* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
@ 2026-08-26 23:32 ` Hillf Danton
2026-08-26 23:33 ` syzbot
2026-08-26 23:46 ` Hillf Danton
` (6 subsequent siblings)
7 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2026-08-26 23:32 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
#syz test
--- x/drivers/usb/usbip/stub_rx.c
+++ y/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ num_urbs = priv->num_urbs;
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
2026-08-26 23:32 ` Hillf Danton
@ 2026-08-26 23:46 ` Hillf Danton
2026-08-26 23:46 ` syzbot
2026-08-27 0:06 ` Hillf Danton
` (5 subsequent siblings)
7 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2026-08-26 23:46 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
#syz test
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 25d77d4a1061..763f79806bd8 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ num_urbs = priv->num_urbs;
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
2026-08-26 23:32 ` Hillf Danton
2026-08-26 23:46 ` Hillf Danton
@ 2026-08-27 0:06 ` Hillf Danton
2026-08-27 0:06 ` syzbot
2026-08-27 0:17 ` Hillf Danton
` (4 subsequent siblings)
7 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2026-08-27 0:06 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
#syz test
---
drivers/usb/usbip/stub_rx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae57..26233ca 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ num_urbs = priv->num_urbs;
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-27 0:06 ` Hillf Danton
@ 2026-08-27 0:06 ` syzbot
0 siblings, 0 replies; 18+ messages in thread
From: syzbot @ 2026-08-27 0:06 UTC (permalink / raw)
To: hdanton; +Cc: hdanton, linux-kernel, syzkaller-bugs
>> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
>> syzbot has found a reproducer for the following issue on:
>>
>> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
>> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
>> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
>> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
>
> #syz test
"" does not look like a valid git branch or commit.
>
> ---
> drivers/usb/usbip/stub_rx.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
> index 1e9ae57..26233ca 100644
> --- a/drivers/usb/usbip/stub_rx.c
> +++ b/drivers/usb/usbip/stub_rx.c
> @@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
> return;
>
> /* urb is now ready to submit */
> - for (i = 0; i < priv->num_urbs; i++) {
> + num_urbs = priv->num_urbs;
> + for (i = 0; i < num_urbs; i++) {
> if (!is_tweaked) {
> ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
>
> --
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
` (2 preceding siblings ...)
2026-08-27 0:06 ` Hillf Danton
@ 2026-08-27 0:17 ` Hillf Danton
2026-08-27 0:18 ` syzbot
2026-08-27 0:20 ` Hillf Danton
` (3 subsequent siblings)
7 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2026-08-27 0:17 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs, Hillf Danton
> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
#syz test
syzbot reported a uaf in stub_rx_loop(), so see if it happened after the
complete callback.
Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
Signed-off-by: Hillf Danton <hdanton@sina.com>
---
drivers/usb/usbip/stub_rx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae57..26233ca 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ num_urbs = priv->num_urbs;
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-27 0:17 ` Hillf Danton
@ 2026-08-27 0:18 ` syzbot
0 siblings, 0 replies; 18+ messages in thread
From: syzbot @ 2026-08-27 0:18 UTC (permalink / raw)
To: hdanton; +Cc: hdanton, linux-kernel, syzkaller-bugs
>> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
>> syzbot has found a reproducer for the following issue on:
>>
>> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
>> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
>> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
>> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
>
> #syz test
"" does not look like a valid git branch or commit.
>
> syzbot reported a uaf in stub_rx_loop(), so see if it happened after the
> complete callback.
>
> Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
> Signed-off-by: Hillf Danton <hdanton@sina.com>
> ---
> drivers/usb/usbip/stub_rx.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
> index 1e9ae57..26233ca 100644
> --- a/drivers/usb/usbip/stub_rx.c
> +++ b/drivers/usb/usbip/stub_rx.c
> @@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
> return;
>
> /* urb is now ready to submit */
> - for (i = 0; i < priv->num_urbs; i++) {
> + num_urbs = priv->num_urbs;
> + for (i = 0; i < num_urbs; i++) {
> if (!is_tweaked) {
> ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
>
> --
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
` (3 preceding siblings ...)
