Re: [PATCH v1] usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps

On Tue, May 14, 2024 at 03:01:31PM -0700, Amit Sunil Dhamne wrote:

There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when:

• new (say invalid) source caps are advertised
• the existing source caps are unregistered
• tcpm_register_source_caps() returns with an error as usb_power_delivery_register_capabilities() fails

This causes port->partner_source_caps to hold on to the now freed source caps.

Reset port->partner_source_caps value to NULL after unregistering existing source caps.

Fixes: 230ecdf71a64 ("usb: typec: tcpm: unregister existing source caps before re-registration") Cc: stable@vger.kernel.org Signed-off-by: Amit Sunil Dhamne amitsd@google.com

---

drivers/usb/typec/tcpm/tcpm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org