From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EAF113FBB4E for ; Mon, 27 Jul 2026 12:34:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785155663; cv=none; b=W4YUTzfSJfCoXbepjZ8XfhxXCQyYY4tsqqiC571ju4ngvIV0Q2i5i7+8e+kaEvnxB2q1dPAtZnCr1dqqJVPLFvjSX61OdOvbrx2E4YW6QZKOAFNLwm5IFTerIpp3nh50m+ZwAEGrFWwy4z6Ha9zgTdGzoVQAsh4q5jUwh5ze42A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785155663; c=relaxed/simple; bh=tnL9O9Z7eVZ+EFi12OyJIwP3KzopoQRB3H0/5ZGueNY=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=Dzh1alaTXsHbvfXpDKSMIStpXfUVzH92AQ+pbWLQROdCrIODkqr2v8ZFvVa5usON/icSqoR6NuNoeMkt688YOPXbzRd5nXt+uAOxNyKXUtT44NygX1+IsdOqjMXDpl5GQszy4cBBs3qo5TXqinSjyYYmmCUNGx7z3JX2xhGtgyA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SDncjdFY; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SDncjdFY" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38f0f132f56so1711309a91.0 for ; Mon, 27 Jul 2026 05:34:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785155661; x=1785760461; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ad864FHAlhdgy4F9Sp08C6CuMiqJx6RHQkPj5GQwqjE=; b=SDncjdFYndxVcFvM4eSwH7OQqOIvZnH4dVWQvnlBgY+EFIih2pmUc15WrN9F9salVr j76hgjufrGZy8QIz+lKdhIMEYIdvzMGT1Qo/39OH9OJlU2uo7uYCGRTpMEKra119DmNJ uSQzZTA/YXLsD4ZuO7Yi2K/CKIbw7gwCv5GBeHzLdXfje4aquWX98TsibJLxAWKI/7bX bfnHGZUVws3ZOe/4EkxTtLyOcNA7/Ik3fqDo8U5FEHk2m/Hu2dbEtJWJcCtzHnYGt/Cd SzcAkTdLh1sHlBsSyB8P4k+Ka9A5LX6ic7ZHiYPxEPzKEwxw9xrPqBPH09NSU9aknPds aRfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785155661; x=1785760461; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ad864FHAlhdgy4F9Sp08C6CuMiqJx6RHQkPj5GQwqjE=; b=LHN8v9VTXUBVkrKGV7c49hUMT2JmY2zPtJKz4Zin/x2BffXP7PL+tx6HwZRgPMv3FS 3BLGo4/ZeSB2+Vwp8wMkwV6Fa2mP5qGqCEPX0UdJ+P3aORilSZ/Vq1v5ScIzzMpQhQAH yfQlDkNsvxSFpEqdoSQOa3OVqnQHiGlAb0oltVAZJJADQffiF4s4bECRjbeLr7xrxgIT b/n3Bjb09kDO5Rb6le0ZhDwhbmGRJl31z1lg6UlcUajJjJT05Sev5dJ9X5+jeZdK1YgB v5AVOZKjl/904M5QCD7yutbOD4G0djw7OW302EcrCm9A0opdG4l4hZgk04//Y912a0CB WCuQ== X-Forwarded-Encrypted: i=1; AHgh+RpsRpLjGkOxtmwaR//KbfHM4xeA5W9RUpVnHC/YOw2i5VdAYk9l0O5SG8/sCj2eGWPR5tOGjUipOBBYOO0=@vger.kernel.org X-Gm-Message-State: AOJu0YxVXBjE9R6fjE/2YBKhtnJEP0Sy/ODszLsaNVJwxU00agxPnWeO hq4sG0+ZTHbFxdcnVEtVfKqbx9q4JyYqoWWM4RlDa4yYysWhUzrrxjE= X-Gm-Gg: AR+sD12aHOzzwy3Yd4ntPFebMuHoJTGgEm5CVOo7t7+sbYkMoK6gKizQaBi6xgXSUxB /FOZLL36hHQaCSFZhdh5vkk13eBdi/gNyV1Gcd10i8dMCB6PlHaI8CP1C5wiEs+yrbBmkA+sa0A OEX3TkhI/yxucNNXXhvDXwgYU5G3Npj7s53NYqOayXLqQbHBHsBH2HePKlYOiRgkohn9hFaRTrg H8pL+fEmmgXXeqovrj7UNqUGehjRDVKRTU7xRJp1FjxYHmmLx/tEQq8PbiZbt2B1QcsyxKY9/jF /CQeoJXZCw5eqOaGssYFrFhkKzAfw6ttSYxL1MfbOU3qgd7iPQWmOeYhfntMZbbU31KG0YBOb/o 4m3Mqe5+tyl+vJ/prVF0r3LHiML4xlhOc8MVUoqG5fMppawGqNmGIiHraTniOl0lsNSAwyGix7L 8m036EO6AeXDlCj5fE7KIFYyungGV8t83NfVGmgyFu+o5Gi5CZZtopbYmiEEsDFA3cd67Bmfr4s k4cax0lhr9vittPuaSQaz1atCxcHfzb1KOb6vzyZP+w6AJHqRiOsRA= X-Received: by 2002:a17:90b:554f:b0:387:d5bd:6231 with SMTP id 98e67ed59e1d1-38f2aacfdadmr5837955a91.20.1785155661178; Mon, 27 Jul 2026 05:34:21 -0700 (PDT) Received: from localhost.localdomain ([121.147.145.153]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38f03ad817esm4956993a91.4.2026.07.27.05.34.18 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 27 Jul 2026 05:34:20 -0700 (PDT) From: Myeonghun Pak To: Alan Stern Cc: Greg Kroah-Hartman , edwin_rong , Ijae Kim , linux-usb@vger.kernel.org, usb-storage@lists.one-eyed-alien.net, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] usb: storage: realtek_cr: fix use-after-free on disconnect Date: Mon, 27 Jul 2026 21:34:14 +0900 Message-Id: <20260727123414.44700-1-mhun512@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a use-after-free. Use timer_shutdown_sync() to wait for the callback and prevent further rearming. Do this unconditionally because ss_en may be changed after the timer is armed. Move timer_setup() into init_realtek_cr() so the timer is initialized before any failure path can invoke the destructor. Found by static analysis. Fixes: e931830bb877 ("Realtek cr: Add autosuspend function.") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/usb/storage/realtek_cr.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c index af038b897c6b..c4b28744693b 100644 --- a/drivers/usb/storage/realtek_cr.c +++ b/drivers/usb/storage/realtek_cr.c @@ -916,7 +916,6 @@ static int realtek_cr_autosuspend_setup(struct us_data *us) us->proto_handler = rts51x_invoke_transport; chip->timer_expires = 0; - timer_setup(&chip->rts51x_suspend_timer, rts51x_suspend_timer_fn, 0); fw5895_init(us); /* enable autosuspend function of the usb device */ @@ -934,10 +933,7 @@ static void realtek_cr_destructor(void *extra) return; #ifdef CONFIG_REALTEK_AUTOPM - if (ss_en) { - timer_delete(&chip->rts51x_suspend_timer); - chip->timer_expires = 0; - } + timer_shutdown_sync(&chip->rts51x_suspend_timer); #endif kfree(chip->status); } @@ -982,6 +978,9 @@ static int init_realtek_cr(struct us_data *us) us->extra = chip; us->extra_destructor = realtek_cr_destructor; +#ifdef CONFIG_REALTEK_AUTOPM + timer_setup(&chip->rts51x_suspend_timer, rts51x_suspend_timer_fn, 0); +#endif us->max_lun = chip->max_lun = rts51x_get_max_lun(us); chip->us = us; -- 2.47.1