[PATCH] usb: chipidea: core: cancel power_lost_work on removal

[PATCH] usb: chipidea: core: cancel power_lost_work on removal

[Hyunjung Ko]

ci_hdrc_resume() queues ci->power_lost_work on system resume when the
controller lost power during suspend. The work (ci_power_lost_work)
dereferences ci: it touches ci->irq, ci->dev and switches the role.

ci is allocated with devm_kzalloc(), so devres frees it after
ci_hdrc_remove() returns. ci_hdrc_remove() never cancels power_lost_work,
so a work queued by a resume just before unbind can run after ci has been
freed and dereference freed memory -- a use-after-free.

Cancel power_lost_work at the start of ci_hdrc_remove(), before the
devm-allocated ci is released.

Found by static analysis; not runtime-reproduced (needs a chipidea
controller losing power across a system suspend/resume that races unbind).

Fixes: cc509b6a47e7 ("usb: chipidea: core: handle power lost in workqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/usb/chipidea/core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 3461dd7..400e4ca 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -1246,6 +1246,13 @@ static void ci_hdrc_remove(struct platform_device *pdev)
 {
 	struct ci_hdrc *ci = platform_get_drvdata(pdev);

+	/*
+	 * ci_hdrc_resume() queues power_lost_work when the controller lost
+	 * power during system suspend; the work dereferences ci, so drain it
+	 * before the devm-allocated ci is freed.
+	 */
+	cancel_work_sync(&ci->power_lost_work);
+
 	if (ci->role_switch)
 		usb_role_switch_unregister(ci->role_switch);

--
2.43.0