Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) client-ip=23.128.96.31;
Date:   Fri, 13 Oct 2023 18:52:09 +0800
From:   Hongren Zheng <i@zenithal.me>
To:     Shuah Khan <shuah@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Valentina Manea <valentina.manea.m@gmail.com>,
        Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc:     linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        sfr@canb.auug.org.au
Subject: [PATCH -next] usb/usbip: fix wrong data added to platform device
Message-ID: <ZSkhWa5wmAGsAdCK@Sun>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?wAahB1BKOB8NWW+Ok75sSS78zqpiKOumDwYUmyyzNb1BuClUVOp7J4OqLSN3?=
 =?us-ascii?Q?Bv6cLImssNiICjzWgRNIVowfT5Mzc3teVOCXslc9GzFVaZrzM8+qP5b+HwrL?=
 =?us-ascii?Q?gOtCf8dinp/kwNvhKO0Qz9IQmHACkWlIcDlxWsN22V7dwno6XyOZEoRjJ2EY?=
 =?us-ascii?Q?EEe2viJtOeNIZJDUJJpNhHi9auFHFEmhZ8K7r0fStLyjfjyvljOCpx87lyIL?=
 =?us-ascii?Q?re5xAaO3Dn0GvTQPtjNUD+NQ5SuJ13RKCSA5J9Zxga6LZYU0bi91DJFpH8yM?=
 =?us-ascii?Q?EvT0yw8Ub7lMFvgNzDixFW07RV8SUkKQ2ni3HWunFXBXvvzGmXUb5OBZTsBB?=
 =?us-ascii?Q?RzHZL6rK/5GOcK7jO4+cirbGbfnTkQv0LvZ1G9wF7P3ySlmeiPnOrRG364R2?=
 =?us-ascii?Q?H3U/cxARr0+KWpzhzXip2f9G8Q6YgIg/i3Ghg/1JidqMAK4c8P1veTU+mnJB?=
 =?us-ascii?Q?wp5h7VUnXs6fo8Rwov7XkNrmhuJe4oq5v50c5K9bw90D0IXpkfdq1EfBI4zq?=
 =?us-ascii?Q?wk6TaSqqqG0DPsm5nvF2N5bS0w8+B9RAe/cPz7ifurWUXxWPsLsmQn4HRo6O?=
 =?us-ascii?Q?DQhXDWe6QQsqNJsATKL5wFUtsj4sXHoBGvsle04sVNiDkzKqOF9gmUbxbdQk?=
 =?us-ascii?Q?JBkvoEn1WDm7Q9tR/Daq1yuTOjSf1C+LUfs/o7gJqaKqq7XtmaE9VNs8Aemt?=
 =?us-ascii?Q?dIJ66nu216nG8TWPi3Hi72t8BIko7ZQ6/njjVPPAi3uxVA+7Jy5sdTGncJje?=
 =?us-ascii?Q?iAPNEsfzCu2SzHSMi9/6JhXTG7hjV03rUOnmSyJpcPjCRWTgU0bsvPyyp3I8?=
 =?us-ascii?Q?lFgm11S95HvEpG9AFwNU3Xf2K5y25LTVd0P0uax39JCyWHAMN2UqNdPQnMzg?=
 =?us-ascii?Q?Z1q0w2Cs94lmTq1MPYq3tu7gGELfwOLRGlEXuxDSkOG2wr0pXUgsKMCFzY2Q?=
 =?us-ascii?Q?hYW2ghRXenBOfyZmpXigczX1j5ei/t0AtxDO74Qo1/bd+4pyu9Q9V0uY+Iws?=
 =?us-ascii?Q?++0l4TfHtwqr8F9Pdcgh1kFMANM6RSYSIXAZJ53Ukse5L7eZfieHV9ACLgQy?=
 =?us-ascii?Q?x1+J9lCP7wDrQyidPt+NzDa5E4QX4ijYGaTVczZgG1VKBI/nQet2CyaAGB5W?=
 =?us-ascii?Q?EqaMSienT9w6STP0zJCw4toaUrS5ggEB4F2I5FcMF3NPe03CKVn4jUMDFmOB?=
 =?us-ascii?Q?UhN6uzE9blnI1HO7joz3KaLAEgeY2PoH1x2gcm75ToyU9iDgHNabxcNFBMDY?=
 =?us-ascii?Q?ThtKNEsrQ3JWyFj0/EenoqMVoKMnfSHyw88/RXpnBkkO5J0LtGl5FnlOwbPk?=
 =?us-ascii?Q?6/DL4kgif0li4WIbGBdLPmtPDCDwkTvyznrTr1Aldg1DJZUL9J12CnkyHCxC?=
 =?us-ascii?Q?zeHtJuw4J3tW1FTeU1mIZK4KvH+Zhv45MmOsJbesNqBGO8AezU1Bjfp3SDsT?=
 =?us-ascii?Q?8cxh9R66LqXJf4OZV5Y3GSuQNg0S83GXHhx9dCVq9OzsRNAwRFyhLDThKaVv?=
 =?us-ascii?Q?oiQvkjvYEQ6hvHWV65EjGpVh67sLSlPZjJ+6B8rLs7JpBgicAPS9k8RATHg6?=
 =?us-ascii?Q?JE4pGGeZ+FPTekujhTmtTXpgS6srbjolFS+mGEPr?=
X-OriginatorOrg: zenithal.me
X-MS-Exchange-CrossTenant-Network-Message-Id: f05b149b-d518-4be5-4816-08dbcbda76c6
X-MS-Exchange-CrossTenant-AuthSource: TYYP286MB1406.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2023 10:52:16.2039
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 436d481c-43b1-4418-8d7f-84c1e4887cf0
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: N9eQm4tzfBrmn6RZBrNymiCKAnxfi6TVgSfDjAFAO5VfgVW+ev0M10ihiqpfl0q/
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYWP286MB2478
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on morse.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (morse.vger.email [0.0.0.0]); Fri, 13 Oct 2023 03:52:32 -0700 (PDT)