2026-08-27 0:17 ` Hillf Danton
@ 2026-08-27 0:20 ` Hillf Danton
2026-08-27 0:21 ` syzbot
2026-08-27 0:25 ` Hillf Danton
` (2 subsequent siblings)
7 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2026-08-27 0:20 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs, Hillf Danton
> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
#syz test upstream
syzbot reported a uaf in stub_rx_loop(), so see if it happened after the
complete callback.
Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
Signed-off-by: Hillf Danton <hdanton@sina.com>
---
drivers/usb/usbip/stub_rx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae57..26233ca 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ num_urbs = priv->num_urbs;
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-27 0:20 ` Hillf Danton
@ 2026-08-27 0:21 ` syzbot
0 siblings, 0 replies; 18+ messages in thread
From: syzbot @ 2026-08-27 0:21 UTC (permalink / raw)
To: hdanton; +Cc: hdanton, linux-kernel, syzkaller-bugs
>> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
>> syzbot has found a reproducer for the following issue on:
>>
>> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
>> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
>> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
>> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
>
> #syz test upstream
I've failed to parse your command.
Did you perhaps forget to provide the branch name, or added an extra ':'?
Please use one of the two supported formats:
1. #syz test
2. #syz test: repo branch-or-commit-hash
Note the lack of ':' in option 1.
>
> syzbot reported a uaf in stub_rx_loop(), so see if it happened after the
> complete callback.
>
> Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
> Signed-off-by: Hillf Danton <hdanton@sina.com>
> ---
> drivers/usb/usbip/stub_rx.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
> index 1e9ae57..26233ca 100644
> --- a/drivers/usb/usbip/stub_rx.c
> +++ b/drivers/usb/usbip/stub_rx.c
> @@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
> return;
>
> /* urb is now ready to submit */
> - for (i = 0; i < priv->num_urbs; i++) {
> + num_urbs = priv->num_urbs;
> + for (i = 0; i < num_urbs; i++) {
> if (!is_tweaked) {
> ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
>
> --
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
` (4 preceding siblings ...)
2026-08-27 0:20 ` Hillf Danton
@ 2026-08-27 0:25 ` Hillf Danton
2026-08-27 2:12 ` syzbot
2026-08-27 0:46 ` Edward Adam Davis
2026-08-27 1:21 ` [PATCH] usbip: prevent priv from uaf in cmd submit Edward Adam Davis
7 siblings, 1 reply; 18+ messages in thread
From: Hillf Danton @ 2026-08-27 0:25 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs, Hillf Danton
> Date: Wed, 26 Aug 2026 09:49:36 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=151ce979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a28d49580000
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 818bebeb63dd
syzbot reported a uaf in stub_rx_loop(), so see if it happened after the
complete callback.
Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
Signed-off-by: Hillf Danton <hdanton@sina.com>
---
drivers/usb/usbip/stub_rx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae57..26233ca 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ num_urbs = priv->num_urbs;
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
2026-08-26 16:49 ` syzbot
` (5 preceding siblings ...)
2026-08-27 0:25 ` Hillf Danton
@ 2026-08-27 0:46 ` Edward Adam Davis
2026-08-27 2:31 ` syzbot
2026-08-27 1:21 ` [PATCH] usbip: prevent priv from uaf in cmd submit Edward Adam Davis
7 siblings, 1 reply; 18+ messages in thread
From: Edward Adam Davis @ 2026-08-27 0:46 UTC (permalink / raw)
To: syzbot+06fa667a0931a3430026; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 818bebeb63dd
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae578810d..85370b3bc600 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
^ permalink raw reply [flat|nested] 18+ messages in thread* [PATCH] usbip: prevent priv from uaf in cmd submit
2026-08-26 16:49 ` syzbot
` (6 preceding siblings ...)
2026-08-27 0:46 ` Edward Adam Davis
@ 2026-08-27 1:21 ` Edward Adam Davis
2026-09-23 13:25 ` Shuah Khan
7 siblings, 1 reply; 18+ messages in thread
From: Edward Adam Davis @ 2026-08-27 1:21 UTC (permalink / raw)
To: syzbot+06fa667a0931a3430026
Cc: gregkh, i, linux-kernel, linux-usb, shuah, syzkaller-bugs,
valentina.manea.m, suwan.kim027
The num_urbs is 1, and the request is not special, so it is not tweaked.
