From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f45.google.com (mail-dl1-f45.google.com [74.125.82.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B60BC3AC0C3 for ; Tue, 30 Jun 2026 04:17:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782793049; cv=none; b=bzzPQW9Q/+c278hTChCl6zgiCtyZviNPiRG9DcgDN4R2uhKvsGLq0vu3o49it+b2oQUhI2SbjK1h95Yyl2dLWXlvzDoC+md09B63y7oJRqW91IoMxQSz8NU+Paoga+fiojWJ66nJjwli0a7akkJzvGQMBbR7E83vK1uNdbQ2of4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782793049; c=relaxed/simple; bh=8u5uZUMqhrL/gnN85tqtWF3US52t+rBo+R6AWDwO5ck=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NUW+S8E52Z/t3fdT6ZbUiPFZIK9B10uR8oWNazPhct81cPRYWo07BYiuuItWzQlRpzDwNSwL4FapMEr0UvMshVhWPPvHd5TD2vrWCeKbDgLXdoiLO5Gsj6IeX4BEYK/wUtG6SC7PN0xtNQQ2f5xWxuFjW20I95P5WGpbWS5KZa8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=O323CP3q; arc=none smtp.client-ip=74.125.82.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="O323CP3q" Received: by mail-dl1-f45.google.com with SMTP id a92af1059eb24-13b24ddadedso1990951c88.0 for ; Mon, 29 Jun 2026 21:17:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782793045; x=1783397845; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=OjgHD+veL6Mrs93d7R3aSe1UX0mQg1cLxReyF2YhYPw=; b=O323CP3qFts6eay/77P5Bgbp0JoTIDQIXpTbAo5xG4OQTLtykzxJcwieKuJM0e1n/J 4JHRHXVin4N8vfSQgj73907E9c/HawBqTLJg4mC0c571T7L6J5j/c+DJQEK1wdErE8IH Ahu+GHiD/KbCy2CLZFAszbcdQ29yWRq5nj+csx5CPpWcjWtxr3/UhpY/Nwz27FaisPgt 2RaVmtSvHZQbDBZLPq/PrzIjlnVaj1aneagwCJSCLIsI8MuMtsUOBv81kAy1rZYAngIF axj2u3IfLqnQt7MmnKbjuCC3JLd35YjvptO7+XTYwKrmmgRMa/0cv074haxzdd8MNW5x GA8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782793045; x=1783397845; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=OjgHD+veL6Mrs93d7R3aSe1UX0mQg1cLxReyF2YhYPw=; b=mAVlDa51pcWukNwIUJ/F5m681t1obCtj1gSisS1EIYzhks5fhLXhZRxl0/PqqoNLeH f4IBHa3nNAn+nO2nnFpaemKryTDsad0Tt4k17kITZXwicbZz8bJtRIERJA+qLzznKO/3 KYSTjUZSDBwLJkRh9lOYmTZIw4YkfF6ojmqaBSIo9iHX3V4KddOVTDMRewGHMV5tAWei d5IWo21grWC5rp60vZXg5Ys6sc1Y7dPW2ajWki9IrLsnyVZbkZxImeTFnB4LeBijWnql uAABtUmJ5VGfJg9A+ADcFFapsIT0ORo9YpD3W0taMcB52XISzyEYrCclyivJR8UXyfxA 8Wyg== X-Forwarded-Encrypted: i=1; AFNElJ8LfUe09JktHm2ffkcvTgCcODKI7fwK3kIcvwcnaaKH1MvTcBowt1IWFGKw4AfBz6ZzLQAcZl4nD+0vNmY=@vger.kernel.org X-Gm-Message-State: AOJu0Yz6BdF5+HlLdq7MrnFXSU6fprDMgQ9KawQfT3E9S3d1kyKQJzWG sstilSrOvxFS9BV2Fas5jTIK6fIK4Nm7QN62k6abd6itQQbGlyqjohiA X-Gm-Gg: AfdE7cnhdO5EP4ykiv/ZN/jWkYB5zqg6QaXsrR+Nf/MSIRqtCCxmbaxNNVD3Jvu28ZG sx7xjearBg1HqL3KIcRWgnor/viT4hnQgxxDil+zO3ACDp6udbmaXYH9Jo3tTxl0ovzJJ71zwLp ecEPUCKhhwVJrmcw4dmw/Gt81jtotObEieVwbQjnT6BdZOZvB9X2+CFu4Gl7dirT3nAWsQTgujG K3HVB1zmd0fwMDqhYkj1xOxfsUKadahY24m/LPFKeESMXUSGpSKwZQ66/NnZyCrKNLepndcZClc aVCp3vOM9nnYHo7am7DgOVp8Lzqw+/9wlYwRbANcaHc3jnBFPZhxARRT1XLzkdcFiEbFkiCa0kO RmEsOMioiuU+lkoGZxLh/L/D/g2iUxyFz3jl0sKHFoyz1Frq0JIVaZP5mXZ3KflRBszcZ47hr1g K6Uy/mHXaXh+3j2ixNQip1aoMXCe04+uUUk5j4DJAmoAH9c5F7wi/EAi80vSo9it1CmDBF X-Received: by 2002:a05:7022:fa0:b0:13b:20ad:b96a with SMTP id a92af1059eb24-13b2a1dd575mr1300904c88.50.1782793045226; Mon, 29 Jun 2026 21:17:25 -0700 (PDT) Received: from deepanshu-kernel-hacker.. ([2405:201:682f:383f:bf30:8dca:9d63:c0de]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13b2a9b425asm3891062c88.0.2026.06.29.21.17.