From nobody Thu Oct 2 15:32:59 2025 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AD8F62EC092 for ; Tue, 16 Sep 2025 08:21:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758010911; cv=none; b=mxK8cCuwhJlLsYXsmHTcwApF+grYzsuzJ3meMa9qCmvK7BW6DVDr9CRC0JJaIqqM97zuBV2LNfgF2Qi+oAQ3cIJy82lhmcY9PRwmXCCQFF6xh+9/WZHTfXi4A2u907LFSBUvtlhHl+7ablVACxTCzPUCWe/zwNvQYCFjAnezdrk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758010911; c=relaxed/simple; bh=nzUJUBQUDY6IjnlDTIkln8mW+kfgV5L3cPxxckekh/M=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=vGVeyvlBwplTz3AVv6jbXfEIAHZGW1pe5nKjP7ORYfe35yJUyaTwy7m+kVYY8HkpGWwh9S2jKme1NOwg6CIVSv6M48vzh4GVg6mqpbnqtdE4lpeR+cjaVW7NnkPQnTq3E9Z8pdheilH2uydiiUAll2wprXfBeX7/rUXTXFGSn6Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=pSnccMmS; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="pSnccMmS" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-244581ce13aso106261435ad.2 for ; Tue, 16 Sep 2025 01:21:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1758010909; x=1758615709; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=T6KEyWg5U4Q05BuxI9yT5T5sEUrMlo9n5Xv8LbVudls=; b=pSnccMmSFgskPzC1X2TP9RAOk58y6jbkpwX551tK6OOLCz9Wd/ZP2vlP2vtc5ZrqeB xBiyk7NGfw0d9VggVi/a3Er488Fmag5d9hm7s5eB+jv/lRlahrV5WtM98smL1F4+cG1M ktojoDC6ePGYdwj4e58EH+s70C3xZR279cogbjVueRtMDlDEN/YiUDHYIZ/N6K9TASch /RFc0V6clD4pZBSOGqVXNNayYmXkSGWPFI0dxMk2XSaYWbQO2wieHWWPsgpRIJVX0FSP DP6Q8WBGEiaSOLlfB6pC8UvSy0Cc57pU42GmKeHt2BfReAVJgpK613O0uDj+8ydhHcSN B1sQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758010909; x=1758615709; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=T6KEyWg5U4Q05BuxI9yT5T5sEUrMlo9n5Xv8LbVudls=; b=IAzY3NTCra9KtcJ+ErZtJCTAuh7zcPpTJjWtBh3mvu3zaVnWs8m9FIntY41FmVQ9WZ VXeCMCdfvruzOGU74yY+0+1RWKQRnf6nCMUV4LFxGinXSfv9L9iUAy1YKlmMWlkXE8Am mGaISh/LLf30SJ5kZdM6S2E7lxJ8b9bjr5iKDhPvGOqPoJXowVGowGcwsMuskLfcFDdU IZZO9/sjVhS7g2m69xgQN4HmLWq/z85zuLEbjwgse/Nzk39kYg2MzzZWm8PdAdunBNNs XaVD1xMZjvTFtPuiE3ByyqmYD2C1fwcRH83jM3Mc1Xn7nQlLiF3RxTiqXALvdj4PQ1f+ W4Rg== X-Forwarded-Encrypted: i=1; AJvYcCXEHSqIWRHy/DvfmA9ghn2FlCPejLba8IgjEiSkaEAzoLKNdb96vWZ93bfsCOJEzHtU/aNLnjqu9hl2PFc=@vger.kernel.org X-Gm-Message-State: AOJu0Yztwm5N0GNCsyweWSwIRSWBA127bLYRSAnwnRBvpICR6IyTvdQu VprGLbBDN3Rq5HFvbC8PSJT1I1zaDun7ywZj6Pfi7tp4qAPbBPhQy2cNu1FgCDMe3rYf8JLRPug 8jsQ5GQ== X-Google-Smtp-Source: AGHT+IFQoROC6DO6NsAcnx7lNpGk7R8oDG7xj1iNrSLy1+m6NH3iLLjA9tVJeTEuD+rPSe8yUuz1smsBOoY= X-Received: from plgi5.prod.google.com ([2002:a17:902:cf05:b0:267:e3c2:182d]) (user=khtsai job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:478d:b0:265:acc3:d312 with SMTP id d9443c01a7336-265acc3d46bmr93071495ad.43.1758010909064; Tue, 16 Sep 2025 01:21:49 -0700 (PDT) Date: Tue, 16 Sep 2025 16:21:36 +0800 In-Reply-To: <20250916-ready-v1-0-4997bf277548@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250916-ready-v1-0-4997bf277548@google.com> X-Developer-Key: i=khtsai@google.com; a=ed25519; pk=abA4Pw6dY2ZufSbSXW9mtp7xiv1AVPtgRhCFWJSEqLE= X-Developer-Signature: v=1; a=ed25519-sha256; t=1758010894; l=4610; i=khtsai@google.com; s=20250916; h=from:subject:message-id; bh=nzUJUBQUDY6IjnlDTIkln8mW+kfgV5L3cPxxckekh/M=; b=FXplXMMjNF7hhFe9P3At0BZbxF/fa0xizJlEnR67dc3Hlb3Kd/sDpeo2ok4ItCJryANkscJ+R 9ims8ubyAQPDYyR6h2TCbWnOU3BV3ZCVOpBOFygIqtvugLG5UkK738s X-Mailer: b4 0.14.2 Message-ID: <20250916-ready-v1-5-4997bf277548@google.com> Subject: [PATCH 5/6] usb: gadget: f_ecm: Refactor bind path to use __free() From: Kuen-Han Tsai To: Greg Kroah-Hartman , David Brownell , Nam Cao , Zack Rusin , Krzysztof Kozlowski , Prashanth K , Thinh Nguyen , John Keeping , Roy Luo Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Kuen-Han Tsai , stable@kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request. Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism. Fixes: da741b8c56d6 ("usb ethernet gadget: split CDC Ethernet function") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai --- drivers/usb/gadget/function/f_ecm.c | 48 ++++++++++++++++-----------------= ---- 1 file changed, 20 insertions(+), 28 deletions(-) diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/funct= ion/f_ecm.c index 027226325039f0c8eaee27a339513a758c01786b..675d2bc538a45747de601b0fcf2= b7b8757642214 100644 --- a/drivers/usb/gadget/function/f_ecm.c +++ b/drivers/usb/gadget/function/f_ecm.c @@ -8,6 +8,7 @@ =20 /* #define VERBOSE_DEBUG */ =20 +#include #include #include #include @@ -15,6 +16,8 @@ #include #include =20 +#include + #include "u_ether.h" #include "u_ether_configfs.h" #include "u_ecm.h" @@ -678,6 +681,7 @@ ecm_bind(struct usb_configuration *c, struct usb_functi= on *f) struct usb_ep *ep; =20 struct f_ecm_opts *ecm_opts; + struct usb_request *request __free(free_usb_request) =3D NULL; =20 if (!can_support_ecm(cdev->gadget)) return -EINVAL; @@ -711,7 +715,7 @@ ecm_bind(struct usb_configuration *c, struct usb_functi= on *f) /* allocate instance-specific interface IDs */ status =3D usb_interface_id(c, f); if (status < 0) - goto fail; + return status; ecm->ctrl_id =3D status; ecm_iad_descriptor.bFirstInterface =3D status; =20 @@ -720,24 +724,22 @@ ecm_bind(struct usb_configuration *c, struct usb_func= tion *f) =20 status =3D usb_interface_id(c, f); if (status < 0) - goto fail; + return status; ecm->data_id =3D status; =20 ecm_data_nop_intf.bInterfaceNumber =3D status; ecm_data_intf.bInterfaceNumber =3D status; ecm_union_desc.bSlaveInterface0 =3D status; =20 - status =3D -ENODEV; - /* allocate instance-specific endpoints */ ep =3D usb_ep_autoconfig(cdev->gadget, &fs_ecm_in_desc); if (!ep) - goto fail; + return -ENODEV; ecm->port.in_ep =3D ep; =20 ep =3D usb_ep_autoconfig(cdev->gadget, &fs_ecm_out_desc); if (!ep) - goto fail; + return -ENODEV; ecm->port.out_ep =3D ep; =20 /* NOTE: a status/notification endpoint is *OPTIONAL* but we @@ -746,20 +748,18 @@ ecm_bind(struct usb_configuration *c, struct usb_func= tion *f) */ ep =3D usb_ep_autoconfig(cdev->gadget, &fs_ecm_notify_desc); if (!ep) - goto fail; + return -ENODEV; ecm->notify =3D ep; =20 - status =3D -ENOMEM; - /* allocate notification request and buffer */ - ecm->notify_req =3D usb_ep_alloc_request(ep, GFP_KERNEL); - if (!ecm->notify_req) - goto fail; - ecm->notify_req->buf =3D kmalloc(ECM_STATUS_BYTECOUNT, GFP_KERNEL); - if (!ecm->notify_req->buf) - goto fail; - ecm->notify_req->context =3D ecm; - ecm->notify_req->complete =3D ecm_notify_complete; + request =3D usb_ep_alloc_request(ep, GFP_KERNEL); + if (!request) + return -ENOMEM; + request->buf =3D kmalloc(ECM_STATUS_BYTECOUNT, GFP_KERNEL); + if (!request->buf) + return -ENOMEM; + request->context =3D ecm; + request->complete =3D ecm_notify_complete; =20 /* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at @@ -778,7 +778,7 @@ ecm_bind(struct usb_configuration *c, struct usb_functi= on *f) status =3D usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function, ecm_ss_function, ecm_ss_function); if (status) - goto fail; + return status; =20 /* NOTE: all that is done without knowing or caring about * the network link ... which is unavailable to this code @@ -788,20 +788,12 @@ ecm_bind(struct usb_configuration *c, struct usb_func= tion *f) ecm->port.open =3D ecm_open; ecm->port.close =3D ecm_close; =20 + ecm->notify_req =3D no_free_ptr(request); + DBG(cdev, "CDC Ethernet: IN/%s OUT/%s NOTIFY/%s\n", ecm->port.in_ep->name, ecm->port.out_ep->name, ecm->notify->name); return 0; - -fail: - if (ecm->notify_req) { - kfree(ecm->notify_req->buf); - usb_ep_free_request(ecm->notify, ecm->notify_req); - } - - ERROR(cdev, "%s: can't bind, err %d\n", f->name, status); - - return status; } =20 static inline struct f_ecm_opts *to_f_ecm_opts(struct config_item *item) --=20 2.51.0.384.g4c02a37b29-goog