Re: [PATCH 2/3] usb: core: Close anchor capture-to-increment race in URB giveback

[sashiko-bot@kernel.org]

> __usb_hcd_giveback_urb() captures urb->anchor into a local variable at
> the top of the function, but increments the anchor's suspend_wakeups
> counter only after unmapping the URB for DMA and running the usbmon
> hooks.  Nothing pins the anchor during that window.  If the URB is
> concurrently unanchored by another thread -- a driver calling
> usb_unanchor_urb() on its own in-flight URB, or usb_get_from_anchor()
> or usb_scuttle_anchored_urbs() taking it -- the anchor list can become
> empty while suspend_wakeups is still zero.  A
> usb_wait_anchor_empty_timeout() waiter then observes the wait condition
> true, returns, and the driver may free the anchor (anchors are
> typically embedded in driver-private structures); the giveback's
> atomic_inc() on the captured pointer, and the later decrement and
> wake_up() in usb_anchor_resume_wakeups(), operate on freed memory.
> 
> The previous fix ("usb: core: Fix use-after-free in anchor wakeup
> [ ... ]
> Cc: stable@vger.kernel.org
> Cc: Alan Stern <stern@rowland.harvard.edu>
> Cc: Oliver Neukum <oliver@neukum.org>
> Cc: Hans de Goede <hansg@kernel.org>
> Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179264120148.17277.68253767316647311@kylinos.cn?part=2