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jun 2026 21:17:24 -0700 (PDT) From: Deepanshu Kartikey To: castet.matthieu@free.fr, stf_xl@wp.pl, 3chas3@gmail.com, gregkh@linuxfoundation.org Cc: linux-atm-general@lists.sourceforge.net, netdev@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+3d45d763d18796f97412@syzkaller.appspotmail.com Subject: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware() Date: Tue, 30 Jun 2026 09:47:16 +0530 Message-ID: <20260630041716.97102-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit uea_load_firmware() calls request_firmware_nowait() passing a raw struct usb_device pointer as context, without holding a reference to it. If the USB device is disconnected before the firmware workqueue fires, the usb_device and its usb_interface objects are freed while uea_upload_pre_firmware() is still pending on the workqueue. When the callback eventually runs, it accesses the freed memory causing a slab-use-after-free: BUG: KASAN: slab-use-after-free in __intf_to_usbdev include/linux/usb.h:752 [inline] BUG: KASAN: slab-use-after-free in uea_upload_pre_firmware+0x8d/0x640 drivers/usb/atm/ueagle-atm.c:598 Read of size 8 at addr ffff88802b0710b8 by task kworker/0:2/1664 Fix by calling usb_get_dev() before queuing the firmware request to pin the usb_device in memory for the lifetime of the async operation, and usb_put_dev() in the callback once it is finished with the pointer. On the error path where request_firmware_nowait() itself fails, drop the reference immediately since the callback will never fire. Reported-by: syzbot+3d45d763d18796f97412@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d45d763d18796f97412 Signed-off-by: Deepanshu Kartikey --- drivers/usb/atm/ueagle-atm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c index d610cdcef7d0..686cc58fb89f 100644 --- a/drivers/usb/atm/ueagle-atm.c +++ b/drivers/usb/atm/ueagle-atm.c @@ -663,6 +663,7 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, uea_err(usb, "firmware is corrupted\n"); err: release_firmware(fw_entry); + usb_put_dev(usb); } /* @@ -693,12 +694,14 @@ static int uea_load_firmware(struct usb_device *usb, unsigned int ver) break; } + usb_get_dev(usb); ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev, GFP_KERNEL, usb, uea_upload_pre_firmware); - if (ret) + if (ret) { uea_err(usb, "firmware %s is not available\n", fw_name); - else + usb_put_dev(usb); + } else uea_info(usb, "loading firmware %s\n", fw_name); return ret; -- 2.43.0