Commit fe814b5b authored Jan 04, 2024 by Avichal Rakesh Committed by Greg Kroah-Hartman Jan 05, 2024

usb: gadget: uvc: Fix use are free during STREAMOFF



There is a path that may lead to freed memory being referenced,
causing kernel panics.

The kernel panic has the following stack trace:

Workqueue: uvcgadget uvcg_video_pump.c51fb85fece46625450f86adbf92c56c.cfi_jt
pstate: 60c00085 (nZCv daIf +PAN +UAO -TCO BTYPE=--)
pc : __list_del_entry_valid+0xc0/0xd4
lr : __list_del_entry_valid+0xc0/0xd4
Call trace:
  __list_del_entry_valid+0xc0/0xd4
  uvc_video_free_request+0x60/0x98
  uvcg_video_pump+0x1cc/0x204
  process_one_work+0x21c/0x4b8
  worker_thread+0x29c/0x574
  kthread+0x158/0x1b0
  ret_from_fork+0x10/0x30

The root cause is that uvcg_video_usb_req_queue frees the uvc_request
if is_enabled is false and returns an error status. video_pump also
frees the associated request if uvcg_video_usb_req_queue returns an
error status, leading to double free and accessing garbage memory.

To fix the issue, this patch removes freeing logic from
uvcg_video_usb_req_queue, and lets the callers to the function handle
queueing errors as they see fit.

Fixes: 6acba034 ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests")
Tested-by: Avichal Rakesh <arakesh@google.com>
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20240104215009.2252452-1-arakesh@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 5962ded7

drivers/usb/gadget/function/uvc_video.c

+10 −4

Original line number	Diff line number	Diff line
		@@ -276,10 +276,9 @@ static int uvcg_video_usb_req_queue(struct uvc_video *video,
		bool is_bulk = video->max_payload_size;
		struct list_head *list = NULL;

		if (!video->is_enabled) {
		uvc_video_free_request(req->context, video->ep);
		if (!video->is_enabled)
		return -ENODEV;
		}

		if (queue_to_ep) {
		struct uvc_request *ureq = req->context;
		/*
		@@ -464,8 +463,15 @@ uvc_video_complete(struct usb_ep ep, struct usb_request req)
		* and this thread for isoc endpoints.
		*/
		ret = uvcg_video_usb_req_queue(video, to_queue, !is_bulk);
		if (ret < 0)
		if (ret < 0) {
		/*
		* Endpoint error, but the stream is still enabled.
		* Put request back in req_free for it to be cleaned
		* up later.
		*/
		uvcg_queue_cancel(queue, 0);
		list_add_tail(&to_queue->list, &video->req_free);
		}
		} else {
		uvc_video_free_request(ureq, ep);
		}