In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: Fix race condition and ordering in port unregistration
A synchronization issue exists during port unregistration where pending partner work items can race against workqueue destruction, leading to use-after-free conditions:
cros_ec_ucsi cros_ec_ucsi.3.auto: error -ETIMEDOUT: PPM init failed BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__queue_work+0x83/0x4a0 Call Trace: __cfi_delayed_work_timer_fn+0x10/0x10 run_timer_softirq+0x3b6/0xbd0 sched_clock_cpu+0xc/0x110 irq_exit_rcu+0x18d/0x330 fred_sysvec_apic_timer_interrupt+0x5e/0x80
Fix this by ensuring strict ordering and proper serialization during teardown:
- Move ucsi_unregister_partner() to the beginning of the teardown sequence and protect it under the connector mutex lock.
- Ensure all pending partner tasks are explicitly flushed and finished before the workqueue is destroyed.
- Switch from mod_delayed_work() to a cancel_delayed_work() and queue_delayed_work() sequence. This guarantees that items currently marked as pending wont be scheduled an additional time, preventing a double release of resources which leads to the following crash:
Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP NOPTI Workqueue: cros_ec_ucsi.3.auto-con2 ucsi_poll_worker RIP: 0010:ucsi_poll_worker+0x65/0x1e0 Call Trace: process_scheduled_works+0x218/0x6d0 worker_thread+0x188/0x3f0 __cfi_worker_thread+0x10/0x10 kthread+0x226/0x2a0
To ensure these rules are applied identically across both the normal teardown and the ucsi_init() error paths, consolidate the cleanup logic into a new helper, ucsi_unregister_port().
References
- https://git.kernel.org/stable/c/07f8aaffee705e552c1f723ac8bf7eb137ad59c2
- https://git.kernel.org/stable/c/11483d80267db97fbe49f2df66385434256cc3b0
- https://git.kernel.org/stable/c/3f7b3728dd9011c915cbeaea77274ebe8366550d
- https://git.kernel.org/stable/c/7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261
- https://git.kernel.org/stable/c/bc7a0f721123ea260a42f1ded06dab844ba49434