From patchwork Mon Jan 18 08:46:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jerome Brunet X-Patchwork-Id: 365488 Delivered-To: patch@linaro.org Received: by 2002:a02:ccad:0:0:0:0:0 with SMTP id t13csp2060458jap; Mon, 18 Jan 2021 00:49:17 -0800 (PST) X-Google-Smtp-Source: ABdhPJwc80dNztrIgYqJvatKC1ZFVbacyl+/Gc68s1KsXogezJo1RcQ7W5i2VDFMkPR6eTPmxTZ1 X-Received: by 2002:aa7:d386:: with SMTP id x6mr223491edq.194.1610959757689; Mon, 18 Jan 2021 00:49:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1610959757; cv=none; d=google.com; s=arc-20160816; b=Y6AGPxoizEUD+DZ2HEoaH91QKHVhFpM2uoRMYMLK6vr8NBtwkBtT2d2bCNFZ7Jkjbq 1tvfIuIsttgZ1tDA6Vv9Zg7ghvBLXcWenUqbKOulWTruABvmjtxUwjaab4org5eaGyTv vq1kVQVtOQgFyskSudp7A+04P46j3wdv7N3gvIkkT7ZwAT8seIaWdbJi4xql8cWjbV0K o67UnaR9fOZZfexzKUPhsSAa1sbWBxjz6bSLB1ADt5wWWuD9YCpVGm4YIKs0wda2eWwZ ik6mL+gdt2Mu8N+lNSocrwrNooFK8W9rhXC+TnUtrfj1JxlaThH5E9RZwqjM2/2Fa0H0 UtVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=OyQZB4rl5Zar0wRlUg3JZS81nsXMFf2BksOtPVpSskk=; b=uKDYVPQgw7H3dfPPweZtk2lwKXBc3QeYkxG3vNVrWlyHSXf5yzLM5HEZGAD860zuw4 Vy3W85mQw/qtXYuM3hKhsXxF1zzXKOAFsFkgXJm5W6gUJM/bTRoTAWh+NOsLox6lJa/A epV5QxXfZ/XdZoOx6BlOSJlzcXZBJRd++QkCQ9zwC4uB2Kb62lBo3/1UAA7YKX/QCZUv fG98cFDOumOM1NE1E77CnJ83qrNGICFqWDj3mW+iMB5DmSblg5nznwOC8rdCwI47/s1g 5OLu7tN/P1GyC3U/KnS06D10QR+du2Ub4kVR1uLt3boQ2RiLJUr0hBtkmV8CSbCnGHNF vZhA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@baylibre-com.20150623.gappssmtp.com header.s=20150623 header.b=1eDIvqm2; spf=pass (google.com: domain of linux-usb-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-usb-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id t14si7889997edd.161.2021.01.18.00.49.17; Mon, 18 Jan 2021 00:49:17 -0800 (PST) Received-SPF: pass (google.com: domain of linux-usb-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@baylibre-com.20150623.gappssmtp.com header.s=20150623 header.b=1eDIvqm2; spf=pass (google.com: domain of linux-usb-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-usb-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387927AbhARIsN (ORCPT + 3 others); Mon, 18 Jan 2021 03:48:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36906 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387859AbhARIrp (ORCPT ); Mon, 18 Jan 2021 03:47:45 -0500 Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4884BC061757 for ; Mon, 18 Jan 2021 00:47:04 -0800 (PST) Received: by mail-wr1-x42f.google.com with SMTP id y17so15583722wrr.10 for ; Mon, 18 Jan 2021 00:47:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baylibre-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=OyQZB4rl5Zar0wRlUg3JZS81nsXMFf2BksOtPVpSskk=; b=1eDIvqm2DYBQvrlEqrZOdoWFbDIRO661ivbAjhUrNDhelTRzl7byhn20hOJ85oJkbL b7zrCpvOOaWz6/ecVYNyQ9+YN9D55OrwQgAjzIWATqfremCD8/lk8X6iMYKtdaGnvSpb m+eLJP37fOXg5Z0WUwwbqFmRw748VjyEYfp7ApQHwSF41krg9wAExURz+5ScqvdOk4mg WzRgr/PPaFcn8eUOi8Mq95V0H/jF4fvilivYDzZ1uZurTW9RNtjk+3d23p/fsUcPaqGC ZzchM2EtTLBQOpYSu5VimxKpLNG042e1NYdZb7kDM3Zlw5rxjQmIwQVl4Z05XVJB7vZB xujQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=OyQZB4rl5Zar0wRlUg3JZS81nsXMFf2BksOtPVpSskk=; b=B0A7B5hxR6UoLxCxOTsAccCoB5qGtuQ3sbm3Pui4tYHmodyDgOKk3Kx/gJtZ6wLoKM