From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 96D4E2D6E4B; Fri, 27 Mar 2026 10:52:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774608740; cv=none; b=kiBjSFEhJd0aFoDIRBchJshmfTS6DHVh+/OFJGhDwj1dVSSCMRUgFH8ofg/0D6rQME9vZqypj17E7q+OL0m+zGiJtqPlSauUrGASHwkbO2GyrcoiGnvoB0yKcmPIS1z+cZAtCMPAVa9Pvcqp7fAGTTnGOFp6m7ra6OtBjyp5Kew= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774608740; c=relaxed/simple; bh=hZguq+lW6Mv0r3bUzKtQ4MnIraUe40XJWt/lVIf2SMg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MrS/KQZStP/9toCTolN7wkHaIQKJdYdr/KsiMoz7cRTTprmWLx6LkP9UvXPzaSkoqpP3qInXigdU+z83uYZdBmXePFlz+Rit4dE7AAz7apjJ/maM2g4k8MmEg7e9RgdCnOFACf+eBFd5XkSWvr8n+AmJqryrNWE8B8yk0fkZldU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=srcb3oS0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="srcb3oS0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6458BC2BCB2; Fri, 27 Mar 2026 10:52:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774608740; bh=hZguq+lW6Mv0r3bUzKtQ4MnIraUe40XJWt/lVIf2SMg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=srcb3oS0Y2YWqiUl4Be8vlaWc4AX4yJQ8DyiQ7ke6yiWc1CTaZ8h2ebpMotDCyih8 XuOO6XiHn9N3wioHqWS31yBkNYds4upF5SBIOqXEZEBwlvTQ16/I8JrLfxxvFKfFnN 8wrz8r/ObZziD9Ytog/sCQEJbHSooNTS4X1pM3u+Z4nE5tp2NwjK5D7HXe9x6Jmu2r YVl4YqqLDkDN9kJ6/6mNzLACnjE3f2THQwCQjDRvs+gxG/g69WTgT0otzi5NpsxxVo 3441c7Zyh66BHiPGJu48xQV+ciNgUVrt+QVeXvEGm3lKEKeQxOa3pg4wnOw7YNDNqP Z9Ku50wXAud9g== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w64na-00000005UzW-16hm; Fri, 27 Mar 2026 11:52:18 +0100 From: Johan Hovold To: Ulf Hansson Cc: linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Binbin Zhou Subject: [PATCH 2/4] mmc: vub300: fix use-after-free on disconnect Date: Fri, 27 Mar 2026 11:52:06 +0100 Message-ID: <20260327105208.1310739-3-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260327105208.1310739-1-johan@kernel.org> References: <20260327105208.1310739-1-johan@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The vub300 driver maintains an explicit reference count for the controller and its driver data and the last reference can in theory be dropped after the driver has been unbound. This specifically means that the controller allocation must not be device managed as that can lead to use-after-free. Note that the lifetime is currently also incorrectly tied the parent USB device rather than interface, which can lead to memory leaks if the driver is unbound without its device being physically disconnected (e.g. on probe deferral). Fix both issues by reverting to non-managed allocation of the controller. Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper") Cc: stable@vger.kernel.org # 6.17 Cc: Binbin Zhou Signed-off-by: Johan Hovold --- drivers/mmc/host/vub300.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c index f173c7cf4e1a..3c9df27f9fa7 100644 --- a/drivers/mmc/host/vub300.c +++ b/drivers/mmc/host/vub300.c @@ -369,11 +369,14 @@ struct vub300_mmc_host { static void vub300_delete(struct kref *kref) { /* kref callback - softirq */ struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref); + struct mmc_host *mmc = vub300->mmc; + usb_free_urb(vub300->command_out_urb); vub300->command_out_urb = NULL; usb_free_urb(vub300->command_res_urb); vub300->command_res_urb = NULL; usb_put_dev(vub300->udev); + mmc_free_host(mmc); /* * and hence also frees vub300 * which is contained at the end of struct mmc @@ -2112,7 +2115,7 @@ static int vub300_probe(struct usb_interface *interface, goto error1; } /* this also allocates memory for our VUB300 mmc host device */ - mmc = devm_mmc_alloc_host(&udev->dev, sizeof(*vub300)); + mmc = mmc_alloc_host(sizeof(*vub300), &udev->dev); if (!mmc) { retval = -ENOMEM; dev_err(&udev->dev, "not enough memory for the mmc_host\n"); @@ -2269,7 +2272,7 @@ static int vub300_probe(struct usb_interface *interface, dev_err(&vub300->udev->dev, "Could not find two sets of bulk-in/out endpoint pairs\n"); retval = -EINVAL; - goto error4; + goto err_free_host; } retval = usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0), @@ -2278,14 +2281,14 @@ static int vub300_probe(struct usb_interface *interface, 0x0000, 0x0000, &vub300->hc_info, sizeof(vub300->hc_info), 1000); if (retval < 0) - goto error4; + goto err_free_host; retval = usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), SET_ROM_WAIT_STATES, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, firmware_rom_wait_states, 0x0000, NULL, 0, 1000); if (retval < 0) - goto error4; + goto err_free_host; dev_info(&vub300->udev->dev, "operating_mode = %s %s %d MHz %s %d byte USB packets\n", (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL", @@ -2300,7 +2303,7 @@ static int vub300_probe(struct usb_interface *interface, 0x0000, 0x0000, &vub300->system_port_status, sizeof(vub300->system_port_status), 1000); if (retval < 0) { - goto error4; + goto err_free_host; } else if (sizeof(vub300->system_port_status) == retval) { vub300->card_present = (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0; @@ -2308,7 +2311,7 @@ static int vub300_probe(struct usb_interface *interface, (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0; } else { retval = -EINVAL; - goto error4; + goto err_free_host; } usb_set_intfdata(interface, vub300); INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread); @@ -2338,6 +2341,8 @@ static int vub300_probe(struct usb_interface *interface, return 0; error6: timer_delete_sync(&vub300->inactivity_timer); +err_free_host: + mmc_free_host(mmc); /* * and hence also frees vub300 * which is contained at the end of struct mmc -- 2.52.0