From nobody Thu Oct 2 15:33:01 2025 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B53B32EBDDE for ; Tue, 16 Sep 2025 08:21:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758010909; cv=none; b=dtCcglgdg39Mz440OOjwH29BDTln2AuLBQK3hBZ0n7MVl4dTlJ1B9kfqph00iwqdJGc+mvdj2a8368J0vkLE0N+74LUEi6ULJRVy8YWfDCJFvG7Zga6ggW/t7lWiHUB/LVWqyGFZxA05sR9Jkq13ekhLNij0OkhD6s2DX0At9vk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758010909; c=relaxed/simple; bh=P1LfRxrcrGhzoZEKvZbzrpnaEprQNC1g8Qth+X5e6xs=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=XrjdImf6NM+PligozyTmE6Xz+KvqFogxBePtCjFYGrGnaVNMxwPfXzkg39Qe8NweGqTi83Mm/LHLVCYNkBT3Lv7O2IvcOLHx64O/i8z++3niUUA+91GaIxwLRT+vZNyqjw2GfjEmIN7UKCnaH7ypERYRMMNkIw3SsBBs9+NydmY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=UyKAjIU3; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="UyKAjIU3" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-77619bb3871so6049724b3a.1 for ; Tue, 16 Sep 2025 01:21:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1758010907; x=1758615707; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=DG760754b6pvLc5Zdigx6UGTSLqlU0NzUMtufzKH57g=; b=UyKAjIU3UwUpki3+ebEWxbcOIlPl/Yd6bSm0y+uOOO2VCUXgxbOizehaANb1sLGYkf fLNjn2sVy6s/zpgIeUBhuRr+4WASzZSHgjnGANyLTZLeh2tyD/eOw3/yqgeUh/h6K4f1 G1JzyhTjbQaZqVsnL4QhBOq0B3UuKSH5JMtnWJjY3mMzFIj0kGHCBJbPoLJyxCUZVJAV o4bJhHl2Uep1naFVKEao/1EjdVZqiwZs9e60iVJj1vYheUPxyn4y17imSney3S0vFwfB mb3M+FtY/p2ToDD7tewVHpfHr4JgDEgUkDMYZSAg3GX3yW5Fcb67Zf1j+jE0NK23qWCE XrVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758010907; x=1758615707; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=DG760754b6pvLc5Zdigx6UGTSLqlU0NzUMtufzKH57g=; b=ZqgIVeyYARg8XOX14DeHehBr5fnoz2Fo0nwT81TLE4he1oGW3qEgQSi2pesEj+7r0N UTO9JfsF5M9XWVF2ZH7NFsv83PMjVkhW7uqkyt6cJYevtaMGiU+lpeOOTuJ6XunDI93c enpcCZYNCDR7SssOI38vO0U7bZUxihO4cz/DY0YdYCwZvmemvHUy0BACCcDtMkEfv5C1 Zag68rFbs6cZdrYImkcIgPT8r+Y0F/C8oYWoFS/1s7hM6ww8XMcreXY3/zAmnkm0GXXM LwnzlLNef5aFAqRfCo+Z8cxGUqoNw+gLVbsO/hbQ63CJlXwafxMwgsv5w/VtR/yiF8XW ZAjA== X-Forwarded-Encrypted: i=1; AJvYcCVVjw9rkXgkhSzjX2qRe4Uj8Odup4feZFwn2sAZRBD79bpwRXG2qur5jKWtB9UrFTEmWZoYZjiXRQKE7qs=@vger.kernel.org X-Gm-Message-State: AOJu0YyPNaH/RVx4m5QWInoVA2Y3R8Zqa0WhJx1JoBrDKL7ntYRFb8iB rMuqeTJHyXhbOm65QlfJM0OchnNx368wj44GAjhNcr2K563v3em05f6uSnhOqUhVLM6TfHA3xBO encijvQ== X-Google-Smtp-Source: AGHT+IE/0Vv546PDeVtNiWrkwmA+p4ogC/9GnEu3AVLh9mD580agcG1I3jbi197WFqLLkWttRZiWdsxHsQE= X-Received: from pfbft4.prod.google.com ([2002:a05:6a00:81c4:b0:776:130f:e189]) (user=khtsai job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:1708:b0:76e:8cf4:7bc4 with SMTP id d2e1a72fcca58-7761218c807mr17784493b3a.26.1758010906973; Tue, 16 Sep 2025 01:21:46 -0700 (PDT) Date: Tue, 16 Sep 2025 16:21:35 +0800 In-Reply-To: <20250916-ready-v1-0-4997bf277548@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250916-ready-v1-0-4997bf277548@google.com> X-Developer-Key: i=khtsai@google.com; a=ed25519; pk=abA4Pw6dY2ZufSbSXW9mtp7xiv1AVPtgRhCFWJSEqLE= X-Developer-Signature: v=1; a=ed25519-sha256; t=1758010894; l=4996; i=khtsai@google.com; s=20250916; h=from:subject:message-id; bh=P1LfRxrcrGhzoZEKvZbzrpnaEprQNC1g8Qth+X5e6xs=; b=ngT80pto5NMDDKcMxDtTWqjfpJrj74zFXpjGVXpoFlYPvuJUmGwrlyJslN0GVGqt1N1O+klY7 JS8hsEnrmNgA3QsBlF3dSrOIkwmCg1Ls7FD2ntSq3776GW2bkJ80wgQ X-Mailer: b4 0.14.2 Message-ID: <20250916-ready-v1-4-4997bf277548@google.com> Subject: [PATCH 4/6] usb: gadget: f_acm: Refactor bind path to use __free() From: Kuen-Han Tsai To: Greg Kroah-Hartman , David Brownell , Nam Cao , Zack Rusin , Krzysztof Kozlowski , Prashanth K , Thinh Nguyen , John Keeping , Roy Luo Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Kuen-Han Tsai , stable@kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Unable to handle kernel NULL pointer dereference at virtual address 0000000= 000000020 Call trace: usb_ep_free_request+0x2c/0xec gs_free_req+0x30/0x44 acm_bind+0x1b8/0x1f4 usb_add_function+0xcc/0x1f0 configfs_composite_bind+0x468/0x588 gadget_bind_driver+0x104/0x270 