From 06ae205d8c58c156dc7360a8217d3b6bf80c0f7e Mon Sep 17 00:00:00 2001 From: Chandana Kishori Chiluveru Date: Mon, 15 Apr 2019 10:03:39 +0530 Subject: [PATCH] usb: dwc3: Fix use after free crash from dwc3 interrupt handler If CONFIG_DEBUG_SHIRQ config option is enabled in kernel, shared irq interrupt handler can be called from free_irq context and accessing the freed dwc->ev_buf pointer in irq handler. Hence fix this issue by explicitly checking for dwc->ev_buf pointer in dwc3_check_event_buf() function. Change-Id: I3311aa36408f17fb2560ad02c0929c52e96cc7e8 Signed-off-by: Chandana Kishori Chiluveru Signed-off-by: Jack Pham --- drivers/usb/dwc3/core.c | 4 +++- drivers/usb/dwc3/gadget.c | 6 +++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index 340fdea4a345..1820b742c3f4 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -398,8 +398,10 @@ static void dwc3_free_event_buffers(struct dwc3 *dwc) struct dwc3_event_buffer *evt; evt = dwc->ev_buf; - if (evt) + if (evt) { dwc3_free_one_event_buffer(dwc, evt); + dwc->ev_buf = NULL; + } /* free GSI related event buffers */ dwc3_notify_event(dwc, DWC3_GSI_EVT_BUF_FREE, 0); diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index f016dd371ec6..8d07c59a4475 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -3661,12 +3661,16 @@ static irqreturn_t dwc3_thread_interrupt(int irq, void *_evt) static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt) { - struct dwc3 *dwc = evt->dwc; + struct dwc3 *dwc; u32 amount; u32 count; u32 reg; ktime_t start_time; + if (!evt) + return IRQ_NONE; + + dwc = evt->dwc; start_time = ktime_get(); dwc->irq_cnt++;