Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <f90522c4-f7d6-3068-9789-8c6d893f2768@suse.com>
Date:   Wed, 6 Apr 2022 13:47:35 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.7.0
Subject: Re: [PATCH] usb: misc: fix improper handling of refcount in
 uss720_probe()
Content-Language: en-US
To:     Hangyu Hua <hbh25y@gmail.com>, gregkh@linuxfoundation.org,
        mudongliangabcd@gmail.com
CC:     linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20220406073349.22203-1-hbh25y@gmail.com>
From:   Oliver Neukum <oneukum@suse.com>
In-Reply-To: <20220406073349.22203-1-hbh25y@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?1JHn47woJJajBNhUXSVDHWUquLJKixMep3xHTUB1GCkZ7IHCVOWpvhxDqW5Z?=
 =?us-ascii?Q?frXztqFy3bTU3Bs13U05J3vuEZQge9orddgjc8AmF8Cus8oZBSMgBcCNKnHN?=
 =?us-ascii?Q?ZUw91ALush7VNxkoCQPN5GHXbKmT6CyexhuNHzHqr0iy4ec2Gq3V68cyxD/E?=
 =?us-ascii?Q?yFbAbz+Jr9RVO//czQVyFpKBYAD1HhfWllQhPh+dm+6zwQbk9s70+kiCDqUl?=
 =?us-ascii?Q?LFADVXoHizwAf1Pvj2asoYGtU/Y2y781eFGjZ8FE3UYGIf3sUN0FaYl/5v6k?=
 =?us-ascii?Q?v53OPgafeFO+6F1gcrsLIphQseLUs8xtzxC0ycg4mbt9JEGbUGWAD/vqrH8M?=
 =?us-ascii?Q?vIu3jOlBOsl7uAb2uZPcixanrI1LIY94H8gnDsga7C/fM+8DhD4EmHfpErLM?=
 =?us-ascii?Q?sBHyhAkfM62oA3miuiA6VXjxhfF7j2nhGiod9IF0Emw0Mqrs9VfZsMBrB9f5?=
 =?us-ascii?Q?GlvtULx8i4yjIUhFcO1UsHohdeX/wfO66dC21gMEnTROlz/qGnfGGyJTB7qY?=
 =?us-ascii?Q?c+8A9a84Xp2a/hrKhESymsuTAVeefWnGnT4622jzeeNEzer50tdcoB2E9OXE?=
 =?us-ascii?Q?V0I49P/9DyrfevW/uyS4krO9y399ruOM2jDj17KMVcIdiZULeuO2qLnzKcns?=
 =?us-ascii?Q?s3dtZXPG0n7BpijK3SJl+Blpc/4VFHzvTebmNHHYwtw2Vbk6k1VWgvl79rgT?=
 =?us-ascii?Q?8yW9jJEMakP3CrZHoZV4asTIKwIxosTLZ6bi1DKA3C/YpNMxsK/S9LFtKgMq?=
 =?us-ascii?Q?R5zaw+So+xP48ED93UmLgLg6sVm2Tp0yiAN/Y6FfABrUmdoXh1V10HCs8aE+?=
 =?us-ascii?Q?OKHoFc0yGYq4p+rViW4me66XbhilAG6kkqN1CfutrRoU2rbn/Em5JtdKz1Ae?=
 =?us-ascii?Q?Zba6JQlFKRb3+VwKu2s6gGAND9IGKaM307S7x0uqltjA2TqPPz5vRv3GEONv?=
 =?us-ascii?Q?wV61V8HCTMxXfGSRUlk6jcNm9C80njiFC07i4tLEFQskZoX/UKub18y3LrtO?=
 =?us-ascii?Q?9t/m/F755DcjlCfvoLbwR39pNwY//n6J05QfqMF0Zkay1iwqCXMNaKLg3Xpg?=
 =?us-ascii?Q?rXWNrbQnI1sUn60GHV5OW+cDlGj0v2m4cgefmtE4W9JpoVf4Ui1fJoj6fVU7?=
 =?us-ascii?Q?L9Gaoa9+VWO5Zrat6Y3Bce8P/f8AOYyNLrqNUqE7GbvKF46f7Z6Da00qLOub?=
 =?us-ascii?Q?2cCdwJsI7i/cuEFWkm6F0S/GcIOPKBH7mHgsp2DfcOoWISGOND5oK1CE/YcQ?=
 =?us-ascii?Q?BHWKxIM+dJQOHMKuOnH+FMuZHzodFPKq+fpw0tYCfqjw9RRTZYwoSMnftuUx?=
 =?us-ascii?Q?k9HR3/ISZq1GYgWjh8HSJcNmuYimIZBzA5ex2XOXZqvbyX6uRE2PZRbbHZEg?=
 =?us-ascii?Q?Lg5j0dK/jPV5lGNH6x/7dQGg48A4Bb725BDNJm4Wy6qcvt7PskRqIfrlAtl9?=
 =?us-ascii?Q?oGJwVIZG0B8xlU1NB/pJG/5f9BafyUbNRBa2+4GgmPz44FyVeLlMpou3e1b2?=
 =?us-ascii?Q?1+S+TJLPJD36bkqPqR7TmffEWAWKJ77di8cFCm0r2U143v4upeTHamX6otzz?=
 =?us-ascii?Q?d6CX2wn73OpjO65fxfxhfK4LEp2wizUiZ2c5P4HjxKVs66X4V9LId9eVp9Cb?=
 =?us-ascii?Q?lXAh6SScKFms+0z6uQhcRLI91w78N0DQ91eyybPeWw3b2fALTzw+Gei1893P?=
 =?us-ascii?Q?qGXP5QcyLXeYPSC/CkjJs3hOoYNLrR3iNsvEjyyh+K8vh8xE+E78uc3Y8km8?=
 =?us-ascii?Q?KCYAJQT4/tgNjwleqh+F/GlnzU6/7cqkqRxbUABgpQ+1tyvYZ4A7vf5+0phw?=
X-MS-Exchange-AntiSpam-MessageData-1: dFUrfJg5D7tr3w==
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 39af00dc-6885-4e64-43cf-08da17c3402a
X-MS-Exchange-CrossTenant-AuthSource: VI1PR0401MB2526.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Apr 2022 11:47:39.0638
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: FPEGpi51lkG2T8NGjuRGaH2aF3NqgeawanbdyLCBtGWJfmUNJQP5IvVZx6G2uhigiYS4r6S0mn/4dUtCt1n7Jw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB8867
X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,NICE_REPLY_A,RDNS_NONE,SPF_HELO_NONE,
	T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 06.04.22 09:33, Hangyu Hua wrote:
> usb_put_dev shouldn't be called when uss720_probe succeeds because of
> priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL
> before destroy_priv in uss720_disconnect because usb_put_dev is in
> destroy_priv.

Hi,

I am sorry, but that's a clear NACK.
> @@ -754,13 +753,13 @@ static void uss720_disconnect(struct usb_interface =
*intf)
>  	usb_set_intfdata(intf, NULL);
>  	if (pp) {
>  		priv =3D pp->private_data;
> -		priv->usbdev =3D NULL;
>  		priv->pp =3D NULL;
>  		dev_dbg(&intf->dev, "parport_remove_port\n");
>  		parport_remove_port(pp);
>  		parport_put_port(pp);
>  		kill_all_async_requests_priv(priv);
>  		kref_put(&priv->ref_count, destroy_priv);
> +		priv->usbdev =3D NULL;

That is a clear use after free The patch is no good in this state..

=C2=A0=C2=A0=C2=A0 HTH
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 Oliver