Re: [PATCH 1/1] usb: gadget: f_hid: Conduct proper refcounting on shared f_hidg pointer

[John Keeping <john@metanate.com>]

On Tue, Nov 22, 2022 at 08:31:08AM +0000, Lee Jones wrote:
> On Mon, 21 Nov 2022, John Keeping wrote:
> > Subject: [PATCH] usb: gadget: f_hid: fix f_hidg lifetime vs cdev
> > 
> > The embedded struct cdev does not have its lifetime correctly tied to
> > the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN
> > is held open while the gadget is deleted.
> > 
> > This can readily be replicated with libusbgx's example programs (for
> > conciseness - operating directly via configfs is equivalent):
> > 
> > 	gadget-hid
> > 	exec 3<> /dev/hidg0
> > 	gadget-vid-pid-remove
> > 	exec 3<&-
> > 
> > Pull the existing device up in to struct f_hidg and make use of the
> > cdev_device_{add,del}() helpers.  This changes the lifetime of the
> > device object to match struct f_hidg, but note that it is still added
> > and deleted at the same time.
> 
> This is much better, thanks for re-spinning.
> 
> > [Also fix refcount leak on an error path.]
> > 
> > Signed-off-by: John Keeping <john@metanate.com>
> > ---
> >  drivers/usb/gadget/function/f_hid.c | 50 ++++++++++++++++-------------
> >  1 file changed, 28 insertions(+), 22 deletions(-)
> > 
> > diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
> > index ca0a7d9eaa34..0b94668a3812 100644
> > --- a/drivers/usb/gadget/function/f_hid.c
> > +++ b/drivers/usb/gadget/function/f_hid.c
> > @@ -71,7 +71,7 @@ struct f_hidg {
> >  	wait_queue_head_t		write_queue;
> >  	struct usb_request		*req;
> >  
> > -	int				minor;
> > +	struct device			dev;
> >  	struct cdev			cdev;
> >  	struct usb_function		func;
> >  
> > @@ -84,6 +84,14 @@ static inline struct f_hidg *func_to_hidg(struct usb_function *f)
> >  	return container_of(f, struct f_hidg, func);
> >  }
> >  
> > +static void hidg_release(struct device *dev)
> > +{
> > +	struct f_hidg *hidg = container_of(dev, struct f_hidg, dev);
> 
> Could we store/fetch this with dev_{set,get}_drvdata(), and make
> hidg->dev a pointer reducing the size of the struct f_hidg.

That will reduce the size of struct f_hidg, but we'll have an extra
allocation for the device object, so I don't think that's a real
benefit.

It seems simpler to keep a single allocation and embed the device.

> > +	kfree(hidg->set_report_buf);
> > +	kfree(hidg);
> > +}
> > +
> >  /*-------------------------------------------------------------------------*/
> >  /*                           Static descriptors                            */
> >  
> > @@ -904,9 +912,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
> >  	struct usb_ep		*ep;
> >  	struct f_hidg		*hidg = func_to_hidg(f);
> >  	struct usb_string	*us;
> > -	struct device		*device;
> >  	int			status;
> > -	dev_t			dev;
> >  
> >  	/* maybe allocate device-global string IDs, and patch descriptors */
> >  	us = usb_gstrings_attach(c->cdev, ct_func_strings,
> > @@ -999,21 +1005,12 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
> >  
> >  	/* create char device */
> >  	cdev_init(&hidg->cdev, &f_hidg_fops);
> > -	dev = MKDEV(major, hidg->minor);
> > -	status = cdev_add(&hidg->cdev, dev, 1);
> > +	cdev_set_parent(&hidg->cdev, &hidg->dev.kobj);
> 
> cdev_device_add() should take care of this, so long as:
> 
>     if (dev->devt)
>         dev_set_parent(cdev, &dev->kobj);

Thanks, I'll change this.

> > +	status = cdev_device_add(&hidg->cdev, &hidg->dev);
> >  	if (status)
> >  		goto fail_free_descs;
> >  
> > -	device = device_create(hidg_class, NULL, dev, NULL,
> > -			       "%s%d", "hidg", hidg->minor);
> > -	if (IS_ERR(device)) {
> > -		status = PTR_ERR(device);
> > -		goto del;
> > -	}
> > -
> >  	return 0;
> > -del:
> > -	cdev_del(&hidg->cdev);
> >  fail_free_descs:
> >  	usb_free_all_descriptors(f);
> >  fail:
> > @@ -1244,9 +1241,7 @@ static void hidg_free(struct usb_function *f)
> >  
> >  	hidg = func_to_hidg(f);
> >  	opts = container_of(f->fi, struct f_hid_opts, func_inst);
> > -	kfree(hidg->report_desc);
> > -	kfree(hidg->set_report_buf);
> > -	kfree(hidg);
> > +	put_device(&hidg->dev);
> >  	mutex_lock(&opts->lock);
> >  	--opts->refcnt;
> >  	mutex_unlock(&opts->lock);
> > @@ -1256,8 +1251,7 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f)
> >  {
> >  	struct f_hidg *hidg = func_to_hidg(f);
> >  
> > -	device_destroy(hidg_class, MKDEV(major, hidg->minor));
> > -	cdev_del(&hidg->cdev);
> > +	cdev_device_del(&hidg->cdev);
> >  
> >  	usb_free_all_descriptors(f);
> >  }
> > @@ -1266,6 +1260,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
> >  {
> >  	struct f_hidg *hidg;
> >  	struct f_hid_opts *opts;
> > +	int ret;
> >  
> >  	/* allocate and initialize one new instance */
> >  	hidg = kzalloc(sizeof(*hidg), GFP_KERNEL);
> > @@ -1277,17 +1272,28 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
> >  	mutex_lock(&opts->lock);
> >  	++opts->refcnt;
> >  
> > -	hidg->minor = opts->minor;
> > +	device_initialize(&hidg->dev);
> > +	hidg->dev.release = hidg_release;
> > +	hidg->dev.class = hidg_class;
> > +	hidg->dev.devt = MKDEV(major, opts->minor);
> > +	ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor);
> > +	if (ret) {
> > +		--opts->refcnt;
> 
> Since we're holding the opts lock at this point, is there anything
> preventing us from incrementing the refcnt at the end, just before
> giving up the lock, thus saving 2 decrements in the error paths?

This makes sense.  I'll respin this as a series and include a patch
tidying up the error handling as a final step.

> > +		mutex_unlock(&opts->lock);
> > +		return ERR_PTR(ret);
> > +	}
> > +
> >  	hidg->bInterfaceSubClass = opts->subclass;
> >  	hidg->bInterfaceProtocol = opts->protocol;
> >  	hidg->report_length = opts->report_length;
> >  	hidg->report_desc_length = opts->report_desc_length;
> >  	if (opts->report_desc) {
> > -		hidg->report_desc = kmemdup(opts->report_desc,
> > +		hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc,
> 
> Nice.
> 
> >  					    opts->report_desc_length,
> >  					    GFP_KERNEL);
> >  		if (!hidg->report_desc) {
> > -			kfree(hidg);
> > +			put_device(&hidg->dev);
> > +			--opts->refcnt;
> >  			mutex_unlock(&opts->lock);
> >  			return ERR_PTR(-ENOMEM);
> >  		}
> 
> Thanks for doing this John, your work is appreciated.