From nobody Fri Jul 24 21:29:33 2026 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22919433BAB for ; Fri, 24 Jul 2026 13:42:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784900576; cv=none; b=RkVit7+7HP+uw9Eb9MgM9opnNJF9l1Vj5iwD78bQXhgJBNWRxSzB4RapKoipe07pX/dh9leLcLhA1gi9P5oTGynIrqwVuxkVPDHkCl0dDDhAuZao4uSCSh1cg3IiSytkcbLtqbt7+HNeOPvdn1B+w4o9nG9vRkQT3k5ln9M3nRc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784900576; c=relaxed/simple; bh=nmS6H4FTGfwQIoCXwTuZi7xAO3R/0s18DSvjvFnlIn4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hbnP8ACM+hitBTyvPB49Na30BYAmJju5nFo7cAT42V7FPTNzlEJ/whl+wf73YtFg0Jc+RnlayKPcBEZ4eUqDt8S2l97tLCAUB10NxRL0tSH03lOotJSoePh0tI+qdSS7Aa/QISQDftC02Dl/ogpoOxOL21DdBubdrl6SLvHaLMA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai; spf=pass smtp.mailfrom=0sec.ai; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b=TUoORDvp; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=0sec.ai Authentication-Results: smtp.subspace.kernel.org; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b="TUoORDvp" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so2790795e9.2 for ; Fri, 24 Jul 2026 06:42:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=0sec.ai; s=google; t=1784900572; x=1785505372; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=hzokFwbqCQcQa0BrIKwjqqwQpe6YFNwdchqjati0oWs=; b=TUoORDvpHUE7jt0UnLuCr3U1DxrW1G21GQgo3dKWkZcHd67wMIhjWYLOZpzrdyDPsu 5YvUsIVX/PSk1ovTgm9VjNpZKxy9fk7UMdgzEvA+eoagaZM8kd2jZ3XTfjVe5YUE+lie 3oM2VrJQ2O3B774l0Kq8vYrfIdrh9k8iR/6LfhWA6+W1ejXsVKsHwisfRujj3Z20yiwq P4hdRTJuuo9dTImnEgZi80LbsjPdAydRtnmrY9A2AoCBiJ7fTo4LFaBTEWOX4yNFQ/qL ncUnT5o629xMIGHgLeJ0x33MJ8H6js/4J3Dc0bd/b7RfzRWtI95UrXU1P9E0K7VeVwKL HZVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784900572; x=1785505372; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hzokFwbqCQcQa0BrIKwjqqwQpe6YFNwdchqjati0oWs=; b=L5unahekhWoSeErXjWXQiKeDyarN/R58aAHT20M1Ckt/XxWDGAzgjgYdF58m7DdS4a WI8finWOZXUY0tck4Dl5gTPlcKMsVMNCjtOZbOPGfNmmGgZ4t2NEjKdkcvcDQQ8F6i8+ VocfWaVCxQQy3keuSvTbBaYQgjtuHAPg61Lz58n06NgwhNbR7HsaJKPrG9OJlLE0dMTM DybppkiDxKFnZ4j3blo3p7ZKyXsGGphBqOKNTCNhEjtrqk2kLGuvT0IfqAVsWaKqx+Wj roJ3nShCiDI7jgrYT1WX83HjtwJKCFYoq+GPV0G/a8UdzcR8QkrqGSoTqZWXlAVNcIS/ NR2A== X-Forwarded-Encrypted: i=1; AHgh+RrFgoWGkmiUuRClreodG3scZZnhGx9EEIWTILzwwjnKVvkoIQyn4fEys4Dv2ympIevAdfPB1HPBMB63e+4=@vger.kernel.org X-Gm-Message-State: AOJu0YyLiOmjtrhMW1WKmVDgqI9gTp3Y8BmLJ1dXOnkhvr4A8a+9iSWE zV5Mzjfo8npBjiE7S1XtCJJ9+UJN4AlwNYvyxCnZiggdMzns5Mkaptd1IuFPGJPU3Rsb X-Gm-Gg: AR+sD12ZXWf7OEZSx7FEwtahVnDBKwjnigcWgfdS/KCQcla4vMZ10rs1FmtEbKBGvWZ nze1d4v04CAJhI/95AUxMbIszzTJmgE9KL948oRju2VxYTyQjD3+7A5ZKIckxcfv8mAQsP3v+Eg JrzxW+Si+tabj6gHquILjLUTOvElsiI0szCJOa+FvKFBp9W/QYAHm+Yg9+GcVHEvcwWPXZir3pS 