Re: [PATCH v2 3/4] usb: gadget: f_hid: fix race between userspace report update and GET_REPORT response

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] usb: gadget: f_hid: use-after-free of get_req_buf in
  hidg_unbind()
--

commit e3eb22ae89791d0f4572b69a78a39ec433f7be8d
Author: Shunbo Shi <shishunbo@cmss.chinamobile.com>

usb: gadget: f_hid: fix race between userspace report update and GET_REPORT response

This commit allocates a dedicated buffer (get_req_buf) at bind time and
copies GET_REPORT response data into it before queueing hidg->get_req on
ep0, avoiding a race with userspace report updates.

> diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
> index d7ba30323414c..426bc1743cbb9 100644
> --- a/drivers/usb/gadget/function/f_hid.c
> +++ b/drivers/usb/gadget/function/f_hid.c

[ ... ]

> @@ -1593,6 +1619,8 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f)
>  
>  	cdev_device_del(hidg->cdev, &hidg->dev);
>  	destroy_workqueue(hidg->workqueue);
> +	kfree(hidg->get_req_buf);
> +	hidg->get_req_buf = NULL;
>  	usb_free_all_descriptors(f);
>  }

[Severity: Medium]
Can freeing hidg->get_req_buf here cause a use-after-free if hidg->get_req
is still queued on cdev->gadget->ep0?

get_report_workqueue_handler() queues hidg->get_req (with req->buf set to
hidg->get_req_buf) asynchronously on ep0 and sets hidg->get_report_returned
to true before the transfer completes.  During gadget unbind,
hidg_disable() skips hidg->get_req when hidg->get_report_returned is true,
and destroy_workqueue(hidg->workqueue) in hidg_unbind() can also drain a
pending work item that queues hidg->get_req onto ep0 right before
kfree(hidg->get_req_buf) runs.  Because hidg_unbind() neither dequeues nor
frees hidg->get_req, the UDC can access freed slab memory via req->buf and
hidg->get_req is leaked with a dangling buffer pointer.

Should hidg_unbind() dequeue and free hidg->get_req on ep0 before freeing
hidg->get_req_buf?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111081313.16626-1-shishunbo@cmss.chinamobile.com?part=3