From: Xin Zhao <xnzhao@google.com>
To: John Keeping <john@metanate.com>
Cc: Alan Stern <stern@rowland.harvard.edu>,
gregkh@linuxfoundation.org, jakobkoschel@gmail.com,
rdunlap@infradead.org, ira.weiny@intel.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: gadget: dummyhcd: Fix use-after-free in dummy_free_request
Date: Tue, 7 Feb 2023 21:58:03 +0000 [thread overview]
Message-ID: <Y+LJa8ZuBaD1DwlL@google.com> (raw)
In-Reply-To: <Y+I9HcPvrm1TzUCw@donbot>
On Tue, Feb 07, 2023 at 11:59:25AM +0000, John Keeping wrote:
> On Mon, Feb 06, 2023 at 07:34:40PM -0500, Alan Stern wrote:
> > On Mon, Feb 06, 2023 at 10:52:58PM +0000, Xin Zhao wrote:
> > > DummyHCD assume when dummy_free_request is called, the request
> > > is already detached from request queues. It is correct in most
> > > cases.
> > > But when DummyHCD is detached from gadget configfs with pending
> > > requests and some requests are still in pending queue,
> > > dummy_free_request would free them directly.
> > > Later on, dummy_udc_stop would iterate pending queue to release
> > > the requests again.
> > >
> > > Stacktrace for dummy_free_reqeust
> > > ```
> > > kfree(const void * x) (slub.c:4200)
> > > dummy_free_request(struct usb_ep * _ep, struct usb_request * _req) (dummy_hcd.c:691)
> > > usb_ep_free_request(struct usb_ep * ep, struct usb_request * req) (core.c:201)
> > > functionfs_unbind(struct ffs_data * ffs) (f_fs.c:1894)
> >
> > That's the bug right there. The kerneldoc for usb_ep_free_request()
> > says "Caller guarantees the request is not queued". So it looks like
> > the real solution is to fix functionfs_unbind().
>
> This is commit ce405d561b02 ("usb: gadget: f_fs: Ensure ep0req is
> dequeued before free_request") IIUC.
>
> Xin, are you able to test a version with that commit?
Yes John, the commit may fix the issue. Thanks for bring it up.
prev parent reply other threads:[~2023-02-07 21:58 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-06 22:52 [PATCH] usb: gadget: dummyhcd: Fix use-after-free in dummy_free_request Xin Zhao
2023-02-07 0:34 ` Alan Stern
2023-02-07 11:59 ` John Keeping
2023-02-07 21:58 ` Xin Zhao [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y+LJa8ZuBaD1DwlL@google.com \
--to=xnzhao@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=ira.weiny@intel.com \
--cc=jakobkoschel@gmail.com \
--cc=john@metanate.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=rdunlap@infradead.org \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.