IJFwKZH8HJEb8WJsF0+0SiKfzNXL907gAAEcLMG4Gxf439Gj+kjy6jKhcga5Lqvml+yA JUe7tnccCmXRVA3QMDEWMfMj4qGJt8hHDr7fZyymczHxzTBsSG3VC+JOMVu7+r/7JFp1 jHFU/adv2gvNWv+4vACvPt+9nGSoXsucNVA7hrzBb5eUE/paJODqeqlySOa4suYGSuaC f27Wd3QCSy80xA48NTBD1u0Ni8b4STx9+uSi1e4JHBzluYIH6VCiih+mLzvrFbVeEbiQ vhVA== X-Gm-Message-State: AOAM530o0UAzOcY7/mOO/ppTUeEbfZQ6cZfw74CIKDDffGwbGON7jlRZ 91FMZYtSzEIyWLHMgiBnPaF3Pg== X-Received: by 2002:a5d:6cd4:: with SMTP id c20mr24712137wrc.57.1610959622969; Mon, 18 Jan 2021 00:47:02 -0800 (PST) Received: from starbuck.lan (82-65-169-74.subs.proxad.net. [82.65.169.74]) by smtp.googlemail.com with ESMTPSA id y63sm26224518wmd.21.2021.01.18.00.47.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Jan 2021 00:47:02 -0800 (PST) From: Jerome Brunet To: Felipe Balbi , Greg Kroah-Hartman Cc: Jack Pham , Ruslan Bilovol , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Ferry Toth , Peter Chen , Jerome Brunet Subject: [PATCH v3 1/4] usb: gadget: u_audio: Free requests only after callback Date: Mon, 18 Jan 2021 09:46:39 +0100 Message-Id: <20210118084642.322510-2-jbrunet@baylibre.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20210118084642.322510-1-jbrunet@baylibre.com> References: <20210118084642.322510-1-jbrunet@baylibre.com> MIME-Version: 1.0 X-Patchwork-Bot: notify Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org From: Jack Pham As per the kernel doc for usb_ep_dequeue(), it states that "this routine is asynchronous, that is, it may return before the completion routine runs". And indeed since v5.0 the dwc3 gadget driver updated its behavior to place dequeued requests on to a cancelled list to be given back later after the endpoint is stopped. The free_ep() was incorrectly assuming that a request was ready to be freed after calling dequeue which results in a use-after-free in dwc3 when it traverses its cancelled list. Fix this by moving the usb_ep_free_request() call to the callback itself in case the ep is disabled. Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core") Reported-and-tested-by: Ferry Toth Reviewed-and-tested-by: Peter Chen Signed-off-by: Jack Pham Signed-off-by: Jerome Brunet Acked-by: Felipe Balbi --- drivers/usb/gadget/function/u_audio.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) -- 2.29.2 diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c index e6d32c536781..908e49dafd62 100644 --- a/drivers/usb/gadget/function/u_audio.c +++ b/drivers/usb/gadget/function/u_audio.c @@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req) struct snd_uac_chip *uac = prm->uac; /* i/f shutting down */ - if (!prm->ep_enabled || req->status == -ESHUTDOWN) + if (!prm->ep_enabled) { + usb_ep_free_request(ep, req); + return; + } + + if (req->status == -ESHUTDOWN) return; /* @@ -336,8 +341,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) for (i = 0; i < params->req_number; i++) { if (prm->ureq[i].req) { - usb_ep_dequeue(ep, prm->ureq[i].req); - usb_ep_free_request(ep, prm->ureq[i].req); + if (usb_ep_dequeue(ep, prm->ureq[i].req)) + usb_ep_free_request(ep, prm->ureq[i].req); + /* + * If usb_ep_dequeue() cannot successfully dequeue the + * request, the request will be freed by the completion + * callback. + */ + prm->ureq[i].req = NULL; } }