[PATCH net] net: usb: ipheth: fix carrier_work UAF on disconnect

[PATCH net] net: usb: ipheth: fix carrier_work UAF on disconnect

[Doruk Tan Ozturk]

ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero
URB status:

	else
		schedule_delayed_work(&dev->carrier_work, 0);

ipheth_disconnect() drains that work via unregister_netdev() ->
ipheth_close() -> cancel_delayed_work_sync(), and only then kills the URBs
with ipheth_kill_urbs(). usb_kill_urb() completes any in-flight TX URB
synchronously with -ENOENT, so ipheth_sndbulk_callback() runs after the
drain and re-arms carrier_work. free_netdev() then frees the netdev
whose private area embeds carrier_work, and the pending
ipheth_carrier_check_work() dereferences the freed device, a
use-after-free on unplug while a TX URB is in flight.

Drain carrier_work again after the URB source is stopped and before the
netdev is freed.

Found by 0sec (https://0sec.ai) using automated source analysis; not
runtime-reproduced.

Fixes: bb1b40c7cb86 ("usbnet: ipheth: prevent TX queue timeouts when device not ready")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:multi-model
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
 drivers/net/usb/ipheth.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index bb1364f85bd1..fdddd761f83b 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -672,6 +672,15 @@ static void ipheth_disconnect(struct usb_interface *intf)
 	if (dev != NULL) {
 		unregister_netdev(dev->net);
 		ipheth_kill_urbs(dev);
+		/*
+		 * ipheth_sndbulk_callback() re-arms carrier_work on the
+		 * -ENOENT completion delivered by the usb_kill_urb() in
+		 * ipheth_kill_urbs(), after ipheth_close() (via
+		 * unregister_netdev()) already drained it.  Drain it again
+		 * once the URB source is stopped, before free_netdev() frees
+		 * the netdev whose private area embeds carrier_work.
+		 */
+		cancel_delayed_work_sync(&dev->carrier_work);
 		ipheth_free_urbs(dev);
 		kfree(dev->ctrl_buf);
 		free_netdev(dev->net);
-- 
2.43.0

Re: [PATCH net] net: usb: ipheth: fix carrier_work UAF on disconnect

[Jakub Kicinski]

On Fri, 24 Jul 2026 15:42:50 +0200 Doruk Tan Ozturk wrote:
> ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero
> URB status:
> 
> 	else
> 		schedule_delayed_work(&dev->carrier_work, 0);
> 
> ipheth_disconnect() drains that work via unregister_netdev() ->
> ipheth_close() -> cancel_delayed_work_sync(), and only then kills the URBs
> with ipheth_kill_urbs(). usb_kill_urb() completes any in-flight TX URB
> synchronously with -ENOENT, so ipheth_sndbulk_callback() runs after the
> drain and re-arms carrier_work. free_netdev() then frees the netdev
> whose private area embeds carrier_work, and the pending
> ipheth_carrier_check_work() dereferences the freed device, a
> use-after-free on unplug while a TX URB is in flight.
> 
> Drain carrier_work again after the URB source is stopped and before the
> netdev is freed.

Doesn't look very clean. Maybe we can check netif_running() before
scheduling? Or disable / enable the work.
-- 
pw-bot: cr