Received-SPF: pass (google.com: domain of linux-kernel+bounces-171785-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Date: Tue, 7 May 2024 18:19:13 +0200
From: =?utf-8?Q?Ond=C5=99ej?= Jirman <megi@xff.cz>
To: Amit Sunil Dhamne <amitsd@google.com>
Cc: linux@roeck-us.net, heikki.krogerus@linux.intel.com, 
	gregkh@linuxfoundation.org, badhri@google.com, rdbabiera@google.com, 
	linux-usb@vger.kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, 
	Mark Brown <broonie@kernel.org>
Subject: Re: [PATCH v1] usb: typec: tcpm: unregister existing source caps
 before re-registration
Message-ID: <y4lla7vqsrl75qhesmyexq7yvcu6hl6kryh3ctwq5ci3r4mlpw@rsnhfkmlmtt7>
Mail-Followup-To: =?utf-8?Q?Ond=C5=99ej?= Jirman <megi@xff.cz>, 
	Amit Sunil Dhamne <amitsd@google.com>, linux@roeck-us.net, heikki.krogerus@linux.intel.com, 
	gregkh@linuxfoundation.org, badhri@google.com, rdbabiera@google.com, 
	linux-usb@vger.kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, 
	Mark Brown <broonie@kernel.org>
References: <20240424223227.1807844-1-amitsd@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240424223227.1807844-1-amitsd@google.com>

On Wed, Apr 24, 2024 at 03:32:16PM GMT, Amit Sunil Dhamne wrote:
> Check and unregister existing source caps in tcpm_register_source_caps
> function before registering new ones. This change fixes following
> warning when port partner resends source caps after negotiating PD contract
> for the purpose of re-negotiation.
> 
> [  343.135030][  T151] sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities'
> [  343.135071][  T151] Call trace:
> [  343.135076][  T151]  dump_backtrace+0xe8/0x108
> [  343.135099][  T151]  show_stack+0x18/0x24
> [  343.135106][  T151]  dump_stack_lvl+0x50/0x6c
> [  343.135119][  T151]  dump_stack+0x18/0x24
> [  343.135126][  T151]  sysfs_create_dir_ns+0xe0/0x140
> [  343.135137][  T151]  kobject_add_internal+0x228/0x424
> [  343.135146][  T151]  kobject_add+0x94/0x10c
> [  343.135152][  T151]  device_add+0x1b0/0x4c0
> [  343.135187][  T151]  device_register+0x20/0x34
> [  343.135195][  T151]  usb_power_delivery_register_capabilities+0x90/0x20c
> [  343.135209][  T151]  tcpm_pd_rx_handler+0x9f0/0x15b8
> [  343.135216][  T151]  kthread_worker_fn+0x11c/0x260
> [  343.135227][  T151]  kthread+0x114/0x1bc
> [  343.135235][  T151]  ret_from_fork+0x10/0x20
> [  343.135265][  T151] kobject: kobject_add_internal failed for source-capabilities with -EEXIST, don't try to register things with the same name in the same directory.
> 
> Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
> Cc: linux-usb@vger.kernel.org
> Cc: stable@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Mark Brown <broonie@kernel.org>
> Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
> ---
>  drivers/usb/typec/tcpm/tcpm.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> index ab6ed6111ed0..d8eb89f4f0c3 100644
> --- a/drivers/usb/typec/tcpm/tcpm.c
> +++ b/drivers/usb/typec/tcpm/tcpm.c
> @@ -2996,7 +2996,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
>  {
>  	struct usb_power_delivery_desc desc = { port->negotiated_rev };
>  	struct usb_power_delivery_capabilities_desc caps = { };
> -	struct usb_power_delivery_capabilities *cap;
> +	struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
>  
>  	if (!port->partner_pd)
>  		port->partner_pd = usb_power_delivery_register(NULL, &desc);
> @@ -3006,6 +3006,9 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
>  	memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
>  	caps.role = TYPEC_SOURCE;
>  
> +	if (cap)
> +		usb_power_delivery_unregister_capabilities(cap);

This certainly looks like it's asking for use after free on port->partner_source_caps
later on, since you're not clearing the pointer for the data that you just freed.

> +
>  	cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
>  	if (IS_ERR(cap))
>  		return PTR_ERR(cap);

This can easily fail if caps contain invalid PDOs, resulting in keeping pointer
to freed memory in port->partner_source_caps.

Kind regards,
	o.

> base-commit: 0d31ea587709216d88183fe4ca0c8aba5e0205b8
> -- 
> 2.44.0.769.g3c40516874-goog
>