really_probe+0x190/0x374 __driver_probe_device+0xa0/0x12c driver_probe_device+0x3c/0x218 __device_attach_driver+0x14c/0x188 bus_for_each_drv+0x10c/0x168 __device_attach+0xfc/0x198 device_initial_probe+0x14/0x24 bus_probe_device+0x94/0x11c device_add+0x268/0x48c usb_add_gadget+0x198/0x28c dwc3_gadget_init+0x700/0x858 __dwc3_set_mode+0x3cc/0x664 process_scheduled_works+0x1d8/0x488 worker_thread+0x244/0x334 kthread+0x114/0x1bc ret_from_fork+0x10/0x20 Fixes: 1f1ba11b6494 ("usb gadget: issue notifications from ACM function") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai --- drivers/usb/gadget/function/f_acm.c | 42 +++++++++++++++++----------------= ---- 1 file changed, 19 insertions(+), 23 deletions(-) diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/funct= ion/f_acm.c index 7061720b9732e4182b02ac3523d49c8e053176b7..106046e17c4e11253e325789904= 2ab803f3f2657 100644 --- a/drivers/usb/gadget/function/f_acm.c +++ b/drivers/usb/gadget/function/f_acm.c @@ -11,12 +11,15 @@ =20 /* #define VERBOSE_DEBUG */ =20 +#include #include #include #include #include #include =20 +#include + #include "u_serial.h" =20 =20 @@ -613,6 +616,7 @@ acm_bind(struct usb_configuration *c, struct usb_functi= on *f) struct usb_string *us; int status; struct usb_ep *ep; + struct usb_request *request __free(free_usb_request) =3D NULL; =20 /* REVISIT might want instance-specific strings to help * distinguish instances ... @@ -630,7 +634,7 @@ acm_bind(struct usb_configuration *c, struct usb_functi= on *f) /* allocate instance-specific interface IDs, and patch descriptors */ status =3D usb_interface_id(c, f); if (status < 0) - goto fail; + return status; acm->ctrl_id =3D status; acm_iad_descriptor.bFirstInterface =3D status; =20 @@ -639,43 +643,41 @@ acm_bind(struct usb_configuration *c, struct usb_func= tion *f) =20 status =3D usb_interface_id(c, f); if (status < 0) - goto fail; + return status; acm->data_id =3D status; =20 acm_data_interface_desc.bInterfaceNumber =3D status; acm_union_desc.bSlaveInterface0 =3D status; acm_call_mgmt_descriptor.bDataInterface =3D status; =20 - status =3D -ENODEV; - /* allocate instance-specific endpoints */ ep =3D usb_ep_autoconfig(cdev->gadget, &acm_fs_in_desc); if (!ep) - goto fail; + return -ENODEV; acm->port.in =3D ep; =20 ep =3D usb_ep_autoconfig(cdev->gadget, &acm_fs_out_desc); if (!ep) - goto fail; + return -ENODEV; acm->port.out =3D ep; =20 ep =3D usb_ep_autoconfig(cdev->gadget, &acm_fs_notify_desc); if (!ep) - goto fail; + return -ENODEV; acm->notify =3D ep; =20 acm_iad_descriptor.bFunctionProtocol =3D acm->bInterfaceProtocol; acm_control_interface_desc.bInterfaceProtocol =3D acm->bInterfaceProtocol; =20 /* allocate notification */ - acm->notify_req =3D gs_alloc_req(ep, - sizeof(struct usb_cdc_notification) + 2, - GFP_KERNEL); - if (!acm->notify_req) - goto fail; + request =3D gs_alloc_req(ep, + sizeof(struct usb_cdc_notification) + 2, + GFP_KERNEL); + if (!request) + return -ENODEV; =20 - acm->notify_req->complete =3D acm_cdc_notify_complete; - acm->notify_req->context =3D acm; + request->complete =3D acm_cdc_notify_complete; + request->context =3D acm; =20 /* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at @@ -692,7 +694,9 @@ acm_bind(struct usb_configuration *c, struct usb_functi= on *f) status =3D usb_assign_descriptors(f, acm_fs_function, acm_hs_function, acm_ss_function, acm_ss_function); if (status) - goto fail; + return status; + + acm->notify_req =3D no_free_ptr(request); =20 dev_dbg(&cdev->gadget->dev, "acm ttyGS%d: IN/%s OUT/%s NOTIFY/%s\n", @@ -700,14 +704,6 @@ acm_bind(struct usb_configuration *c, struct usb_funct= ion *f) acm->port.in->name, acm->port.out->name, acm->notify->name); return 0; - -fail: - if (acm->notify_req) - gs_free_req(acm->notify, acm->notify_req); - - ERROR(cdev, "%s/%p: can't bind, err %d\n", f->name, f, status); - - return status; } =20 static void acm_unbind(struct usb_configuration *c, struct usb_function *f) --=20 2.51.0.384.g4c02a37b29-goog