[PATCH] usb: gadget: pch_udc: drain vbus GPIO works before freeing the device

[PATCH] usb: gadget: pch_udc: drain vbus GPIO works before freeing the device

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

pch_vbus_gpio_irq() schedules dev->vbus_gpio.irq_work_fall /
irq_work_rise (pch_vbus_gpio_work_fall/_rise), whose handlers obtain the
pch_udc_dev via container_of() and dereference it.

pch_vbus_gpio_free() frees the VBUS GPIO interrupt on teardown but never
cancels those works:

	if (dev->vbus_gpio.intr)
		free_irq(dev->vbus_gpio.intr, dev);

free_irq() only waits for the interrupt handler to finish; it does not
cancel a work the handler has already queued. dev is allocated with
devm_kzalloc() and is freed by devres after pch_udc_remove() returns, so
a VBUS GPIO interrupt arriving shortly before removal can leave
irq_work_fall/rise pending and have pch_vbus_gpio_work_fall()/_rise() run
against the freed pch_udc_dev -> use-after-free.

Cancel both works after free_irq() (so the interrupt can no longer
re-queue them) and before dev is freed. Both are INIT_WORK()'d on the
path that sets vbus_gpio.intr, so the existing intr guard also covers the
cancels.

Found by code review; not reproduced (needs the EG20T/ML7213 pch_udc
hardware with a VBUS detection GPIO and an interrupt racing device
removal).

Fixes: 637b78eb31e0 ("usb: gadget: pch_udc: Detecting VBUS through GPIO with interrupt")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/usb/gadget/udc/pch_udc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 99b3ce2..5531094 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1406,8 +1406,11 @@ static int pch_vbus_gpio_init(struct pch_udc_dev *dev)
  */
 static void pch_vbus_gpio_free(struct pch_udc_dev *dev)
 {
-	if (dev->vbus_gpio.intr)
+	if (dev->vbus_gpio.intr) {
 		free_irq(dev->vbus_gpio.intr, dev);
+		cancel_work_sync(&dev->vbus_gpio.irq_work_fall);
+		cancel_work_sync(&dev->vbus_gpio.irq_work_rise);
+	}
 }
 
 /**
-- 
2.43.0