Skip to contentSkip to conversation

usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps

PATCH In review Amit Sunil Dhamne 4 participants 4 messages May 14, 2024 – May 21, 2024

Subsystems (4)
Stable branch USB USB Type-C class USB Type-C port controller drivers
lore
Share & tools
lore

Amit Sunil Dhamne

author
#0 lore raw

PATCH 1/1 usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps

There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when:
* new (say invalid) source caps are advertised
* the existing source caps are unregistered
* tcpm_register_source_caps() returns with an error as usb_power_delivery_register_capabilities() fails

This causes port->partner_source_caps to hold on to the now freed source caps.

Reset port->partner_source_caps value to NULL after unregistering existing source caps.

Fixes 230ecdf71a64 ("usb: typec: tcpm: unregister existing source caps before re-registration")
Cc [email protected]
Signed-off-by Amit Sunil Dhamne <[email protected]>
---
 drivers/usb/typec/tcpm/tcpm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +3 -1
index 8a1af08f71b6..be4127ef84e9 100644
@@ -3014,8 +3014,10 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
 	memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
 	caps.role = TYPEC_SOURCE;
 
-	if (cap)
+	if (cap) {
 		usb_power_delivery_unregister_capabilities(cap);
+		port->partner_source_caps = NULL;
+	}
 
 	cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
 	if (IS_ERR(cap))

base-commit: 51474ab44abf907023a8a875e799b07de461e466

Signature · 1 line
2.45.0.rc1.225.g2a3ae87e7f-goog
Reviewed-by on v1 1/1
#1 lore raw
Quoted 10 lines · Amit Sunil Dhamne

There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when:
* new (say invalid) source caps are advertised
* the existing source caps are unregistered
* tcpm_register_source_caps() returns with an error as usb_power_delivery_register_capabilities() fails

This causes port->partner_source_caps to hold on to the now freed source caps.

Quoted 7 lines

Reset port->partner_source_caps value to NULL after unregistering existing source caps.

Fixes 230ecdf71a64 ("usb: typec: tcpm: unregister existing source caps before re-registration")
Cc [email protected]
Signed-off-by Amit Sunil Dhamne <[email protected]>
Reviewed-by Ondrej Jirman <[email protected]>

Thanks for the fix.

Kind regards,

	o.
Quoted 26 lines
---
 drivers/usb/typec/tcpm/tcpm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +3 -1
index 8a1af08f71b6..be4127ef84e9 100644
@@ -3014,8 +3014,10 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
 	memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
 	caps.role = TYPEC_SOURCE;
 
-	if (cap)
+	if (cap) {
 		usb_power_delivery_unregister_capabilities(cap);
+		port->partner_source_caps = NULL;
+	}
 
 	cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
 	if (IS_ERR(cap))

base-commit: 51474ab44abf907023a8a875e799b07de461e466

Signature · 1 line
2.45.0.rc1.225.g2a3ae87e7f-goog
Reviewed-by on v1 1/1
#2 lore raw
In reply to Amit Sunil Dhamne
Quoted 13 lines · Amit Sunil Dhamne

There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when:
* new (say invalid) source caps are advertised
* the existing source caps are unregistered
* tcpm_register_source_caps() returns with an error as usb_power_delivery_register_capabilities() fails

This causes port->partner_source_caps to hold on to the now freed source caps.

Reset port->partner_source_caps value to NULL after unregistering existing source caps.

Quoted 7 lines
Fixes 230ecdf71a64 ("usb: typec: tcpm: unregister existing source caps before re-registration")
Cc [email protected]
Signed-off-by Amit Sunil Dhamne <[email protected]>
---
 drivers/usb/typec/tcpm/tcpm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
Reviewed-by Dmitry Baryshkov <[email protected]>
Signature · 2 lines
With best wishes
Dmitry
maintainer Reviewed-by on v1 1/1
#3 lore raw
In reply to Amit Sunil Dhamne
Quoted 10 lines · Amit Sunil Dhamne

There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when:
* new (say invalid) source caps are advertised
* the existing source caps are unregistered
* tcpm_register_source_caps() returns with an error as usb_power_delivery_register_capabilities() fails

This causes port->partner_source_caps to hold on to the now freed source caps.

Quoted 6 lines

Reset port->partner_source_caps value to NULL after unregistering existing source caps.

Fixes 230ecdf71a64 ("usb: typec: tcpm: unregister existing source caps before re-registration")
Cc [email protected]
Signed-off-by Amit Sunil Dhamne <[email protected]>
Reviewed-by Heikki Krogerus <[email protected]>
Quoted 24 lines
---
 drivers/usb/typec/tcpm/tcpm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +3 -1
index 8a1af08f71b6..be4127ef84e9 100644
@@ -3014,8 +3014,10 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
 	memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
 	caps.role = TYPEC_SOURCE;
 
-	if (cap)
+	if (cap) {
 		usb_power_delivery_unregister_capabilities(cap);
+		port->partner_source_caps = NULL;
+	}
 
 	cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
 	if (IS_ERR(cap))

base-commit: 51474ab44abf907023a8a875e799b07de461e466

Signature · 1 line
2.45.0.rc1.225.g2a3ae87e7f-goog
Signature · 1 line
heikki