* [PATCH v1] usb: typec: tcpm: unregister existing source caps before re-registration
@ 2024-04-24 22:20 Amit Sunil Dhamne
0 siblings, 0 replies; 5+ messages in thread
From: Amit Sunil Dhamne @ 2024-04-24 22:20 UTC (permalink / raw)
To: badhri
Cc: rdbabiera, Amit Sunil Dhamne, linux-usb, stable, kernel, Mark Brown
Check and unregister existing source caps in tcpm_register_source_caps
function before registering new ones. This change fixes following
warning when port partner resends source caps after negotiating PD contract
for the purpose of re-negotiation.
[ 343.135030][ T151] sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities'
[ 343.135071][ T151] Call trace:
[ 343.135076][ T151] dump_backtrace+0xe8/0x108
[ 343.135099][ T151] show_stack+0x18/0x24
[ 343.135106][ T151] dump_stack_lvl+0x50/0x6c
[ 343.135119][ T151] dump_stack+0x18/0x24
[ 343.135126][ T151] sysfs_create_dir_ns+0xe0/0x140
[ 343.135137][ T151] kobject_add_internal+0x228/0x424
[ 343.135146][ T151] kobject_add+0x94/0x10c
[ 343.135152][ T151] device_add+0x1b0/0x4c0
[ 343.135187][ T151] device_register+0x20/0x34
[ 343.135195][ T151] usb_power_delivery_register_capabilities+0x90/0x20c
[ 343.135209][ T151] tcpm_pd_rx_handler+0x9f0/0x15b8
[ 343.135216][ T151] kthread_worker_fn+0x11c/0x260
[ 343.135227][ T151] kthread+0x114/0x1bc
[ 343.135235][ T151] ret_from_fork+0x10/0x20
[ 343.135265][ T151] kobject: kobject_add_internal failed for source-capabilities with -EEXIST, don't try to register things with the same name in the same directory.
Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org
Cc: kernel@vger.kernel.org
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
---
drivers/usb/typec/tcpm/tcpm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index ab6ed6111ed0..d8eb89f4f0c3 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2996,7 +2996,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
{
struct usb_power_delivery_desc desc = { port->negotiated_rev };
struct usb_power_delivery_capabilities_desc caps = { };
- struct usb_power_delivery_capabilities *cap;
+ struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
if (!port->partner_pd)
port->partner_pd = usb_power_delivery_register(NULL, &desc);
@@ -3006,6 +3006,9 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
caps.role = TYPEC_SOURCE;
+ if (cap)
+ usb_power_delivery_unregister_capabilities(cap);
+
cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
if (IS_ERR(cap))
return PTR_ERR(cap);
base-commit: 0d31ea587709216d88183fe4ca0c8aba5e0205b8
--
2.44.0.769.g3c40516874-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v1] usb: typec: tcpm: unregister existing source caps before re-registration
2024-05-07 16:19 ` Ondřej Jirman
@ 2024-05-07 21:02 ` Amit Sunil Dhamne
0 siblings, 0 replies; 5+ messages in thread
From: Amit Sunil Dhamne @ 2024-05-07 21:02 UTC (permalink / raw)
To: Ondřej Jirman, linux, heikki.krogerus, gregkh, badhri,
rdbabiera, linux-usb, stable, linux-kernel, Mark Brown
Hi Ondřej,
On 5/7/24 09:19, Ondřej Jirman wrote:
> On Wed, Apr 24, 2024 at 03:32:16PM GMT, Amit Sunil Dhamne wrote:
>> Check and unregister existing source caps in tcpm_register_source_caps
>> function before registering new ones. This change fixes following
>> warning when port partner resends source caps after negotiating PD contract
>> for the purpose of re-negotiation.
