From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f70.google.com (mail-oa1-f70.google.com [209.85.160.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5570BCA6B for ; Tue, 30 Jun 2026 00:31:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782779464; cv=none; b=IxmNlFlIAS7SJXBUJgxA6NW6kOqRw5QWZk0QLs4RyER2CpiLv48R7llbsI9nszRQwiyuDLR01jDotwCimBIM5HvxQgmT8XIOGQKgeVXqNHaGV0dkv9g6z2cHeRfVMVigvrZDqL05aa6qMP9QJsG0QSz160/E3k3P+kYIqGvDhLk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782779464; c=relaxed/simple; bh=MzCoA0I6JCoPZ6ySbq3jKzKC+tsg4jpFxx0qUIj2ARE=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=ZMEHE1/By0Ppx+8chFvSOLcSHw8t34+G9c/VeyZLFwlBniqhAP3Gi6LEOu1IwOrvE3tWpgZZla17CERtv9dF7I64gHO+HGEGnaShB8uNypL+eQ1oROvu9LJr1qr4tLp8T2bvEBgcmaC1auMQPexbgVRP+IflvllqWweHzjlSms4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.160.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oa1-f70.google.com with SMTP id 586e51a60fabf-44801afec53so4704819fac.2 for ; Mon, 29 Jun 2026 17:31:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782779462; x=1783384262; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=M9/UvHKKqNMQnZdcA3GPPv/jOFNBm0CJgUt26WbEJQs=; b=tHQ0OacSAfbqs4nCwmSoe5voIzo7f7yTSWybfatuvYVmqXYCL28GxEIwFoa8OMJSgG GfunlKM+mVNree0la5to6v7GOY42RGAEEFgEyPcg4cKfUBgIt3aZ++X4POxhknFnQzOC OYLhyr2YBr7NOjU9sfJZWpDywdk5zeoqub57OL4+psB1lymZoUmF2XpCORNDYwwd4/I1 cbB5xxu01aXo+6Gw6vnk+BeW2MQfl0zpY9Zhg/iUcOQ98FyVNu9ebxDNAm6yLJ1DzA0a ETqRGcb0cy0SsUJ73LDyHEglOD28AQJ93PQSItdLLaldGG1RJADcz7DP03IXJ5+MB9f3 7obQ== X-Gm-Message-State: AOJu0Yxm+yiEGoKwCmv6QflzS1De10PLiW/YYgNOAgROYn4VFXdhl6EJ VQLXM0FVOe/F5f65tvtFvkGYA1kaOKNyiXh/1Gj8Awe7PcSMhjYM8pRL++xxK8GMTU2aixJXIbC KCQV1UytieOT8s0kQAs8CE2Jw60xLqCQg2rGTY1Rdn2VJdjvEqWHcza8PAAE= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6809:381:20b0:495:ec4c:e418 with SMTP id 5614622812f47-495ec4ce4c4mr695772b6e.30.1782779462424; Mon, 29 Jun 2026 17:31:02 -0700 (PDT) Date: Mon, 29 Jun 2026 17:31:02 -0700 In-Reply-To: <6a42df07.854d4ab9.360e1d.000d.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a430e46.6124255a.dd83.0007.GAE@google.com> Subject: Forwarded: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware() From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware() Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master uea_load_firmware() calls request_firmware_nowait() passing a raw struct usb_device pointer as the callback context, without holding a reference to it. If the USB device is disconnected before the firmware workqueue fires, the usb_device is freed while uea_upload_pre_firmware() is still executing, causing a slab-use-after-free: BUG: KASAN: slab-use-after-free in __intf_to_usbdev include/linux/usb.h:752 [inline] BUG: KASAN: slab-use-after-free in uea_upload_pre_firmware+0x8d/0x640 drivers/usb/atm/ueagle-atm.c:598 Read of size 8 at addr ffff88802b0710b8 by task kworker/0:2/1664 The root cause: Eagle ADSL modems enumerate twice. On first plug-in they present a pre-firmware PID; uea_probe() calls uea_load_firmware() which queues the firmware upload asynchronously and returns immediately. The USB core considers probing complete. If the cable is pulled at this point, the usb_device is torn down while the firmware callback is still pending or running on the workqueue. Fix by calling usb_get_dev() before queuing the request to pin the usb_device in memory for the lifetime of the async operation, and usb_put_dev() in the callback once it is finished with the pointer. On the error path where request_firmware_nowait() itself fails, drop the reference immediately since the callback will never fire. Reported-by: syzbot+3d45d763d18796f97412@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d45d763d18796f97412 Signed-off-by: Deepanshu Kartikey --- drivers/usb/atm/ueagle-atm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c index d610cdcef7d0..686cc58fb89f 100644 --- a/drivers/usb/atm/ueagle-atm.c +++ b/drivers/usb/atm/ueagle-atm.c @@ -663,6 +663,7 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, uea_err(usb, "firmware is corrupted\n"); err: release_firmware(fw_entry); + usb_put_dev(usb); } /* @@ -693,12 +694,14 @@ static int uea_load_firmware(struct usb_device *usb, unsigned int ver) break; } + usb_get_dev(usb); ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev, GFP_KERNEL, usb, uea_upload_pre_firmware); - if (ret) + if (ret) { uea_err(usb, "firmware %s is not available\n", fw_name); - else + usb_put_dev(usb); + } else uea_info(usb, "loading firmware %s\n", fw_name); return ret; -- 2.43.0