Re: [PATCH 1/6] usbip: vhci_hcd: protect urb->hcpriv with priv_lock in vhci_urb_dequeue()

[sashiko-bot@kernel.org]

> In vhci_urb_dequeue(), urb->hcpriv is read and priv->vdev is
> dereferenced while holding only vhci->lock, before acquiring
> vdev->priv_lock. However, pickup_urb_and_free_priv() in vhci_rx.c frees
> priv and clears urb->hcpriv under vdev->priv_lock without holding
> vhci->lock.
> 
> If vhci_urb_dequeue() races with pickup_urb_and_free_priv() on a
> completing URB, vhci_urb_dequeue() can observe a non-NULL priv pointer
> just before pickup_urb_and_free_priv() frees it, leading to a
> use-after-free when dereferencing priv->vdev or priv->seqnum, or a
> double-free of priv.
> 
> Resolve the race by deriving vdev from urb->dev->portnum (matching
> vhci_urb_enqueue(), and guarding against portnum == 0 in both) and
> acquiring vdev->priv_lock (nested inside vhci->lock) before reading
> urb->hcpriv.
> 
> Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Gemini
> Signed-off-by: Raul E Rangel <rrangel@chromium.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021150704.3129446-1-rrangel@chromium.org?part=1