[PATCH] usb: isp1760: fix use-after-free when kmem cache setup fails

[PATCH] usb: isp1760: fix use-after-free when kmem cache setup fails

[Shuangpeng Bai]

isp1760_init() ignores the return value of isp1760_init_kmem_once().
If creating the isp1760_qtd or isp1760_qh cache fails, the error path
in isp1760_init_kmem_once() destroys the caches that were already
created, but the global pointers keep pointing to the freed kmem_cache
structures: urb_listitem_cachep when the qtd cache creation fails, and
both urb_listitem_cachep and qtd_cachep when the qh cache creation
fails. Module init still succeeds as long as one of the driver
registrations succeeds, so the driver stays loaded with dangling cache
pointers.

When the module is unloaded later, isp1760_exit() calls
isp1760_deinit_kmem_cache(), which destroys the already freed caches a
second time. A controller probed in the meantime would also allocate
qTDs and QHs from freed or NULL caches.

Propagate the error from isp1760_init_kmem_once() so that module load
fails cleanly instead.

Fixes: db11e47dd7b0 ("USB: ISP1760 HCD driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/usb/isp1760/isp1760-if.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/isp1760/isp1760-if.c b/drivers/usb/isp1760/isp1760-if.c
index a64190addba6..bf33289bfcd4 100644
--- a/drivers/usb/isp1760/isp1760-if.c
+++ b/drivers/usb/isp1760/isp1760-if.c
@@ -274,7 +274,9 @@ static int __init isp1760_init(void)
 {
 	int ret, any_ret = -ENODEV;
 
-	isp1760_init_kmem_once();
+	ret = isp1760_init_kmem_once();
+	if (ret)
+		return ret;
 
 	ret = platform_driver_register(&isp1760_plat_driver);
 	if (!ret)
-- 
2.43.0

Re: [PATCH] usb: isp1760: fix use-after-free when kmem cache setup fails

[sashiko-bot]

> isp1760_init() ignores the return value of isp1760_init_kmem_once().
> If creating the isp1760_qtd or isp1760_qh cache fails, the error path
> in isp1760_init_kmem_once() destroys the caches that were already
> created, but the global pointers keep pointing to the freed kmem_cache
> structures: urb_listitem_cachep when the qtd cache creation fails, and
> both urb_listitem_cachep and qtd_cachep when the qh cache creation
> fails. Module init still succeeds as long as one of the driver
> registrations succeeds, so the driver stays loaded with dangling cache
> pointers.
> 
> When the module is unloaded later, isp1760_exit() calls
> isp1760_deinit_kmem_cache(), which destroys the already freed caches a
> second time. A controller probed in the meantime would also allocate
> qTDs and QHs from freed or NULL caches.
> 
> Propagate the error from isp1760_init_kmem_once() so that module load
> fails cleanly instead.
> 
> Fixes: db11e47dd7b0 ("USB: ISP1760 HCD driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023181857.114054-1-shuangpeng.kernel@gmail.com?part=1