properly for omap_enter_idle_coupled() [5.4,44/98] phy: tegra: xusb: Fix dangling pointer on probe failure [5.4,45/98] iwlwifi: mvm: write queue_sync_state only for sync [5.4,46/98] batman-adv: set .owner to THIS_MODULE [5.4,47/98] arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed [5.4,48/98] ARM: dts: dra76x: m_can: fix order of clocks [5.4,49/98] scsi: ufs: Fix race between shutdown and runtime resume flow [5.4,50/98] bnxt_en: fix error return code in bnxt_init_one() [5.4,51/98] bnxt_en: fix error return code in bnxt_init_board() [5.4,52/98] video: hyperv_fb: Fix the cache type when mapping the VRAM [5.4,53/98] bnxt_en: Release PCI regions when DMA mask setup fails during probe. [5.4,54/98] cxgb4: fix the panic caused by non smac rewrite [5.4,55/98] s390/qeth: make af_iucv TX notification call more robust [5.4,56/98] s390/qeth: fix af_iucv notification race [5.4,57/98] s390/qeth: fix tear down of async TX buffers [5.4,58/98] ibmvnic: fix call_netdevice_notifiers in do_reset [5.4,59/98] ibmvnic: notify peers when failover and migration happen [5.4,60/98] powerpc/64s: Fix allnoconfig build since uaccess flush [5.4,61/98] IB/mthca: fix return value of error branch in mthca_init_cq() [5.4,62/98] i40e: Fix removing driver while bare-metal VFs pass traffic [5.4,63/98] nfc: s3fwrn5: use signed integer for parsing GPIO numbers [5.4,64/98] net: ena: set initial DMA width to avoid intel iommu issue [5.4,65/98] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues [5.4,66/98] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq [5.4,67/98] optee: add writeback to valid memory type [5.4,68/98] arm64: tegra: Wrong AON HSP reg property size [5.4,69/98] efivarfs: revert "fix memory leak in efivarfs_create()" [5.4,70/98] efi: EFI_EARLYCON should depend on EFI [5.4,71/98] can: gs_usb: fix endianess problem with candleLight firmware [5.4,72/98] platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time [5.4,73/98] platform/x86: toshiba_acpi: Fix the wrong variable assignment [5.4,74/98] RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP [5.4,75/98] RDMA/hns: Bugfix for memory window mtpt configuration [5.4,76/98] can: m_can: m_can_open(): remove IRQF_TRIGGER_FALLING from request_threaded_irq()s flags [5.4,77/98] can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 [5.4,78/98] perf stat: Use proper cpu for shadow stats [5.4,79/98] perf probe: Fix to die_entrypc() returns error correctly [5.4,80/98] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe [5.4,81/98] USB: core: Change %pK for __user pointers to %px [5.4,82/98] usb: gadget: f_midi: Fix memleak in f_midi_alloc [5.4,83/98] USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb... [5.4,84/98] usb: gadget: Fix memleak in gadgetfs_fill_super [5.4,85/98] irqchip/exiu: Fix the index of fwspec for IRQ type [5.4,86/98] x86/mce: Do not overwrite no_way_out if mce_end() fails [5.4,87/98] x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb [5.4,88/98] x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak [5.4,89/98] x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak [5.4,90/98] USB: core: Fix regression in Hercules audio card [5.4,91/98] ASoC: Intel: Skylake: Remove superfluous chip initialization [5.4,92/98] ASoC: Intel: Skylake: Select hda configuration permissively [5.4,93/98] ASoC: Intel: Skylake: Enable codec wakeup during chip init [5.4,94/98] ASoC: Intel: Skylake: Shield against no-NHLT configurations [5.4,95/98] ASoC: Intel: Allow for ROM init retry on CNL platforms [5.4,96/98] ASoC: Intel: Skylake: Await purge request ack on CNL [5.4,97/98] ASoC: Intel: Multiple I/O PCM format support for pipe [5.4,98/98] ASoC: Intel: Skylake: Automatic DMIC format configuration according to information fr...

[5.4,44/98] phy: tegra: xusb: Fix dangling pointer on probe failure

Commit Message

Patch