From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C98453E9F7D for ; Thu, 18 Jun 2026 12:40:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781786439; cv=none; b=ArmgHI+eEuTXNGxxm3s1jflbWjIBP8kJAwTqEk9uoaDQO7fb+PaA8oQuAqAEhVIDtmopsFcm2PFD1+mYGC2fhq4cfJPx1FZ4BzCJOiX4qdr5WIlTDmplQB6kI4G/9JKaGZ00mvazqIOBsx5MGNHziznJpUmhAa+GfhU0HL9Gvd0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781786439; c=relaxed/simple; bh=26V5SDUbDp8lGf2dtZE0/EVVRB0FC6Q8kCIxc65KvfM=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=thmhN/ZbgibDIRoJCFx2X3ePJFD8i1MSJlZANC58gt1nAurCeRDyDKUIBO284PfQbyNq6Sy9JISzGzmyJG0UKk0to+w1yeDLBK1AS/Ey25Y3Jb1KkeEln4Ew71UItz3J0MQ4L3Ky0w98JXLQwwUieV6fjKEilTfn8htIFDcWWkc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LiVTzSeu; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LiVTzSeu" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-37c8e7c8137so401452a91.1 for ; Thu, 18 Jun 2026 05:40:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781786436; x=1782391236; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Em4soZVbEstplz9Ebabbr+wHmpAw7PoPCOmv3WbAhgg=; b=LiVTzSeu++DarUmG+kEZbOACnzjhyd2JU9FrE4MK9CjUilwOvcLJJP+2leGdtD4geq Njtr4Gso3xE1ujvRxIy3l1JY+zImSzssWQmomjNq5oKxzFzi3/3qDpBinUlfuDwLw+ti 9lBD27u4Ex69CmyaOIGuKfSVx7+A8K/Psi3gLnxBopYuyFbb2ZzuVRXA3ighK2rdpQKQ WSZqSXf30oUHlSa+1yeB3hdQfrKnz5itDuySDloViqYQn7gjmyjtoRqxchyPLgZ1CcqT izVxvDstvof+sq7AFoamP4/3F9b7wk28TziVyA1iwWfdnaZ4gJ1l5oswIucqFnPnR43Q IGEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781786436; x=1782391236; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Em4soZVbEstplz9Ebabbr+wHmpAw7PoPCOmv3WbAhgg=; b=Hiai7VDZXhZ/sPhjUyRG0ElXDYi3up9ka0k4LQbWeKMpCKfBRxMl3coT1MIzXslQO5 X1eYAWXGl5q+PhcfedIM674AQGq2NLvoC7D1WIbhnlAxz7XHAvXTPKBcAH2zWIhx7ZVB nm8YFQbtSNIYOHKsoIGThDlowSCOkuRXzN6jDhEkzxkyECrTWIT4HYiUgxvakewrpw7e 884Oktas7/WR6unj+Fl1RWL5ZRfGrtTye2n5yHFbtsR3xuyY23pwWHy956ZU33pPApZ3 XTUy98Sk/BJRmggq7cFwjvVwxwHETxFD9+DKhHjI/u6y3BxUm0CyYj7oJ5ZX1T4/p2Lm 6pEA== X-Forwarded-Encrypted: i=1; AFNElJ+vKtWWf/F9Lan0Y1nZmZ39emnf8U0gyNEpsEZ6zSCY4xRDRjuSHJfx7NX4zzt2hz990tJwpNRw6cdrPBE=@vger.kernel.org X-Gm-Message-State: AOJu0Yyd5dfFecjJaqKShnczJPPoabkdt8f2sQI5+7kNFe0cgxYPKqjM 5EBoF6/hU5JAG/HVfzwGkYWwM4Z5eEm1/K5XhMhazanDpv3/OgVZQ8id X-Gm-Gg: AfdE7cnJcFqIpER9fyfg8hXpDnKJg33GA8UZ7PxUlwGPGZZFkKL4ONrt9sRyzN/tzOx Iu2CHujzFpdLIDhqAVdGtjluifeLH9F5uQjhP+PktHNkK6oZ7CG6UwQFK1fYsV9kiPSXdNyYi9M Kfurn54VrcxtJRtYN4toWCDieqNUZBBEhGXdRhOx4JcY73lLtQQ2s75zZttngX7NYiPZzKOAi2A WGNRyF+OGLQn0X4ZwCdAKSF7e+In2vrQMaufw7TuAHEjr5109iDGlIr7YMFKpoHApgjXHTgJv+N Y0Viu8IfJCFTf8bJmuv4PupEMTUoHkJhAxxC6sm9nZH1RQGnyt0VWLNAE+BBP4T3hQODoWh2/WL JeRSzJzXPJT/LHVE3j9blH9DqKm20ZTUDjukd3KILlS/vW5+18zIrkr1SJ24nE6XlerjYLXaIAz kKmjEXgks= X-Received: by 2002:a17:90b:1a8e:b0:37c:63fc:b2fb with SMTP id 98e67ed59e1d1-37c9ebe9457mr8374915a91.22.1781786435944; Thu, 18 Jun 2026 05:40:35 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37c52092ee3sm9765839a91.0.2026.06.18.05.40.