Received-SPF: pass (google.com: domain of linux-kernel+bounces-50042-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Frank Li <Frank.Li@nxp.com>
To: rogerq@kernel.org
Cc: Frank.Li@nxp.com,
	felipe.balbi@linux.intel.com,
	gregkh@linuxfoundation.org,
	imx@lists.linux.dev,
	linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org,
	pawell@cadence.com,
	peter.chen@kernel.org
Subject: [PATCH v2 2/2] usb: cdns3: fix memory double free when handle zero packet
Date: Fri,  2 Feb 2024 10:42:17 -0500
Message-Id: <20240202154217.661867-2-Frank.Li@nxp.com>
In-Reply-To: <20240202154217.661867-1-Frank.Li@nxp.com>
References: <20240202154217.661867-1-Frank.Li@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?XbDhKyZsA3x2v+704X/Fe/prhi4ygmLNZgCQ1rcCrTmg0txA6KvFLTvmpJ6m?=
 =?us-ascii?Q?+xOnCC7EGcqiHXH5MJV8UgDrG2RBXhHM158YAsP8b3G0rsKMDm6W1J89jOto?=
 =?us-ascii?Q?iZh0K8D47YB6d3FizlMbqwEyM1OHTXHC/lJR8SkCpSxPCsYN/LDhL9S0dxFP?=
 =?us-ascii?Q?aOaD651rw8AkwOZgmAUGYot1b271xEUcu0gbCUy2OPvfOtkVkif6dpBPoCpg?=
 =?us-ascii?Q?K36Xw3nONIk3IbvGccdLLCTV0hb6z9A0ETBJQI4IJHgvXyH4F2GPgCW/FC64?=
 =?us-ascii?Q?XscVj3iJvc8nwJmFhy/moMa8KgCjPmIKMUeG/8ZLEv0U6NEHzRi87i/H2504?=
 =?us-ascii?Q?fCrk6P/YcOLodjy+6jQOeX+OYdpt2NGk+4Mru4Zk2sepnCNCtIa14fUp8Nsh?=
 =?us-ascii?Q?7bkncnu968YbQAwU6FfJEJmdxbOLFsFuQj42hUyGUW0nTAejab3C+YKFq3K9?=
 =?us-ascii?Q?/E5Dyztq37IADnvO72mpwOcA9f/4VMZBDojZvypUvyuJoksGMiLs2e2aasXF?=
 =?us-ascii?Q?640eSHaI0x3nVBu+DxO7m+DZoM1q5mvLkLW2hSae8GHEcKawgM9DYa4/6Mhr?=
 =?us-ascii?Q?D0BGXP4k+KdfVscaGacysFYpSxUKOwGw31BjRPehbuxYwa/bVh3erFTZx+o6?=
 =?us-ascii?Q?TbXtHu1p8j/CR2TLxOf3Xmne+jvYa8wVpjbkxuWZy8EXEv1lZncVoNzxhxU3?=
 =?us-ascii?Q?JTJlLDJfh7gQDoDdDthxhDx61QxVAS3LrcT2VS63MOxxArbp67M1RVtTiPO8?=
 =?us-ascii?Q?Lj3iRgsIWB8unMC3i7tiu1k/iRKdEFrlJf7U747ouK85Hqr4iIz6zAOCCv+o?=
 =?us-ascii?Q?gVBzYfsAFtZzJZWxMov31n1o08TMlBNobwnt46OXseTg0SvmC9lJoN4B5wlK?=
 =?us-ascii?Q?ibJtNtK57AGbDfUJ1cXl+qNNN04pUW27FyDviCkz9LaTIo+brzgYPdbmshdo?=
 =?us-ascii?Q?DkMfvMtzBDegZyTahhy7UrLyHLIeLgXVG1DA3J3+3fb6TfqhMdUKJ//IFkq8?=
 =?us-ascii?Q?W3UBmawCzEOO3TBaROMoBEUCKTRLf3VItD3CKY9Gvh/JdW1O+XmUqEuCxln/?=
 =?us-ascii?Q?XEAnj1zSdlICXMiPkPdWmL7QwCeywcHS/ZyXOu7VkGJXgI4et1lDpyG1Kz2y?=
 =?us-ascii?Q?DK/abB8u1Ezjyn1uOsmyWyYuUAVpacGr2qzQN5ha8sFuAcbwt1stSOgSWoM9?=
 =?us-ascii?Q?cv01Ubp58lOapArsVgqP3xo2aS8dEoA9A98dm4DL9muEu4BHNTAhjt0VrHNB?=
 =?us-ascii?Q?XZ2ouAQmAp+tu1vWmYQGmcK7emnQd+ayNV1FZ4ojOQWzmQ2vXq4GYgetEBaq?=
 =?us-ascii?Q?uFXrFUl+LsvZh9DHv9KptcOY9fXLkA0je2y5BVXbkR/aw9Udhot/3fkfmUlG?=
 =?us-ascii?Q?y2wes22O0M9CVYDIDXzYApua4eIyNaNhNBskDhPgkSNWjscqEMDj1cw34ulT?=
 =?us-ascii?Q?F8+XMfsXlvL0wZ2IdrofHYqEAvQSglngZzTjrwsFPsO0mxnun/ZyQN+nY35+?=
 =?us-ascii?Q?qpmPWDyFyIyyGaJM8PoZmcUs8byYBioiXs900CdoSnRgzEHMvhZoRpqasR8x?=
 =?us-ascii?Q?jM2cNN0t9FjN1CcuSbAGnx+mtw2S2Qxz4Vhz+CsM?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0f7883ed-0d09-4b4f-47dc-08dc2405966b
X-MS-Exchange-CrossTenant-AuthSource: PAXPR04MB9642.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Feb 2024 15:42:39.8086
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9YfhmrYk6sWVYlSD4ynAPBocYsHQIddiKFlq0VFFPMT/keTlvlXGIjSA25CMM1GHsVf3CvgSyDWFFFzFCKbyRg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWPR04MB10008

829  if (request->complete) {
830          spin_unlock(&priv_dev->lock);
831          usb_gadget_giveback_request(&priv_ep->endpoint,
832                                    request);
833          spin_lock(&priv_dev->lock);
834  }
835
836  if (request->buf == priv_dev->zlp_buf)
837      cdns3_gadget_ep_free_request(&priv_ep->endpoint, request);

Driver append an additional zero packet request when queue a packet, which
length mod max packet size is 0. When transfer complete, run to line 831,
usb_gadget_giveback_request() will free this requestion. 836 condition is
true, so cdns3_gadget_ep_free_request() free this request again.

Log:

[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]
[ 1920.140696][  T150]
[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):
[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]
[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]

Add check at line 829, skip call usb_gadget_giveback_request() if it is
additional zero length packet request. Needn't call
usb_gadget_giveback_request() because it is allocated in this driver.

Cc: <stable@vger.kernel.org>
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
 drivers/usb/cdns3/cdns3-gadget.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index d6723d31fc6e2..fd1beb10bba72 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -828,7 +828,11 @@ void cdns3_gadget_giveback(struct cdns3_endpoint *priv_ep,
 			return;
 	}
 
-	if (request->complete) {
+	/*
+	 * zlp request is appended by driver, needn't call usb_gadget_giveback_request() to notify
+	 * gadget composite driver.
+	 */
+	if (request->complete && request->buf != priv_dev->zlp_buf) {
 		spin_unlock(&priv_dev->lock);
 		usb_gadget_giveback_request(&priv_ep->endpoint,
 					    request);
-- 
2.34.1