After stub_complete() executes, priv is added to the tx queue.
stub_tx_loop() immediately dequeues it and frees priv; the subsequent
loop iteration then checks priv->num_urbs, which ultimately triggers [1].
Use num_urbs directly to avoid accessing the already-freed priv.
[1]
BUG: KASAN: slab-use-after-free in stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:609 [inline]
Read of size 4 at addr ffff888034999db0 by task stub_rx/6028
Call Trace:
stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:609 [inline]
stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
stub_rx_loop+0x2d3b/0x31c0 drivers/usb/usbip/stub_rx.c:707
Allocated by task 6028:
stub_priv_alloc drivers/usb/usbip/stub_rx.c:314 [inline]
stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:490 [inline]
stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
stub_rx_loop+0x638/0x31c0 drivers/usb/usbip/stub_rx.c:707
Freed by task 6029:
stub_free_priv_and_urb+0x427/0x570 drivers/usb/usbip/stub_main.c:321
stub_send_ret_submit+0xecf/0x1810 drivers/usb/usbip/stub_tx.c:333
stub_tx_loop+0xe2/0x3e0 drivers/usb/usbip/stub_tx.c:437
Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver")
Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
drivers/usb/usbip/stub_rx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae578810d..85370b3bc600 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -606,7 +606,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
return;
/* urb is now ready to submit */
- for (i = 0; i < priv->num_urbs; i++) {
+ for (i = 0; i < num_urbs; i++) {
if (!is_tweaked) {
ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
--
2.43.0
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [PATCH] usbip: prevent priv from uaf in cmd submit
2026-08-27 1:21 ` [PATCH] usbip: prevent priv from uaf in cmd submit Edward Adam Davis
@ 2026-09-23 13:25 ` Shuah Khan
0 siblings, 0 replies; 18+ messages in thread
From: Shuah Khan @ 2026-09-23 13:25 UTC (permalink / raw)
To: Edward Adam Davis, syzbot+06fa667a0931a3430026
Cc: gregkh, i, linux-kernel, linux-usb, shuah, syzkaller-bugs,
valentina.manea.m, suwan.kim027, Shuah Khan
On 8/26/26 19:21, Edward Adam Davis wrote:
> The num_urbs is 1, and the request is not special, so it is not tweaked.
> After stub_complete() executes, priv is added to the tx queue.
> stub_tx_loop() immediately dequeues it and frees priv; the subsequent
> loop iteration then checks priv->num_urbs, which ultimately triggers [1].
>
> Use num_urbs directly to avoid accessing the already-freed priv.
>
> [1]
> BUG: KASAN: slab-use-after-free in stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:609 [inline]
> Read of size 4 at addr ffff888034999db0 by task stub_rx/6028
> Call Trace:
> stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:609 [inline]
> stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
> stub_rx_loop+0x2d3b/0x31c0 drivers/usb/usbip/stub_rx.c:707
>
> Allocated by task 6028:
> stub_priv_alloc drivers/usb/usbip/stub_rx.c:314 [inline]
> stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:490 [inline]
> stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
> stub_rx_loop+0x638/0x31c0 drivers/usb/usbip/stub_rx.c:707
>
> Freed by task 6029:
> stub_free_priv_and_urb+0x427/0x570 drivers/usb/usbip/stub_main.c:321
> stub_send_ret_submit+0xecf/0x1810 drivers/usb/usbip/stub_tx.c:333
> stub_tx_loop+0xe2/0x3e0 drivers/usb/usbip/stub_tx.c:437
>
> Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver")
> Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
> drivers/usb/usbip/stub_rx.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
> index 1e9ae578810d..85370b3bc600 100644
> --- a/drivers/usb/usbip/stub_rx.c
> +++ b/drivers/usb/usbip/stub_rx.c
> @@ -606,7 +606,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
> return;
>
> /* urb is now ready to submit */
> - for (i = 0; i < priv->num_urbs; i++) {
> + for (i = 0; i < num_urbs; i++) {
> if (!is_tweaked) {
> ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
>
This fix is incorrect. if priv is being free'd it has to be handled differently
and not by using num_urbs. priv is accessed in this loop.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 18+ messages in thread