Re: [PATCH 1/3] usb: core: Fix use-after-free in anchor wakeup protocol

[sashiko-bot@kernel.org]

> The API contract of usb_wait_anchor_empty_timeout() and of the anchor
> cleanup helpers is that when they return successfully (non-zero, for
> usb_wait_anchor_empty_timeout()), no URB giveback is in flight for the
> anchor anymore, so drivers may free the memory holding the anchor
> (xpad, for example, embeds irq_out_anchor in its private structure and
> kfrees it in xpad_disconnect()).
> 
> This contract is broken by two windows in which the waiter can observe
> "anchor list empty and suspend_wakeups == 0" while the URB giveback
> path is still about to access anchor->wait:
> 
>  1. usb_anchor_resume_wakeups() decrements suspend_wakeups, which
>     makes the wait condition true, and only afterwards calls
>     wake_up(&anchor->wait), without any synchronization in between.
>     A waiter returns, the driver frees the anchor, and the late
> [ ... ]
> Cc: stable@vger.kernel.org
> Cc: Alan Stern <stern@rowland.harvard.edu>
> Cc: Oliver Neukum <oliver@neukum.org>
> Cc: Hans de Goede <hansg@kernel.org>
> Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179264120148.17277.68253767316647311@kylinos.cn?part=1