mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

[PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

Posted by Muhammad Bilal 1 month, 1 week ago

The vub300 driver arms inactivity_timer during probe and acquires a kref
reference for the running timer. However, vub300_disconnect() sets
vub300->interface = NULL and drops the driver's kref without shutting down
the timer via timer_shutdown_sync().

If the timer expires after the host is removed and vub300 is freed,
or if concurrent work items re-arm the timer,
vub300_inactivity_timer_expired() accesses the already freed vub300
structure, causing a Use-After-Free.

Fix this by explicitly shutting down inactivity_timer via
timer_shutdown_sync() and releasing the timer's kref reference in
vub300_disconnect() and probe error cleanup paths.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/mmc/host/vub300.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 8e45dc1a4a12..9f84bd1531e2 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2350,6 +2350,8 @@ static int vub300_probe(struct usb_interface *interface,
 
 err_stop_io:
 	vub300->interface = NULL;
+	timer_shutdown_sync(&vub300->inactivity_timer);
+	kref_put(&vub300->kref, vub300_delete);
 	kref_put(&vub300->kref, vub300_delete);
 
 	return retval;
@@ -2385,6 +2387,8 @@ static void vub300_disconnect(struct usb_interface *interface)
 			usb_set_intfdata(interface, NULL);
 			/* prevent more I/O from starting */
 			vub300->interface = NULL;
+			timer_shutdown_sync(&vub300->inactivity_timer);
+			kref_put(&vub300->kref, vub300_delete);
 			mmc_remove_host(mmc);
 			kref_put(&vub300->kref, vub300_delete);
 			pr_info("USB vub300 remote SDIO host controller[%d]"
-- 
2.43.0

Re: [PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

Posted by Johan Hovold 1 month, 1 week ago

On Wed, Aug 19, 2026 at 02:03:22AM +0500, Muhammad Bilal wrote:
> The vub300 driver arms inactivity_timer during probe and acquires a kref
> reference for the running timer. However, vub300_disconnect() sets
> vub300->interface = NULL and drops the driver's kref without shutting down
> the timer via timer_shutdown_sync().
> 
> If the timer expires after the host is removed and vub300 is freed,
> or if concurrent work items re-arm the timer,
> vub300_inactivity_timer_expired() accesses the already freed vub300
> structure, causing a Use-After-Free.

No, this cannot happen as the timer holds another reference.

> Fix this by explicitly shutting down inactivity_timer via
> timer_shutdown_sync() and releasing the timer's kref reference in
> vub300_disconnect() and probe error cleanup paths.
> 
> Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>

How was this "issue" found? Are you using an LLM?

> ---
>  drivers/mmc/host/vub300.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
> index 8e45dc1a4a12..9f84bd1531e2 100644
> --- a/drivers/mmc/host/vub300.c
> +++ b/drivers/mmc/host/vub300.c
> @@ -2350,6 +2350,8 @@ static int vub300_probe(struct usb_interface *interface,
>  
>  err_stop_io:
>  	vub300->interface = NULL;
> +	timer_shutdown_sync(&vub300->inactivity_timer);
> +	kref_put(&vub300->kref, vub300_delete);
>  	kref_put(&vub300->kref, vub300_delete);

And this results in a reference underflow.

Johan

Re: [PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

Posted by Muhammad Bilal 1 month, 1 week ago

Hi Johan,

You're right, thank you for catching this. I traced through
vub300_probe() and vub300_inactivity_timer_expired() again: the
kref_get() taken right before add_timer() is exactly the extra
reference the timer holds, and the timer callback releases it itself
and stops rearming once vub300->interface is NULL. So the UAF I
described can't happen with the code as it stands.

I should also be upfront that this was flagged by Sashiko, and I did
not verify the reference counting closely enough myself before sending
it.
That's on me. Dropping this patch.

Sorry for the noise.
Muhammad Bilal

On Wed, Aug 19, 2026 at 7:19 PM Johan Hovold <johan@kernel.org> wrote:
>
> On Wed, Aug 19, 2026 at 02:03:22AM +0500, Muhammad Bilal wrote:
> > The vub300 driver arms inactivity_timer during probe and acquires a kref
> > reference for the running timer. However, vub300_disconnect() sets
> > vub300->interface = NULL and drops the driver's kref without shutting down
> > the timer via timer_shutdown_sync().
> >
> > If the timer expires after the host is removed and vub300 is freed,
> > or if concurrent work items re-arm the timer,
> > vub300_inactivity_timer_expired() accesses the already freed vub300
> > structure, causing a Use-After-Free.
>
> No, this cannot happen as the timer holds another reference.
>
> > Fix this by explicitly shutting down inactivity_timer via
> > timer_shutdown_sync() and releasing the timer's kref reference in
> > vub300_disconnect() and probe error cleanup paths.
> >
> > Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
> > Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
>
> How was this "issue" found? Are you using an LLM?
>
> > ---
> >  drivers/mmc/host/vub300.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
> > index 8e45dc1a4a12..9f84bd1531e2 100644
> > --- a/drivers/mmc/host/vub300.c
> > +++ b/drivers/mmc/host/vub300.c
> > @@ -2350,6 +2350,8 @@ static int vub300_probe(struct usb_interface *interface,
> >
> >  err_stop_io:
> >       vub300->interface = NULL;
> > +     timer_shutdown_sync(&vub300->inactivity_timer);
> > +     kref_put(&vub300->kref, vub300_delete);
> >       kref_put(&vub300->kref, vub300_delete);
>
> And this results in a reference underflow.
>
> Johan

Re: [PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

Posted by Johan Hovold 1 month, 1 week ago

[ Please avoid top-posting when replying on the lists. ]

On Wed, Aug 19, 2026 at 07:33:25PM +0500, Muhammad Bilal wrote:

> You're right, thank you for catching this. I traced through
> vub300_probe() and vub300_inactivity_timer_expired() again: the
> kref_get() taken right before add_timer() is exactly the extra
> reference the timer holds, and the timer callback releases it itself
> and stops rearming once vub300->interface is NULL. So the UAF I
> described can't happen with the code as it stands.
> 
> I should also be upfront that this was flagged by Sashiko, and I did
> not verify the reference counting closely enough myself before sending
> it.

Remember to mention when issues were found (or fixed) by tools like
Sashiko or LLMs generally in the commit message of any future patches as
its useful information for reviewers and maintainers (and as is also
documented as being required).

Johan