>>
>> [ 343.135030][ T151] sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities'
>> [ 343.135071][ T151] Call trace:
>> [ 343.135076][ T151] dump_backtrace+0xe8/0x108
>> [ 343.135099][ T151] show_stack+0x18/0x24
>> [ 343.135106][ T151] dump_stack_lvl+0x50/0x6c
>> [ 343.135119][ T151] dump_stack+0x18/0x24
>> [ 343.135126][ T151] sysfs_create_dir_ns+0xe0/0x140
>> [ 343.135137][ T151] kobject_add_internal+0x228/0x424
>> [ 343.135146][ T151] kobject_add+0x94/0x10c
>> [ 343.135152][ T151] device_add+0x1b0/0x4c0
>> [ 343.135187][ T151] device_register+0x20/0x34
>> [ 343.135195][ T151] usb_power_delivery_register_capabilities+0x90/0x20c
>> [ 343.135209][ T151] tcpm_pd_rx_handler+0x9f0/0x15b8
>> [ 343.135216][ T151] kthread_worker_fn+0x11c/0x260
>> [ 343.135227][ T151] kthread+0x114/0x1bc
>> [ 343.135235][ T151] ret_from_fork+0x10/0x20
>> [ 343.135265][ T151] kobject: kobject_add_internal failed for source-capabilities with -EEXIST, don't try to register things with the same name in the same directory.
>>
>> Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
>> Cc: linux-usb@vger.kernel.org
>> Cc: stable@vger.kernel.org
>> Cc: linux-kernel@vger.kernel.org
>> Cc: Mark Brown <broonie@kernel.org>
>> Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
>> ---
>> drivers/usb/typec/tcpm/tcpm.c | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
>> index ab6ed6111ed0..d8eb89f4f0c3 100644
>> --- a/drivers/usb/typec/tcpm/tcpm.c
>> +++ b/drivers/usb/typec/tcpm/tcpm.c
>> @@ -2996,7 +2996,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
>> {
>> struct usb_power_delivery_desc desc = { port->negotiated_rev };
>> struct usb_power_delivery_capabilities_desc caps = { };
>> - struct usb_power_delivery_capabilities *cap;
>> + struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
>>
>> if (!port->partner_pd)
>> port->partner_pd = usb_power_delivery_register(NULL, &desc);
>> @@ -3006,6 +3006,9 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
>> memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
>> caps.role = TYPEC_SOURCE;
>>
>> + if (cap)
>> + usb_power_delivery_unregister_capabilities(cap);
> This certainly looks like it's asking for use after free on port->partner_source_caps
> later on, since you're not clearing the pointer for the data that you just freed.
>
>> +
>> cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
>> if (IS_ERR(cap))
>> return PTR_ERR(cap);
> This can easily fail if caps contain invalid PDOs, resulting in keeping pointer
> to freed memory in port->partner_source_caps.
Makes sense. I will send a fix for this. Thanks for the review.
Thanks,
Amit
>
> Kind regards,
> o.
>
>> base-commit: 0d31ea587709216d88183fe4ca0c8aba5e0205b8
>> --
>> 2.44.0.769.g3c40516874-goog
>>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] usb: typec: tcpm: unregister existing source caps before re-registration
2024-04-24 22:32 Amit Sunil Dhamne
2024-04-25 10:12 ` Heikki Krogerus
@ 2024-05-07 16:19 ` Ondřej Jirman
2024-05-07 21:02 ` Amit Sunil Dhamne
1 sibling, 1 reply; 5+ messages in thread
From: Ondřej Jirman @ 2024-05-07 16:19 UTC (permalink / raw)
To: Amit Sunil Dhamne
Cc: linux, heikki.krogerus, gregkh, badhri, rdbabiera, linux-usb,
stable, linux-kernel, Mark Brown
On Wed, Apr 24, 2024 at 03:32:16PM GMT, Amit Sunil Dhamne wrote:
> Check and unregister existing source caps in tcpm_register_source_caps
> function before registering new ones. This change fixes following
> warning when port partner resends source caps after negotiating PD contract
> for the purpose of re-negotiation.
>
> [ 343.135030][ T151] sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities'
> [ 343.135071][ T151] Call trace:
> [ 343.135076][ T151] dump_backtrace+0xe8/0x108
> [ 343.135099][ T151] show_stack+0x18/0x24
> [ 343.135106][ T151] dump_stack_lvl+0x50/0x6c
> [ 343.135119][ T151] dump_stack+0x18/0x24
> [ 343.135126][ T151] sysfs_create_dir_ns+0xe0/0x140
> [ 343.135137][ T151] kobject_add_internal+0x228/0x424
> [ 343.135146][ T151] kobject_add+0x94/0x10c
> [ 343.135152][ T151] device_add+0x1b0/0x4c0
> [ 343.135187][ T151] device_register+0x20/0x34
> [ 343.135195][ T151] usb_power_delivery_register_capabilities+0x90/0x20c
> [ 343.135209][ T151] tcpm_pd_rx_handler+0x9f0/0x15b8
> [ 343.135216][ T151] kthread_worker_fn+0x11c/0x260
> [ 343.135227][ T151] kthread+0x114/0x1bc
> [ 343.135235][ T151] ret_from_fork+0x10/0x20
> [ 343.135265][ T151] kobject: kobject_add_internal failed for source-capabilities with -EEXIST, don't try to register things with the same name in the same directory.
