Re: typec_altmode_release → refcount_t: underflow; use-after-free.

[Paul Menzel]

Dear Christian,


Am 29.01.24 um 20:06 schrieb Christian A. Ehrhardt:

> On Mon, Jan 29, 2024 at 12:57:11PM +0100, Paul Menzel wrote:

> > I noticed the message first time with Linux 6.6.8 on December 26th, and also
> > with 6.6.11, 6.7 and 6.7.1. I am unsure how to reproduce it though.
> >
> > Here the trace from Linux 6.7.1-1~exp1:
> >
> > ```
> > [    0.000000] Linux version 6.7-amd64 (debian-kernel@xxxxxxxxxxxxxxxx) (x86_64-linux-gnu-gcc-13 (Debian 13.2.0-10) 13.2.0, GNU ld (GNU Binutils for Debian) 2.41.90.20240115) #1 SMP PREEMPT_DYNAMIC Debian 6.7.1-1~exp1 (2024-01-22)
> > […]
> > [    0.000000] DMI: Dell Inc. XPS 13 9360/0596KF, BIOS 2.21.0 06/02/2022
> > […]
> > [ 9068.294345] ucsi_acpi USBC000:00: failed to re-enable notifications (-110)
> > [ 9068.499156] ------------[ cut here ]------------
> > [ 9068.499172] refcount_t: underflow; use-after-free.
> > [ 9068.499199] WARNING: CPU: 0 PID: 5598 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110

[…]
> > [ 9068.499517] Call Trace:
> > [ 9068.499521]  <TASK>
> > [ 9068.499522]  ? refcount_warn_saturate+0xbe/0x110
> > [ 9068.499526]  ? __warn+0x81/0x130
> > [ 9068.499533]  ? refcount_warn_saturate+0xbe/0x110
> > [ 9068.499545]  ? report_bug+0x171/0x1a0
> > [ 9068.499549]  ? console_unlock+0x78/0x120
> > [ 9068.499553]  ? handle_bug+0x3c/0x80
> > [ 9068.499557]  ? exc_invalid_op+0x17/0x70
> > [ 9068.499565]  ? asm_exc_invalid_op+0x1a/0x20
> > [ 9068.499570]  ? refcount_warn_saturate+0xbe/0x110
> > [ 9068.499576]  typec_altmode_release+0x49/0xc0 [typec]
> > [ 9068.499615]  device_release+0x34/0x90
> > [ 9068.499624]  kobject_put+0x78/0x190
> > [ 9068.499629]  ucsi_unregister_altmodes+0x41/0xa0 [typec_ucsi]
> > [ 9068.499648]  ucsi_unregister_partner.part.0+0x77/0xa0 [typec_ucsi]
> > [ 9068.499662]  ucsi_handle_connector_change+0x1bb/0x310 [typec_ucsi]
> > [ 9068.499671]  process_one_work+0x171/0x340
> > [ 9068.499676]  worker_thread+0x27b/0x3a0
> > [ 9068.499679]  ? __pfx_worker_thread+0x10/0x10
> > [ 9068.499681]  kthread+0xe5/0x120
> > [ 9068.499690]  ? __pfx_kthread+0x10/0x10
> > [ 9068.499693]  ret_from_fork+0x31/0x50
> > [ 9068.499698]  ? __pfx_kthread+0x10/0x10
> > [ 9068.499700]  ret_from_fork_asm+0x1b/0x30
> > [ 9068.499714]  </TASK>
> > [ 9068.499715] ---[ end trace 0000000000000000 ]---
> > ```
> >
> > Please find the full output of `dmesg` attached.
>
> This should be fixed by
>
> | commit 5962ded777d689cd8bf04454273e32228d7fb71f
> | Author: RD Babiera <rdbabiera@xxxxxxxxxx>
> | Date:   Wed Jan 3 18:17:55 2024 +0000
> |
> |     usb: typec: class: fix typec_altmode_put_partner to put plugs
>
> which is in mainline and 6.7.2.

Awesome. Thank you for mentioning this, and nice timing, as the commit 
referenced in the Fixed-by tag is from v4.19-rc1 from August 2018. ;-)


Kind regards,

Paul