Re: [Report]: BUG: KASAN: use-after-free in usb_hcd_pci_remove

[Andy Shevchenko <andriy.shevchenko@linux.intel.com>]

On Fri, Aug 14, 2020 at 06:18:16PM +0100, John Garry wrote:

Thanks for notifying me, my comments below.

...

> From a3b9e1b405d1efdfee2ee672bbf7dc1c7de62d66 Mon Sep 17 00:00:00 2001
> From: John Garry <john.garry@huawei.com>
> Date: Fri, 14 Aug 2020 18:14:51 +0100
> Subject: [PATCH] usb: hcd: Fix use-after-free in usb_hcd_pci_remove()
> 
> KASAN reports when CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled:

Please, reduce these huge trace backs, they have a lot of unneeded bulk.

> ==================================================================
> [58.095667] BUG: KASAN: use-after-free in usb_hcd_pci_remove+0xbc/0x168
> [58.102272] Read of size 8 at addr ffff002a0b6e8120 by task swapper/0/1

...

> [58.497758]  ffff002a0b6e8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> fb fb
> [58.504968]
> ==================================================================
> 
> Fix by relocating the usb_put_hcd() call until after the hcd->driver->flags
> check.
> 
> Signed-off-by: John Garry <john.garry@huawei.com>
> 
> diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
> index 4dc443aaef5c..44a8d3644973 100644
> --- a/drivers/usb/core/hcd-pci.c
> +++ b/drivers/usb/core/hcd-pci.c
> @@ -346,9 +346,9 @@ void usb_hcd_pci_remove(struct pci_dev *dev)
>  		dev_set_drvdata(&dev->dev, NULL);
>  		up_read(&companions_rwsem);
>  	}
> -	usb_put_hcd(hcd);
>  	if ((hcd->driver->flags & HCD_MASK) < HCD_USB3)
>  		pci_free_irq_vectors(dev);
> +	usb_put_hcd(hcd);

It's not correct approach.
We need to copy flags to a temporary variable.
I will send a new patch soon to test, thanks!

>  	pci_disable_device(dev);
>  }
>  EXPORT_SYMBOL_GPL(usb_hcd_pci_remove);

-- 
With Best Regards,
Andy Shevchenko