>
> Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
> Cc: linux-usb@vger.kernel.org
> Cc: stable@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Mark Brown <broonie@kernel.org>
> Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
> ---
> drivers/usb/typec/tcpm/tcpm.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> index ab6ed6111ed0..d8eb89f4f0c3 100644
> --- a/drivers/usb/typec/tcpm/tcpm.c
> +++ b/drivers/usb/typec/tcpm/tcpm.c
> @@ -2996,7 +2996,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
> {
> struct usb_power_delivery_desc desc = { port->negotiated_rev };
> struct usb_power_delivery_capabilities_desc caps = { };
> - struct usb_power_delivery_capabilities *cap;
> + struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
>
> if (!port->partner_pd)
> port->partner_pd = usb_power_delivery_register(NULL, &desc);
> @@ -3006,6 +3006,9 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
> memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
> caps.role = TYPEC_SOURCE;
>
> + if (cap)
> + usb_power_delivery_unregister_capabilities(cap);
This certainly looks like it's asking for use after free on port->partner_source_caps
later on, since you're not clearing the pointer for the data that you just freed.
> +
> cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
> if (IS_ERR(cap))
> return PTR_ERR(cap);
This can easily fail if caps contain invalid PDOs, resulting in keeping pointer
to freed memory in port->partner_source_caps.
Kind regards,
o.
> base-commit: 0d31ea587709216d88183fe4ca0c8aba5e0205b8
> --
> 2.44.0.769.g3c40516874-goog
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] usb: typec: tcpm: unregister existing source caps before re-registration
2024-04-24 22:32 Amit Sunil Dhamne
@ 2024-04-25 10:12 ` Heikki Krogerus
2024-05-07 16:19 ` Ondřej Jirman
1 sibling, 0 replies; 5+ messages in thread
From: Heikki Krogerus @ 2024-04-25 10:12 UTC (permalink / raw)
To: Amit Sunil Dhamne
Cc: linux, gregkh, badhri, rdbabiera, linux-usb, stable,
linux-kernel, Mark Brown
On Wed, Apr 24, 2024 at 03:32:16PM -0700, Amit Sunil Dhamne wrote:
> Check and unregister existing source caps in tcpm_register_source_caps
> function before registering new ones. This change fixes following
> warning when port partner resends source caps after negotiating PD contract
> for the purpose of re-negotiation.
>
> [ 343.135030][ T151] sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities'
> [ 343.135071][ T151] Call trace:
> [ 343.135076][ T151] dump_backtrace+0xe8/0x108
> [ 343.135099][ T151] show_stack+0x18/0x24
> [ 343.135106][ T151] dump_stack_lvl+0x50/0x6c
> [ 343.135119][ T151] dump_stack+0x18/0x24
> [ 343.135126][ T151] sysfs_create_dir_ns+0xe0/0x140
> [ 343.135137][ T151] kobject_add_internal+0x228/0x424
> [ 343.135146][ T151] kobject_add+0x94/0x10c
> [ 343.135152][ T151] device_add+0x1b0/0x4c0
> [ 343.135187][ T151] device_register+0x20/0x34
> [ 343.135195][ T151] usb_power_delivery_register_capabilities+0x90/0x20c
> [ 343.135209][ T151] tcpm_pd_rx_handler+0x9f0/0x15b8
> [ 343.135216][ T151] kthread_worker_fn+0x11c/0x260
> [ 343.135227][ T151] kthread+0x114/0x1bc
> [ 343.135235][ T151] ret_from_fork+0x10/0x20
> [ 343.135265][ T151] kobject: kobject_add_internal failed for source-capabilities with -EEXIST, don't try to register things with the same name in the same directory.
