From patchwork Thu Feb 11 15:09:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Shevchenko X-Patchwork-Id: 1439556 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4Dc0V25tTjz9rx6 for ; Fri, 12 Feb 2021 02:12:10 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id D427482764; Thu, 11 Feb 2021 16:11:08 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=linux.intel.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 0669282675; Thu, 11 Feb 2021 16:10:21 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI, SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 5E39B8269C for ; Thu, 11 Feb 2021 16:10:10 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=linux.intel.com Authentication-Results: phobos.denx.de; spf=none smtp.mailfrom=andriy.shevchenko@linux.intel.com IronPort-SDR: XyNsfAYsv+ntISxc6TEzujYZ9PHd/z+xbDMCH+qUcUks8Zt2mBCRyT2PSyGZxSSnh2k3IaFmdG 2KvJhdXAQS4w== X-IronPort-AV: E=McAfee;i="6000,8403,9891"; a="181479842" X-IronPort-AV: E=Sophos;i="5.81,170,1610438400"; d="scan'208";a="181479842" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Feb 2021 07:09:50 -0800 IronPort-SDR: RFt4QSUojQnRF5Rj5z0CHhMAvV3rvG4uFmv4LfZTV2M/I56sJn7NfF7UZrsN6+3TxSG1Xsz2qH xeBPoFBILuJg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,170,1610438400"; d="scan'208";a="380701392" Received: from black.fi.intel.com ([10.237.72.28]) by fmsmga008.fm.intel.com with ESMTP; 11 Feb 2021 07:09:48 -0800 Received: by black.fi.intel.com (Postfix, from userid 1003) id B4E16636; Thu, 11 Feb 2021 17:09:45 +0200 (EET) From: Andy Shevchenko To: marex@denx.de, sjg@chromium.org, trini@konsulko.com, u-boot@lists.denx.de, mbrugger@suse.com Cc: Andy Shevchenko , Nicolas Saenz Julienne Subject: [PATCH v1 11/11] usb: kbd: destroy device after console is stopped Date: Thu, 11 Feb 2021 17:09:44 +0200 Message-Id: <20210211150944.73252-11-andriy.shevchenko@linux.intel.com> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210211150944.73252-1-andriy.shevchenko@linux.intel.com> References: <20210211150944.73252-1-andriy.shevchenko@linux.intel.com> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean In case of IOMUX enabled it assumes that console devices in the list are available to get them stopped properly via ->stop() callback. However, the USB keyboard driver violates this assumption and tries to play tricks so the device get destroyed while being listed as an active console. Swap the order of device deregistration and IOMUX update along with converting to use iomux_replace_device() jelper to avoid the use-after-free. Fixes: 3cbcb2892809 ("usb: Fix usb_kbd_deregister when console-muxing is used") Fixes: 8a8348703081 ("dm: usb: Add a remove() method for USB keyboards") Reported-by: Nicolas Saenz Julienne Signed-off-by: Andy Shevchenko --- common/usb_kbd.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/common/usb_kbd.c b/common/usb_kbd.c index b316807844b1..60c6027e048d 100644 --- a/common/usb_kbd.c +++ b/common/usb_kbd.c @@ -617,12 +617,12 @@ int usb_kbd_deregister(int force) if (dev) { usb_kbd_dev = (struct usb_device *)dev->priv; data = usb_kbd_dev->privptr; - if (stdio_deregister_dev(dev, force) != 0) - return 1; #if CONFIG_IS_ENABLED(CONSOLE_MUX) - if (iomux_doenv(stdin, env_get("stdin")) != 0) + if (iomux_replace_device(stdin, DEVNAME, force ? "nulldev" : "")) return 1; #endif + if (stdio_deregister_dev(dev, force) != 0) + return 1; #ifdef CONFIG_SYS_USB_EVENT_POLL_VIA_INT_QUEUE destroy_int_queue(usb_kbd_dev, data->intq); #endif @@ -660,16 +660,16 @@ static int usb_kbd_remove(struct udevice *dev) goto err; } data = udev->privptr; - if (stdio_deregister_dev(sdev, true)) { - ret = -EPERM; - goto err; - } #if CONFIG_IS_ENABLED(CONSOLE_MUX) - if (iomux_doenv(stdin, env_get("stdin"))) { + if (iomux_replace_device(stdin, DEVNAME, "nulldev")) { ret = -ENOLINK; goto err; } #endif + if (stdio_deregister_dev(sdev, true)) { + ret = -EPERM; + goto err; + } #ifdef CONFIG_SYS_USB_EVENT_POLL_VIA_INT_QUEUE destroy_int_queue(udev, data->intq); #endif