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Jun 2026 05:40:35 -0700 (PDT) From: Cen Zhang To: Israel Cepeda , Hans de Goede , Sakari Ailus , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, baijiaju1990@gmail.com, zzzccc427@gmail.com Subject: [PATCH v2] usb: misc: usbio: fix disconnect UAF in client teardown Date: Thu, 18 Jun 2026 20:40:29 +0800 Message-Id: <20260618124029.3704089-1-zzzccc427@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for an unbound child that can run usbio_auxdev_release() and free the containing struct usbio_client. list_for_each_entry_reverse() advances after the loop body by reading client->link.prev. If the current client is freed by auxiliary_device_uninit(), the iterator dereferences freed memory. Use list_for_each_entry_safe_reverse() so the previous client is cached before the body can drop the final reference. This preserves reverse teardown order while keeping the next iterator cursor independent of the current client's lifetime. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? usbio_disconnect+0x12e/0x150 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? usbio_disconnect+0x12e/0x150 kasan_report+0xe0/0x110 ? usbio_disconnect+0x12e/0x150 usbio_disconnect+0x12e/0x150 usb_unbind_interface+0xf3/0x400 really_probe+0x316/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x44/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0xea/0x1a0 ? srso_alias_return_thunk+0x5/0xfbef5 ? usb_enable_lpm+0x3c/0x260 usb_set_configuration+0xb64/0xf20 usb_generic_driver_probe+0x5f/0x90 usb_probe_device+0x71/0x1b0 really_probe+0x46b/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? add_device_randomness+0xb7/0xf0 usb_new_device+0x492/0x870 hub_event+0x1b10/0x29c0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x187/0x300 ? process_one_work+0x475/0xb90 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0xc8/0x290 ? srso_alias_return_thunk+0x5/0xfbef5 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver") Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang --- v2: Drop the unnecessary list_del_init() per Hans de Goede; the safe reverse iterator is sufficient. drivers/usb/misc/usbio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c index 02d1e0760f0c..0e5ccd2f04d8 100644 --- a/drivers/usb/misc/usbio.c +++ b/drivers/usb/misc/usbio.c @@ -518,7 +518,7 @@ static int usbio_resume(struct usb_interface *intf) static void usbio_disconnect(struct usb_interface *intf) { struct usbio_device *usbio = usb_get_intfdata(intf); - struct usbio_client *client; + struct usbio_client *client, *next; /* Wakeup any clients waiting for a reply */ usbio->rxdat_len = 0; @@ -535,7 +535,7 @@ static void usbio_disconnect(struct usb_interface *intf) usb_kill_urb(usbio->urb); usb_free_urb(usbio->urb); - list_for_each_entry_reverse(client, &usbio->cli_list, link) { + list_for_each_entry_safe_reverse(client, next, &usbio->cli_list, link) { auxiliary_device_delete(&client->auxdev); auxiliary_device_uninit(&client->auxdev); } -- 2.43.0