>
> Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
> Cc: linux-usb@vger.kernel.org
> Cc: stable@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Mark Brown <broonie@kernel.org>
> Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> ---
> drivers/usb/typec/tcpm/tcpm.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
> index ab6ed6111ed0..d8eb89f4f0c3 100644
> --- a/drivers/usb/typec/tcpm/tcpm.c
> +++ b/drivers/usb/typec/tcpm/tcpm.c
> @@ -2996,7 +2996,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
> {
> struct usb_power_delivery_desc desc = { port->negotiated_rev };
> struct usb_power_delivery_capabilities_desc caps = { };
> - struct usb_power_delivery_capabilities *cap;
> + struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
>
> if (!port->partner_pd)
> port->partner_pd = usb_power_delivery_register(NULL, &desc);
> @@ -3006,6 +3006,9 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
> memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
> caps.role = TYPEC_SOURCE;
>
> + if (cap)
> + usb_power_delivery_unregister_capabilities(cap);
> +
> cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
> if (IS_ERR(cap))
> return PTR_ERR(cap);
>
> base-commit: 0d31ea587709216d88183fe4ca0c8aba5e0205b8
> --
> 2.44.0.769.g3c40516874-goog
--
heikki
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v1] usb: typec: tcpm: unregister existing source caps before re-registration
@ 2024-04-24 22:32 Amit Sunil Dhamne
2024-04-25 10:12 ` Heikki Krogerus
2024-05-07 16:19 ` Ondřej Jirman
0 siblings, 2 replies; 5+ messages in thread
From: Amit Sunil Dhamne @ 2024-04-24 22:32 UTC (permalink / raw)
To: linux, heikki.krogerus, gregkh
Cc: badhri, rdbabiera, Amit Sunil Dhamne, linux-usb, stable,
linux-kernel, Mark Brown
Check and unregister existing source caps in tcpm_register_source_caps
function before registering new ones. This change fixes following
warning when port partner resends source caps after negotiating PD contract
for the purpose of re-negotiation.
[ 343.135030][ T151] sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities'
[ 343.135071][ T151] Call trace:
[ 343.135076][ T151] dump_backtrace+0xe8/0x108
[ 343.135099][ T151] show_stack+0x18/0x24
[ 343.135106][ T151] dump_stack_lvl+0x50/0x6c
[ 343.135119][ T151] dump_stack+0x18/0x24
[ 343.135126][ T151] sysfs_create_dir_ns+0xe0/0x140
[ 343.135137][ T151] kobject_add_internal+0x228/0x424
[ 343.135146][ T151] kobject_add+0x94/0x10c
[ 343.135152][ T151] device_add+0x1b0/0x4c0
[ 343.135187][ T151] device_register+0x20/0x34
[ 343.135195][ T151] usb_power_delivery_register_capabilities+0x90/0x20c
[ 343.135209][ T151] tcpm_pd_rx_handler+0x9f0/0x15b8
[ 343.135216][ T151] kthread_worker_fn+0x11c/0x260
[ 343.135227][ T151] kthread+0x114/0x1bc
[ 343.135235][ T151] ret_from_fork+0x10/0x20
[ 343.135265][ T151] kobject: kobject_add_internal failed for source-capabilities with -EEXIST, don't try to register things with the same name in the same directory.
Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
---
drivers/usb/typec/tcpm/tcpm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index ab6ed6111ed0..d8eb89f4f0c3 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2996,7 +2996,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
{
struct usb_power_delivery_desc desc = { port->negotiated_rev };
struct usb_power_delivery_capabilities_desc caps = { };
- struct usb_power_delivery_capabilities *cap;
+ struct usb_power_delivery_capabilities *cap = port->partner_source_caps;
if (!port->partner_pd)
port->partner_pd = usb_power_delivery_register(NULL, &desc);
@@ -3006,6 +3006,9 @@ static int tcpm_register_source_caps(struct tcpm_port *port)
memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps);
caps.role = TYPEC_SOURCE;
+ if (cap)
+ usb_power_delivery_unregister_capabilities(cap);
+
cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps);
if (IS_ERR(cap))
return PTR_ERR(cap);
base-commit: 0d31ea587709216d88183fe4ca0c8aba5e0205b8
--
2.44.0.769.g3c40516874-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-05-07 21:02 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-24 22:20 [PATCH v1] usb: typec: tcpm: unregister existing source caps before re-registration Amit Sunil Dhamne
2024-04-24 22:32 Amit Sunil Dhamne
2024-04-25 10:12 ` Heikki Krogerus
2024-05-07 16:19 ` Ondřej Jirman
2024-05-07 21:02 ` Amit Sunil Dhamne
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).