[PATCH] usb: musb: fix use-after-free in musb_remove()

[Joshua Crofts <crofts@kernel.org>]

Currently in musb_remove(), musb_platform_exit() drops the PHY refcount
before usb_phy_shutdown() is called, causing a use-after-free bug.

Reorder the function so that usb_phy_shutdown() is called before
musb_platform_exit(), the same way as musb_init_controller() does in the
error path.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-d180c2b9-0006-4638-a22b-13df8c201235
Fixes: 39cee200c23e ("usb: musb: core: call init and shutdown for the usb phy")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Crofts <crofts@kernel.org>
---
 drivers/usb/musb/musb_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 73ac25f53698..8e52246de948 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2642,6 +2642,7 @@ static void musb_remove(struct platform_device *pdev)
 	musb_disable_interrupts(musb);
 	musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 	spin_unlock_irqrestore(&musb->lock, flags);
+	usb_phy_shutdown(musb->xceiv);
 	musb_platform_exit(musb);
 
 	pm_runtime_dont_use_autosuspend(musb->controller);
@@ -2650,7 +2651,6 @@ static void musb_remove(struct platform_device *pdev)
 	musb_phy_callback = NULL;
 	if (musb->dma_controller)
 		musb_dma_controller_destroy(musb->dma_controller);
-	usb_phy_shutdown(musb->xceiv);
 	musb_free(musb);
 	device_init_wakeup(dev, 0);
 }

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261107-usb-uaf-fix-bedcd9cd8f4b

Best regards,
-- 
Joshua Crofts