Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests

TCPM may receive PD messages associated with unknown or unsupported
alternate modes. If that happens, calls to typec_match_altmode()
will return NULL. The tcpm code does not currently take this into
account. This results in crashes.

Unable to handle kernel NULL pointer dereference at virtual address 000001f0
pgd = 41dad9a1
[000001f0] *pgd=00000000
Internal error: Oops: 5 [#1] THUMB2
Modules linked in: tcpci tcpm
CPU: 0 PID: 2338 Comm: kworker/u2:0 Not tainted 5.1.18-sama5-armv7-r2 #6
Hardware name: Atmel SAMA5
Workqueue: 2-0050 tcpm_pd_rx_handler [tcpm]
PC is at typec_altmode_attention+0x0/0x14
LR is at tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm]
...
[<c03fbee8>] (typec_altmode_attention) from [<bf8030fb>]
(tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm])
[<bf8030fb>] (tcpm_pd_rx_handler [tcpm]) from [<c012082b>]
(process_one_work+0x123/0x2a8)
[<c012082b>] (process_one_work) from [<c0120a6d>]
(worker_thread+0xbd/0x3b0)
[<c0120a6d>] (worker_thread) from [<c012431f>] (kthread+0xcf/0xf4)
[<c012431f>] (kthread) from [<c01010f9>] (ret_from_fork+0x11/0x38)

Ignore PD messages if the associated alternate mode is not supported.

Fixes: e9576fe8e605c ("usb: typec: tcpm: Support for Alternate Modes")
Cc: stable <stable@vger.kernel.org>
Reported-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/1564761822-13984-1-git-send-email-linux@roeck-us.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Guenter Roeck and committed by
Greg Kroah-Hartman
88d02c9b cb53c517

+23 -13
+23 -13
drivers/usb/typec/tcpm/tcpm.c
··· 1109 1109 break; 1110 1110 case CMD_ATTENTION: 1111 1111 /* Attention command does not have response */ 1112 - typec_altmode_attention(adev, p[1]); 1112 + if (adev) 1113 + typec_altmode_attention(adev, p[1]); 1113 1114 return 0; 1114 1115 default: 1115 1116 break; ··· 1162 1161 } 1163 1162 break; 1164 1163 case CMD_ENTER_MODE: 1165 - typec_altmode_update_active(pdev, true); 1164 + if (adev && pdev) { 1165 + typec_altmode_update_active(pdev, true); 1166 1166 1167 - if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) { 1168 - response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE); 1169 - response[0] |= VDO_OPOS(adev->mode); 1170 - return 1; 1167 + if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) { 1168 + response[0] = VDO(adev->svid, 1, 1169 + CMD_EXIT_MODE); 1170 + response[0] |= VDO_OPOS(adev->mode); 1171 + return 1; 1172 + } 1171 1173 } 1172 1174 return 0; 1173 1175 case CMD_EXIT_MODE: 1174 - typec_altmode_update_active(pdev, false); 1176 + if (adev && pdev) { 1177 + typec_altmode_update_active(pdev, false); 1175 1178 1176 - /* Back to USB Operation */ 1177 - WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, 1178 - NULL)); 1179 + /* Back to USB Operation */ 1180 + WARN_ON(typec_altmode_notify(adev, 1181 + TYPEC_STATE_USB, 1182 + NULL)); 1183 + } 1179 1184 break; 1180 1185 default: 1181 1186 break; ··· 1191 1184 switch (cmd) { 1192 1185 case CMD_ENTER_MODE: 1193 1186 /* Back to USB Operation */ 1194 - WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, 1195 - NULL)); 1187 + if (adev) 1188 + WARN_ON(typec_altmode_notify(adev, 1189 + TYPEC_STATE_USB, 1190 + NULL)); 1196 1191 break; 1197 1192 default: 1198 1193 break; ··· 1205 1196 } 1206 1197 1207 1198 /* Informing the alternate mode drivers about everything */ 1208 - typec_altmode_vdm(adev, p[0], &p[1], cnt); 1199 + if (adev) 1200 + typec_altmode_vdm(adev, p[0], &p[1], cnt); 1209 1201 1210 1202 return rlen; 1211 1203 }