3e82HMo/VBpCdK8Vk77vTGZFIKnxGGmLUmXJrIoYwR8SPHDipbbgn0fspX6wcE1kTuSJ5ev/4ZR XjcgkqQACZKAzIc7axOSgQfida98ZJ2Riq0cph8eZ5OEMgtzGlornUsiD52I8+C1G0oRZEZ0/Lh ZitqR2wLDAy6q/xYw1XVpLTcmmTTkqitE7m0fX+AUfzRcjvfricdI8bq3hmWooi+MrOkKLsIi87 zcC7GZYSMtOV+rIJyP2ViMxqWfU/pOK6UnK6bq00Naq/QdpGvuCvMbGsG4flOwIXAm+RcS/jwzy R4vTNyEBWrEwjfqFPWdwT+wqQ== X-Received: by 2002:a05:600c:350a:b0:495:441a:39d2 with SMTP id 5b1f17b1804b1-49573cd8932mr92373025e9.21.1784900572398; Fri, 24 Jul 2026 06:42:52 -0700 (PDT) Received: from PeakBook-Mini.tail8e484.ts.net ([178.197.219.241]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85bd850asm23982836f8f.15.2026.07.24.06.42.51 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 24 Jul 2026 06:42:51 -0700 (PDT) From: Doruk Tan Ozturk To: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Andrew Lunn Cc: Alexander Kappner , linux-usb@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net] net: usb: ipheth: fix carrier_work UAF on disconnect Date: Fri, 24 Jul 2026 15:42:50 +0200 Message-ID: <20260724134250.34360-1-doruk@0sec.ai> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); ipheth_disconnect() drains that work via unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync(), and only then kills the URBs with ipheth_kill_urbs(). usb_kill_urb() completes any in-flight TX URB synchronously with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work. free_netdev() then frees the netdev whose private area embeds carrier_work, and the pending ipheth_carrier_check_work() dereferences the freed device, a use-after-free on unplug while a TX URB is in flight. Drain carrier_work again after the URB source is stopped and before the netdev is freed. Found by 0sec (https://0sec.ai) using automated source analysis; not runtime-reproduced. Fixes: bb1b40c7cb86 ("usbnet: ipheth: prevent TX queue timeouts when device= not ready") Cc: stable@vger.kernel.org Assisted-by: 0sec:multi-model Signed-off-by: Doruk Tan Ozturk --- drivers/net/usb/ipheth.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index bb1364f85bd1..fdddd761f83b 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -672,6 +672,15 @@ static void ipheth_disconnect(struct usb_interface *in= tf) if (dev !=3D NULL) { unregister_netdev(dev->net); ipheth_kill_urbs(dev); + /* + * ipheth_sndbulk_callback() re-arms carrier_work on the + * -ENOENT completion delivered by the usb_kill_urb() in + * ipheth_kill_urbs(), after ipheth_close() (via + * unregister_netdev()) already drained it. Drain it again + * once the URB source is stopped, before free_netdev() frees + * the netdev whose private area embeds carrier_work. + */ + cancel_delayed_work_sync(&dev->carrier_work); ipheth_free_urbs(dev); kfree(dev->ctrl_buf); free_netdev(dev->net); --=20 2.43.0