For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: gadget: inode: keep ep_data alive via the ep inode reference
Author: adrianox@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/usb/gadget/legacy/inode.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index db961aaa3740..dc0cba86cf30 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1626,6 +1626,16 @@ static int activate_ep_files (struct dev_data *dev)
if (!data->req)
goto enomem1;
+ /*
+ * The inode created below references this ep_data through
+ * ->i_private and gadgetfs_evict_inode() releases it again.
+ * Without this the inode could outlive the ep_data and a
+ * concurrent openat() -> ep_open() would dereference freed
+ * memory (reported as a slab-use-after-free in the mutex fast
+ * path). Keep the object alive for as long as any inode points
+ * to it.
+ */
+ get_ep(data);
err = gadgetfs_create_file (dev->sb, data->name,
data, &ep_io_operations);
if (err)
@@ -2015,9 +2025,25 @@ static int gadgetfs_create_file (struct super_block *sb, char const *name,
return 0;
}
+static void gadgetfs_evict_inode(struct inode *inode)
+{
+ /*
+ * EP file inodes keep their struct ep_data alive through ->i_private;
+ * drop that reference when the inode finally goes away. This closes
+ * the ep_open() vs. gadgetfs_unbind()/destroy_ep_files() race where
+ * the ep_data was freed while an inode still pointed to it.
+ */
+ if (inode->i_fop == &ep_io_operations)
+ put_ep(inode->i_private);
+
+ truncate_inode_pages_final(&inode->i_data);
+ clear_inode(inode);
+}
+
static const struct super_operations gadget_fs_operations = {
.statfs = simple_statfs,
.drop_inode = inode_just_drop,
+ .evict_inode = gadgetfs_evict_inode,
};
static int
--
2.51.0