From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54E207262A for ; Tue, 28 Jul 2026 03:26:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785209169; cv=none; b=KufYzIYU/40Ja/1fXwY7qRi8rHJY+550HNwBdNtqa1Mo2hTLGNGao+P8DtiMn7iawNiwsMjvw87CFj0RWlCQFJ28YaihA4XymfVnTa1xGUpiaCLLDiuN0sF6Rko+xYvUpaLVlWSIEVYuqkejF4Bwo3awo3NeDZxFJHv0FXYqvPg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785209169; c=relaxed/simple; bh=l+RDi4Nf11NV0S2Lhwd/DHfzETjTwNDOQePoAurUtPw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=E8Gg4IITfY16tQwbWitFwprKxbDIid/YC1Cu/22aOS4meS5XqyZJbsSO00dw0wfDsmJQC3JYhLXzOPbZfa8vic/TfmgbLjyWfbvc1pXCg2Bxj++VjKaldZYEC5Va/UThHKJAJCyQKeD5h4tt3I3C41DlTwkBKkQquhxGM8PqCxY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MqBG23O+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MqBG23O+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7AF391F000E9; Tue, 28 Jul 2026 03:26:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785209168; bh=NfA7ARe+UUuWzGJqrw2He9pqP65EzleulsAzPMLVYUc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MqBG23O+v4B9/g2m2NNog4mT/bHL6drVcoBQrNU7FmnnGE8nE/Yx9AUuO9S3q/1qs irwkoaVn1dPnk93zvxGPYKtlC+L0V1KORIDlhibyYTvclPfYYWzQ9rLKZ3MlalYpRV oRUFFPe8s6nsulx3f3PWprVvfh1r+nKHi2aKmf+cdzqSD+RcmL69GuJ/LBIw+0CCWM X/RzWfFs6JQH/ZavYYfT0ejZETVbb/qYYL52xDeY27X40nbauWYIjvA8hw6OpCMRYI kcAk/EoqKazt7OgicAcB4QS7x6u9X7IenBDGtYtVqDgeb5hIwdb+O9vUMILz830WNH 7uFyBhsWtk/0w== From: Sasha Levin To: stable@vger.kernel.org Cc: Johan Hovold , Binbin Zhou , Ulf Hansson Subject: [PATCH 5.10.y 1/3] mmc: vub300: fix use-after-free on disconnect Date: Mon, 27 Jul 2026 23:26:03 -0400 Message-ID: <20260728032605.3151542-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026072048-private-repackage-90f2@gregkh> References: <2026072048-private-repackage-90f2@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Johan Hovold The vub300 driver maintains an explicit reference count for the controller and its driver data and the last reference can in theory be dropped after the driver has been unbound. This specifically means that the controller allocation must not be device managed as that can lead to use-after-free. Note that the lifetime is currently also incorrectly tied the parent USB device rather than interface, which can lead to memory leaks if the driver is unbound without its device being physically disconnected (e.g. on probe deferral). Fix both issues by reverting to non-managed allocation of the controller. Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper") Cc: stable@vger.kernel.org # 6.17+ Cc: Binbin Zhou Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson (cherry picked from commit 8f4d20a710225ec7a565f6a0459862d3b1f32330) --- drivers/mmc/host/vub300.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c index 38024cc2d5e0fe..4000dc80f81af8 100644 --- a/drivers/mmc/host/vub300.c +++ b/drivers/mmc/host/vub300.c @@ -2281,7 +2281,7 @@ static int vub300_probe(struct usb_interface *interface, dev_err(&vub300->udev->dev, "Could not find two sets of bulk-in/out endpoint pairs\n"); retval = -EINVAL; - goto error5; + goto err_free_host; } retval = usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0), @@ -2290,14 +2290,14 @@ static int vub300_probe(struct usb_interface *interface, 0x0000, 0x0000, &vub300->hc_info, sizeof(vub300->hc_info), 1000); if (retval < 0) - goto error5; + goto err_free_host; retval = usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), SET_ROM_WAIT_STATES, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, firmware_rom_wait_states, 0x0000, NULL, 0, 1000); if (retval < 0) - goto error5; + goto err_free_host; dev_info(&vub300->udev->dev, "operating_mode = %s %s %d MHz %s %d byte USB packets\n", (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL", @@ -2312,7 +2312,7 @@ static int vub300_probe(struct usb_interface *interface, 0x0000, 0x0000, &vub300->system_port_status, sizeof(vub300->system_port_status), 1000); if (retval < 0) { - goto error5; + goto err_free_host; } else if (sizeof(vub300->system_port_status) == retval) { vub300->card_present = (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0; @@ -2320,7 +2320,7 @@ static int vub300_probe(struct usb_interface *interface, (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0; } else { retval = -EINVAL; - goto error5; + goto err_free_host; } usb_set_intfdata(interface, vub300); INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread); @@ -2350,7 +2350,7 @@ static int vub300_probe(struct usb_interface *interface, return 0; error6: del_timer_sync(&vub300->inactivity_timer); -error5: +err_free_host: mmc_free_host(mmc); /* * and hence also frees vub300 -- 2.53.0