Commit 3cbc242b authored by Fan Wu's avatar Fan Wu Committed by Greg Kroah-Hartman
Browse files

usb: renesas_usbhs: fix use-after-free in ISR during device removal 



In usbhs_remove(), the driver frees resources (including the pipe array)
while the interrupt handler (usbhs_interrupt) is still registered. If an
interrupt fires after usbhs_pipe_remove() but before the driver is fully
unbound, the ISR may access freed memory, causing a use-after-free.

Fix this by calling devm_free_irq() before freeing resources. This ensures
the interrupt handler is both disabled and synchronized (waits for any
running ISR to complete) before usbhs_pipe_remove() is called.

Fixes: f1407d5c ("usb: renesas_usbhs: Add Renesas USBHS common code")
Cc: stable <stable@kernel.org>
Suggested-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarFan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260303073344.34577-1-fanwu01@zju.edu.cn


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 14ae24cb

drivers/usb/renesas_usbhs/common.c

+9 −0
Original line number Diff line number Diff line
@@ -815,6 +815,15 @@ static void usbhs_remove(struct platform_device *pdev) 


	usbhs_platform_call(priv, hardware_exit, pdev);

	reset_control_assert(priv->rsts);



	/*

	 * Explicitly free the IRQ to ensure the interrupt handler is

	 * disabled and synchronized before freeing resources.

	 * devm_free_irq() calls free_irq() which waits for any running

	 * ISR to complete, preventing UAF.

	 */

	devm_free_irq(&pdev->dev, priv->irq, priv);



	usbhs_mod_remove(priv);

	usbhs_fifo_remove(priv);

	usbhs_pipe_remove(priv);