Received-SPF: pass (google.com: domain of linux-kernel+bounces-50041-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Frank Li <Frank.Li@nxp.com>
To: rogerq@kernel.org
Cc: Frank.Li@nxp.com,
	felipe.balbi@linux.intel.com,
	gregkh@linuxfoundation.org,
	imx@lists.linux.dev,
	linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org,
	pawell@cadence.com,
	peter.chen@kernel.org
Subject: [PATCH v2 1/2] usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
Date: Fri,  2 Feb 2024 10:42:16 -0500
Message-Id: <20240202154217.661867-1-Frank.Li@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?BgYNxMumC3thFlnLjZiA2vbhC82KTtwmADix47vlaS54q5y9gA9LxzZs9jYF?=
 =?us-ascii?Q?bK8yShIOM2MiHElHN9p82SQjz24e9zxGoqfmZ4YcR6cZ0QqzGKSdk+fxKP9F?=
 =?us-ascii?Q?CoJNXahHLcHFfC2RXGPVvj3anT/6Hmn9QcA43YJ2ledi4Aa6emTpObiVFQ9i?=
 =?us-ascii?Q?MvfYeaafSHeJeKtmdfZbU1lIhxkPqpZqhcoTDki4duw53xMTzcPn0X4/phuO?=
 =?us-ascii?Q?qAaQCnZCO5PAFScoY/EeVJAXwpAJC2yJYhngw5Qtl396Fa2PBkRMYCaNJdcn?=
 =?us-ascii?Q?+Fcv8uZn1dPR+91BnnBdBnCL8g/DjdgwMbUL+xEdRyZcWe/FU2vvEwPcSsdt?=
 =?us-ascii?Q?V2ylKlhk5QXbULIkzjJwJK5qNXvwm9LW18PVdera24f+f6Dmul39i9h07zfQ?=
 =?us-ascii?Q?dfgfiRcQ6OUCdaO7bAdzdUG/xDRT8X6zwt0sGG07olypjqA+URfqtf2rBNG7?=
 =?us-ascii?Q?nLVThKC0DYG29+f3UAncU+r6GEVCIWesGwxcO0ENkITx79K3TyiWBVAmbBs4?=
 =?us-ascii?Q?7ezOXNzrS5hi1/wVPt1QDJfBc6xsusP8aGAE/R/wH77czAlndh9UeuqFXXMM?=
 =?us-ascii?Q?hthP7DqznPTgV2+A2ibQrBUQyp0ObhQCqGQteu8lOFoBsqVrtHnhzZ/UgClX?=
 =?us-ascii?Q?7ix4QfYFZ8BUBCy65d4n6tWvGQ50FbNhSzz1zlfT4FadOjfvgt6PASKNLSRF?=
 =?us-ascii?Q?rZ1/4j8d4r00meBYX6xBnKzgWeSTEmy1kaDqZPqAAVo8AFMJoKrSxQgCfR5l?=
 =?us-ascii?Q?wuHBrHE9uWoLiOKw8oP2JqqeUWLCy9WgaqVKRheNF1Lza/924/+Ydfgl2HtP?=
 =?us-ascii?Q?bL1bXsnqDbEmes/8LUN8aNyeSLxu4H0Wk8k+KQnImQJ0FL+OXe6tgkSjypyX?=
 =?us-ascii?Q?vTQky9NiahX0LzwWegzJhBLaOQvqvd8A67h0wXR0rgyebQLxD3xwx5bCZk9y?=
 =?us-ascii?Q?+dADbBUXnAvF7WN0KSrr/XT3RmLZi2gUg1FXH8WxuxDLbwL3ow3itZEyWWwK?=
 =?us-ascii?Q?aLwXswpxMxomX+DpyfBpCHusrvDHilgAMK0QRaJYKJgf4+LPgG1N8J+Cc2EX?=
 =?us-ascii?Q?BVK6pVxYXX1F54bl6OqYunqTq60qBb0mHXSkvH/DTManHew04HpJLK/T06RD?=
 =?us-ascii?Q?KNR/fHwfZd6csMrRV4TyWtmm7O7dPgwVnK+9mpqiTaAFGhzZ7oAujc4kEXkd?=
 =?us-ascii?Q?mwnXfZxG7fuKiPgIorT4kb2lFyzUzXleiWwmY60PKC8oCAV0pMivVqg+sHjp?=
 =?us-ascii?Q?oU4TQy3rtifOeeVc6g0BlSAbT3NJpeUE/lvSzcNuL9uyKPYToreohapx4UEg?=
 =?us-ascii?Q?JQQSkDssVFj2+QtwAEjKSMoB50Fu2fPPUQNUmgCZjoA/B7eIqsnzBbYIvvxB?=
 =?us-ascii?Q?K+P2W379aFLMoBhntW1N9LaiW/KCWQ1iefKBdfvbRKyd9/kTc7CfFNafu8e3?=
 =?us-ascii?Q?6XjiDOOBEchXvy+iXvN8eYV1Qh/9MrvjzKebKrrq2JvMfFTiIPQ2MwDDXQUl?=
 =?us-ascii?Q?VhZnJs3IDbE1kJBzSR0hH9WhAaLSDLH9zXA+oM+ZBg0l+MSgazcwDeyXu0bb?=
 =?us-ascii?Q?+KCLT7L/TUiQlqUE+HB1OCimLOr1g08J4vTap35o?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1ab15353-dff4-43e3-4aa6-08dc240594f1
X-MS-Exchange-CrossTenant-AuthSource: PAXPR04MB9642.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Feb 2024 15:42:37.3280
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 91+ayK2r+fbGc5ZeX1oHrfy5T03jdx8isNrfyzPVhhd73ZjwwZNd2/2TgdTCo9RRa/PYhuhIvO6U+9q5rT4XUw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU2PR04MB8502

  ...
  cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
  list_del_init(&priv_req->list);
  ...

'priv_req' actually free at cdns3_gadget_ep_free_request(). But
list_del_init() use priv_req->list after it.

[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4
[ 1542.642868][  T534]
[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):
[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4
[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]
[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4
[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8
[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368
[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28

Move list_del_init() before cdns3_gadget_ep_free_request() to resolve this
problem.

Cc: <stable@vger.kernel.org>
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Roger Quadros <rogerq@kernel.org>
---
 drivers/usb/cdns3/cdns3-gadget.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index aeca902ab6cc4..d6723d31fc6e2 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2540,11 +2540,11 @@ static int cdns3_gadget_ep_disable(struct usb_ep *ep)
 
 	while (!list_empty(&priv_ep->wa2_descmiss_req_list)) {
 		priv_req = cdns3_next_priv_request(&priv_ep->wa2_descmiss_req_list);
+		list_del_init(&priv_req->list);
 
 		kfree(priv_req->request.buf);
 		cdns3_gadget_ep_free_request(&priv_ep->endpoint,
 					     &priv_req->request);
-		list_del_init(&priv_req->list);
 		--priv_ep->wa2_counter;
 	}
 
-- 
2.34.1