Re: [PATCH v1] usb: cdns3: Fix WA2 request UAF on endpoint disable

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] usb: cdns3: missing DMA unmap for deferred WA2 requests in
  cdns3_gadget_ep_disable()
--

commit 15008f28246eb4c2cca9af667c3695fb8684956a
Author: Jaeyeong Lee <lee@jaeyeong.cc>

usb: cdns3: Fix WA2 request UAF on endpoint disable

This commit initializes priv_req->request.list when adding an internal WA2
request to wa2_descmiss_req_list and removes it during
cdns3_gadget_ep_disable() before freeing the request.

> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index 380c4fde8298e..770fbeee53484 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c

[ ... ]

> @@ -2547,6 +2549,7 @@ static int cdns3_gadget_ep_disable(struct usb_ep *ep)
>  	while (!list_empty(&priv_ep->wa2_descmiss_req_list)) {
>  		priv_req = cdns3_next_priv_request(&priv_ep->wa2_descmiss_req_list);
>  		list_del_init(&priv_req->list);
> +		list_del_init(&priv_req->request.list);
>  
>  		kfree(priv_req->request.buf);
>  		cdns3_gadget_ep_free_request(&priv_ep->endpoint,

[Severity: Medium]
Does this free priv_req->request.buf while it is still mapped for DMA when
an internal WA2 request is on priv_ep->deferred_req_list?

__cdns3_gadget_ep_queue() calls usb_gadget_map_request_by_dev() before
adding priv_req->request.list to priv_ep->deferred_req_list.  Requests on
priv_ep->pending_req_list are unmapped by cdns3_gadget_giveback() in the
preceding loop, but unlinking priv_req->request.list here removes a
deferred WA2 request before the deferred_req_list giveback loop runs,
leaking the DMA mapping and triggering a DMA-API warning when
priv_req->request.buf is freed.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111132346.9262-1-lee@jaeyeong.cc?part=1