.data of platform_device_info will be copied into .platform_data of
struct device via platform_device_add_data.

However, vhcis[i] contains a spinlock, is dynamically allocated and
used by other code, so it is not meant to be copied. The workaround
was to use void *vhci as an agent, but it was removed in the commit
suggested below.

This patch adds back the workaround and changes the way of using
platform_data accordingly.

Reported-by: syzbot+e0dbc33630a092ccf033@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/00000000000029242706077f3145@google.com/
Reported-by: syzbot+6867a9777f4b8dc4e256@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/0000000000007634c1060793197c@google.com/
Fixes: b8aaf639b403 ("usbip: Use platform_device_register_full()")
Signed-off-by: Hongren Zheng <i@zenithal.me>
---
 drivers/usb/usbip/vhci_hcd.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index f845b91848b9..dfbdc77108e5 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -1139,8 +1139,7 @@ static int hcd_name_to_id(const char *name)
 
 static int vhci_setup(struct usb_hcd *hcd)
 {
-	struct vhci *vhci = dev_get_platdata(hcd->self.controller);
-
+	struct vhci *vhci = *((void **)dev_get_platdata(hcd->self.controller));
 	if (usb_hcd_is_primary_hcd(hcd)) {
 		vhci->vhci_hcd_hs = hcd_to_vhci_hcd(hcd);
 		vhci->vhci_hcd_hs->vhci = vhci;
@@ -1257,7 +1256,7 @@ static int vhci_get_frame_number(struct usb_hcd *hcd)
 /* FIXME: suspend/resume */
 static int vhci_bus_suspend(struct usb_hcd *hcd)
 {
-	struct vhci *vhci = dev_get_platdata(hcd->self.controller);
+	struct vhci *vhci = *((void **)dev_get_platdata(hcd->self.controller));
 	unsigned long flags;
 
 	dev_dbg(&hcd->self.root_hub->dev, "%s\n", __func__);
@@ -1271,7 +1270,7 @@ static int vhci_bus_suspend(struct usb_hcd *hcd)
 
 static int vhci_bus_resume(struct usb_hcd *hcd)
 {
-	struct vhci *vhci = dev_get_platdata(hcd->self.controller);
+	struct vhci *vhci = *((void **)dev_get_platdata(hcd->self.controller));
 	int rc = 0;
 	unsigned long flags;
 
@@ -1338,7 +1337,7 @@ static const struct hc_driver vhci_hc_driver = {
 
 static int vhci_hcd_probe(struct platform_device *pdev)
 {
-	struct vhci             *vhci = dev_get_platdata(&pdev->dev);
+	struct vhci             *vhci = *((void **)dev_get_platdata(&pdev->dev));
 	struct usb_hcd		*hcd_hs;
 	struct usb_hcd		*hcd_ss;
 	int			ret;
@@ -1396,7 +1395,7 @@ static int vhci_hcd_probe(struct platform_device *pdev)
 
 static void vhci_hcd_remove(struct platform_device *pdev)
 {
-	struct vhci *vhci = dev_get_platdata(&pdev->dev);
+	struct vhci *vhci = *((void **)dev_get_platdata(&pdev->dev));
 
 	/*
 	 * Disconnects the root hub,
@@ -1431,7 +1430,7 @@ static int vhci_hcd_suspend(struct platform_device *pdev, pm_message_t state)
 	if (!hcd)
 		return 0;
 
-	vhci = dev_get_platdata(hcd->self.controller);
+	vhci = *((void **)dev_get_platdata(hcd->self.controller));
 
 	spin_lock_irqsave(&vhci->lock, flags);
 
@@ -1506,6 +1505,7 @@ static void del_platform_devices(void)
 static int __init vhci_hcd_init(void)
 {
 	int i, ret;
+	void *vhci;
 
 	if (usb_disabled())
 		return -ENODEV;
@@ -1522,10 +1522,11 @@ static int __init vhci_hcd_init(void)
 		goto err_driver_register;
 
 	for (i = 0; i < vhci_num_controllers; i++) {
+		vhci = &vhcis[i];
 		struct platform_device_info pdevinfo = {
 			.name = driver_name,
 			.id = i,
-			.data = &vhcis[i],
+			.data = &vhci,
 			.size_data = sizeof(void *),
 		};
 
-- 
2.37.2