Re: [PATCH v7 3/3] usb: gadget: f_tcm: clear the scatter list when reusing the BOT status request

[sashiko-bot@kernel.org]

> bot_send_bad_status() reuses fu->bot_req_in/bot_req_out to send the CSW or
> drain the data phase, but a preceding sg command left req->sg and
> req->num_sgs pointing at that command's t_data_sg - set in
> bot_send_read_response() for a read, or usbg_prepare_w_request() for a
> write. That command is freed before the status request runs, so an
> sg-capable UDC walks a freed scatter list in dma_map_sg(): it reads freed
> heap out to the host on an IN endpoint, or writes host data into a freed
> page on an OUT endpoint.
> 
> Clear req->num_sgs and req->sg so the UDC uses the linear req->buf instead.
> 
> With KASAN, a read command followed by a rejected command that reuses
> bot_req_in reports a slab-use-after-free in the UDC's scatterlist walk,
> with the previous command's sgl_free() on the freeing stack; clearing the
> scatter list removes it, while a normal sg read still queues its own
> scatterlist.
> 
> Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013073328.2936318-1-yhlee@isslab.korea.ac.kr?part=3