From nobody Mon Jun 8 05:24:41 2026 Received: from mail-qk1-f180.google.com (mail-qk1-f180.google.com [209.85.222.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8981F37AA87 for ; Mon, 1 Jun 2026 20:16:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780345006; cv=none; b=qsRtC6ZBlEUufxhREb0ZtZumSuhjiPw1AsrSj/FzWkyPgAXjvr4yiHbLykn0vjvGq+4AVHAJXlzQG1knd8HPu/AdmSt4b3KhdiXt8yk/sLnTE8bucOqPdH7mF+ozMHKVfhpqNfvwqQa2lszSv5eJmemn2PgS3uCR1IFu15g/ZbQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780345006; c=relaxed/simple; bh=/EnxGHEeNEocOb+vZCdZEOodrWB95vFpILdqMyb7S4c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aAMvaVqcj4VCZ/dnQ12EqsZjP9O5B8ZXRFNXKt0POKEgjUgk/r84Geinb7yCiwRQsP91wXHNpBI+n/ctM2ml8WP4MjpwyQHoivmbBJUIQ1PWbCY6jAkhTPrWcuuoySWBA04TKySsGLTYIc4gJTx5/bFYnEO4fAF2gUd0l66RXnQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LTOGtOZ4; arc=none smtp.client-ip=209.85.222.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LTOGtOZ4" Received: by mail-qk1-f180.google.com with SMTP id af79cd13be357-91550eca866so270061385a.1 for ; Mon, 01 Jun 2026 13:16:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780345003; x=1780949803; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=CeR4WL59kTXKD/bHwazItpYL/nCmf40guV4oSdZazAQ=; b=LTOGtOZ4QW98BuL8T3j4II0Ayxrb8GqDHSJ73+r5e7pER/sgkSan8AIOLyrt+qG3zb cnM39P6pUJiJxvmkP+l4jdhv0HY6QKw3pXaykQuhJ28JxnHXjaPQJPH9SY1iXfXI4QTO IVYQch8sE+hOqCZ1w1u59eQATf4PPHz47z9PUCYLg9d6rop29+ncXd0N1D51F3UfsckJ 0dXme52BdDppwIIsJYOw796/MorO+F8z44+dhiLHvCM5Fjr/3KVgSeHNRpr62O8aQ+S+ NuDWdVmLMZyZcZorlaj/t6zCO5Z3m0xGpLcg7kSspcFoYN1IMVzo/HqhDovvPiK2Lgls 8HMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780345003; x=1780949803; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=CeR4WL59kTXKD/bHwazItpYL/nCmf40guV4oSdZazAQ=; b=KGvlyPRD3Que+xaaiJDyi9rxpYzoSEHeRctpUeTVAEONHyZqfW/A0GjfSh9V9jo+QF 6yPls9+MYDecI9fWM3HCmInLoi9J3R19WF75LiXNgEywnAGcmlvMHAr5A+ivtJYtaEoq o2NpgaJ4H0b2/YDLuT0DwzxCQo4i1vAxqWF2JQapePsp+Qdg1BI3/XINS0WQ+RScJkDW ndmJH4IlcLtsHgYAMFKOV9QH/R2iegDIY59WPMmdFaN56/Xz/6HzT2n5RgemMCJ8UwUk G0czqISGeqaowN27NS6MF4MULr/ksenHmUK8wUZv++HYq/MVq0H9fPGGehNFYfYfwhSW fDuA== X-Forwarded-Encrypted: i=1; AFNElJ990xcWsqswZctFBhU0UOlybFpgCYbCjdipir0IT2NmfC2VMrolZywnXXDZ5qfJJRO9Xoqof4PL6ezqESE=@vger.kernel.org X-Gm-Message-State: AOJu0YwVw2kGvdGfevDZLxOaVceX9N/cahGxPBHzLVm4yv/IZjQaFGtL 9bRxCpG94YXGRVyvHlk6sAjmklW9LLOX56RoYCinBjK0NKEHrLqjJZFZ X-Gm-Gg: Acq92OGu/X/M266IZ5VBlckHx0KocDxrEqP5/zfuoA/nfUC3isynmyXQ+Wxu+io11A0 62cxy9ra58NbAh8O9Bx2X/jo4cQFoD6ERUDCFwcNni3VyBkx+nthWv3nF/rkWfvNLpcmPWroBRo 15djZibdsBknsIvs3vpBK0wuq/dN9vcrGTsEWK4jG1eJaX/ah7rbfL4siarrjmMB1cRx14ti8qW KJAC29tCgKgYqvY0syUW7vLbogIn/44gZBhMF8QV6X+297dAJLpX7oGl7wvK80nV95jCZJo6gMj hFPyTbCDL1Ozg5XOifeSb5Pbf7m1YYDxQ45mQuAOWRIMvY4ReCbL/FoQfgOab2fKqpG4xoz9Z1i ECOyPpUoczJeSEQdlcVAXN50i8SI8ht+/+9nBs5xfon+QJIKoFAsGnFbjsD76FGUDUE4p3QsYXz bIZA0cQO4Zq04hR3I5WxcAJhu/E3FKQ2QhBpu9shddQvZbGRJHK8sxzMPVdwF1Ef5MtcJE7IUjQ 1XDL/OFQg== X-Received: by 2002:a05:620a:6481:b0:915:769d:554 with SMTP id af79cd13be357-915769d0fefmr296852485a.46.1780345003477; Mon, 01 Jun 2026 13:16:43 -0700 (PDT) Received: from Mac.mynetworksettings.com ([2600:4041:42f2:d000:5598:1322:a565:857b]) by smtp.gmail.com with ESMTPSA id af79cd13be357-91532473bb9sm1095732785a.11.2026.06.01.13.16.42 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 01 Jun 2026 13:16:43 -0700 (PDT) From: Rohith Matam To: mchehab@kernel.org Cc: duoming@zju.edu.cn, hverkuil@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Rohith Matam , syzbot+0d6ef2b7ceb6014d756c@syzkaller.appspotmail.com Subject: [PATCH v6] media: siano: fix URB work teardown Date: Mon, 1 Jun 2026 16:16:39 -0400 Message-ID: <20260601201639.63171-1-rohithmatham@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260601160447.59917-1-rohithmatham@gmail.com> References: <20260601160447.59917-1-rohithmatham@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" smsusb_onresponse() reinitializes the URB work item immediately before scheduling it. If teardown races with a queued work item, cancel_work_sync() can observe workqueue state with WORK_STRUCT_PWQ still set and trip the workqueue warning reported by syzbot. The teardown path also has related lifetime bugs. URB_FREE_BUFFER makes USB core free a smscore-owned buffer, and a work item can submit an URB after usb_kill_urb() has already returned. If that submission fails, the worker keeps ownership of the smscore buffer and the streaming pipeline loses an URB. Initialize each work item before any error path can tear down the device, remove URB_FREE_BUFFER, stop resubmission before killing URBs, and kill URBs again after canceling work so any URB submitted by an already-running worker is completed before buffers and the device are freed. Return the smscore buffer if URB submission fails. During teardown, wake workers blocked in smscore_getbuffer() by adding an abortable buffer wait. Then cancel work before returning any URB-owned buffer to avoid racing with workers that are still using surb->cb. Guard the wakeup because early probe failure can call teardown before coredev is registered. Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by = do_submit_urb") Reported-by: syzbot+0d6ef2b7ceb6014d756c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D0d6ef2b7ceb6014d756c Signed-off-by: Rohith Matam --- Changes in v6: - Guard the buffer waitqueue wakeup for early probe failures before coredev has been registered. Changes in v5: - Replace the v4 early-buffer-return ordering with an abortable smscore buffer wait so workers can exit before teardown returns surb->cb. Changes in v4: - During teardown, kill all URBs and return held buffers before canceling workers so smscore_getbuffer() waiters can wake and exit. Changes in v3: - Initialize work items before early probe error paths can call teardown. - Return the smscore buffer when URB submission fails. - Wake buffer waiters after returning the buffer, and use wake_up(). Changes in v2: - Initialize all work items before allocating URBs. - Remove URB_FREE_BUFFER from smscore-owned buffers. - Stop resubmission before teardown and kill URBs again after canceling wor= k. drivers/media/common/siano/smscoreapi.c | 14 ++++++- drivers/media/common/siano/smscoreapi.h | 2 + drivers/media/usb/siano/smsusb.c | 56 +++++++++++++++++++------ 3 files changed, 59 insertions(+), 13 deletions(-) diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common= /siano/smscoreapi.c index 017629e3c..23be7347d 100644 --- a/drivers/media/common/siano/smscoreapi.c +++ b/drivers/media/common/siano/smscoreapi.c @@ -1644,6 +1644,18 @@ struct smscore_buffer_t *smscore_getbuffer(struct sm= score_device_t *coredev) } EXPORT_SYMBOL_GPL(smscore_getbuffer); =20 +struct smscore_buffer_t * +smscore_getbuffer_abortable(struct smscore_device_t *coredev, bool *abort) +{ + struct smscore_buffer_t *cb =3D NULL; + + wait_event(coredev->buffer_mng_waitq, + READ_ONCE(*abort) || (cb =3D get_entry(coredev))); + + return cb; +} +EXPORT_SYMBOL_GPL(smscore_getbuffer_abortable); + /* * return buffer descriptor to a pool * @@ -1654,8 +1666,8 @@ EXPORT_SYMBOL_GPL(smscore_getbuffer); */ void smscore_putbuffer(struct smscore_device_t *coredev, struct smscore_buffer_t *cb) { - wake_up_interruptible(&coredev->buffer_mng_waitq); list_add_locked(&cb->entry, &coredev->buffers, &coredev->bufferslock); + wake_up(&coredev->buffer_mng_waitq); } EXPORT_SYMBOL_GPL(smscore_putbuffer); =20 diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common= /siano/smscoreapi.h index d945a2d6d..f8a9e6ef7 100644 --- a/drivers/media/common/siano/smscoreapi.h +++ b/drivers/media/common/siano/smscoreapi.h @@ -1117,6 +1117,8 @@ extern void smscore_onresponse(struct smscore_device_= t *coredev, =20 extern struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *corede= v); +struct smscore_buffer_t * +smscore_getbuffer_abortable(struct smscore_device_t *coredev, bool *abort); extern void smscore_putbuffer(struct smscore_device_t *coredev, struct smscore_buffer_t *cb); =20 diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/sms= usb.c index 0fdc2e095..98ae94e19 100644 --- a/drivers/media/usb/siano/smsusb.c +++ b/drivers/media/usb/siano/smsusb.c @@ -58,6 +58,8 @@ struct smsusb_device_t { unsigned char in_ep; unsigned char out_ep; enum smsusb_state state; + bool streaming; + bool stopping; }; =20 static int smsusb_submit_urb(struct smsusb_device_t *dev, @@ -71,8 +73,14 @@ static void do_submit_urb(struct work_struct *work) { struct smsusb_urb_t *surb =3D container_of(work, struct smsusb_urb_t, wq); struct smsusb_device_t *dev =3D surb->dev; + int rc; =20 - smsusb_submit_urb(dev, surb); + if (!READ_ONCE(dev->streaming)) + return; + + rc =3D smsusb_submit_urb(dev, surb); + if (rc < 0 && READ_ONCE(dev->streaming)) + pr_err("smsusb_submit_urb(...) failed\n"); } =20 /* @@ -143,19 +151,22 @@ static void smsusb_onresponse(struct urb *urb) =20 =20 exit_and_resubmit: - INIT_WORK(&surb->wq, do_submit_urb); - schedule_work(&surb->wq); + if (READ_ONCE(dev->streaming)) + schedule_work(&surb->wq); } =20 static int smsusb_submit_urb(struct smsusb_device_t *dev, struct smsusb_urb_t *surb) { + int rc; + if (!surb->cb) { /* This function can sleep */ - surb->cb =3D smscore_getbuffer(dev->coredev); + surb->cb =3D smscore_getbuffer_abortable(dev->coredev, + &dev->stopping); if (!surb->cb) { - pr_err("smscore_getbuffer(...) returned NULL\n"); - return -ENOMEM; + pr_debug("device is stopping\n"); + return -ESHUTDOWN; } } =20 @@ -168,20 +179,34 @@ static int smsusb_submit_urb(struct smsusb_device_t *= dev, smsusb_onresponse, surb ); - surb->urb->transfer_flags |=3D URB_FREE_BUFFER; + rc =3D usb_submit_urb(surb->urb, GFP_ATOMIC); + if (rc) { + smscore_putbuffer(dev->coredev, surb->cb); + surb->cb =3D NULL; + } =20 - return usb_submit_urb(surb->urb, GFP_ATOMIC); + return rc; } =20 static void smsusb_stop_streaming(struct smsusb_device_t *dev) { int i; =20 - for (i =3D 0; i < MAX_URBS; i++) { + WRITE_ONCE(dev->streaming, false); + WRITE_ONCE(dev->stopping, true); + if (dev->coredev) + wake_up(&dev->coredev->buffer_mng_waitq); + + for (i =3D 0; i < MAX_URBS; i++) usb_kill_urb(dev->surbs[i].urb); - if (dev->surbs[i].wq.func) - cancel_work_sync(&dev->surbs[i].wq); =20 + for (i =3D 0; i < MAX_URBS; i++) + cancel_work_sync(&dev->surbs[i].wq); + + for (i =3D 0; i < MAX_URBS; i++) + usb_kill_urb(dev->surbs[i].urb); + + for (i =3D 0; i < MAX_URBS; i++) { if (dev->surbs[i].cb) { smscore_putbuffer(dev->coredev, dev->surbs[i].cb); dev->surbs[i].cb =3D NULL; @@ -193,6 +218,9 @@ static int smsusb_start_streaming(struct smsusb_device_= t *dev) { int i, rc; =20 + WRITE_ONCE(dev->stopping, false); + WRITE_ONCE(dev->streaming, true); + for (i =3D 0; i < MAX_URBS; i++) { rc =3D smsusb_submit_urb(dev, &dev->surbs[i]); if (rc < 0) { @@ -401,6 +429,11 @@ static int smsusb_init_device(struct usb_interface *in= tf, int board_id) if (!dev) return -ENOMEM; =20 + for (i =3D 0; i < MAX_URBS; i++) { + dev->surbs[i].dev =3D dev; + INIT_WORK(&dev->surbs[i].wq, do_submit_urb); + } + memset(¶ms, 0, sizeof(params)); usb_set_intfdata(intf, dev); dev->udev =3D interface_to_usbdev(intf); @@ -467,7 +500,6 @@ static int smsusb_init_device(struct usb_interface *int= f, int board_id) =20 /* initialize urbs */ for (i =3D 0; i < MAX_URBS; i++) { - dev->surbs[i].dev =3D dev; dev->surbs[i].urb =3D usb_alloc_urb(0, GFP_KERNEL); if (!dev->surbs[i].urb) goto err_unregister_device; --=20 2.54.0