Re: [PATCH v2] usb: gadget: f_uac1_legacy: fix use-after-free in gaudio_open_snd_dev()

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, May 24, 2026 at 11:33:21PM -0500, Adrian Korwel wrote:
> Three bugs exist in this driver related to ALSA device file lifetime:
> 
> 1. gaudio_open_snd_dev() opens the ALSA control file first, then the
>    PCM playback file. If filp_open() for playback fails, the function
>    returns without closing the already-opened control file handle.
> 
> 2. playback_default_hw_params() return value was ignored. If it fails,
>    both the control and playback file handles are leaked, causing
>    gaudio_cleanup() to call filp_close() on already-freed file objects.
> 
> 3. f_audio_bind() guards gaudio_setup() with an 'audio_opts->bound'
>    flag to prevent re-initialization, but the fail: error path
>    unconditionally calls gaudio_cleanup(). On repeated bind attempts
>    after failure, this closes file handles that were opened in a
>    previous bind invocation and already freed by RCU, causing a
>    use-after-free detected by KASAN:
> 
>    BUG: KASAN: slab-use-after-free in filp_flush+0x23/0x1b0
>    Read of size 8 at addr ffff88810d5523a8 by task bash/306
>    ...
>    gaudio_cleanup+0x59/0x100
>    f_audio_bind+0x4b0/0x590
> 
> Fix all three issues:
> - Close already-opened file handles on each error path in
>   gaudio_open_snd_dev().
> - Check and propagate the return value of playback_default_hw_params().
> - Remove the 'bound' guard and call gaudio_setup() unconditionally in
>   f_audio_bind(), making setup and cleanup a matched pair within each
>   bind invocation. Remove the now-unused 'bound' field from the opts
>   struct.

Why is this not broken up into smaller patches to corrispond with each
issue/fix?  Please do so.


> 
> Additionally, f_audio_disable() was an empty stub. Add
> cancel_work_sync() to ensure the playback work item is not in flight
> when the function is unbound and the audio struct is freed.
> 
> Changes since v1:
> - Added removal of the 'bound' guard in f_audio_bind() which was the
>   root cause of the repeated-bind UAF
> - Added cancel_work_sync() to f_audio_disable()
> - Removed now-unused 'bound' field from struct f_uac1_legacy_opts

The "changes" go below the --- line, right?

thanks,

greg k-h