Re: [PATCH] usb: gadget: f_printer: fix pnp_string use-after-free on reconfigure

[sashiko-bot@kernel.org]

> f_printer_opts_pnp_string_store() replaces opts->pnp_string with
> kfree(old) + kstrndup(new) under opts->lock only, with no opts->refcnt
> guard, so the IEEE-1284 ID string can be changed while the function is
> bound and the gadget is enumerated.
> 
> printer_func_setup() answers the host GET_DEVICE_ID class request from
> (soft)irq context and reads the string with no lock:
> 
> 	value = strlen(*dev->pnp_string);
> 	...
> 	memcpy(buf + 2, *dev->pnp_string, value);
> 
> dev->pnp_string points at &opts->pnp_string, so a concurrent configfs
> write that frees the old string races the setup read -> use-after-free.
> 
> [ ... ]
> function is not linked into a gadget.
> 
> Fixes: 24b7ba2f88e0 ("usb: gadget: function: fix dangling pnp_string in f_printer.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yu Zhang <yuz08559@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015084658.70918-1-yuz08559@gmail.com?part=1