From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f177.google.com (mail-qk1-f177.google.com [209.85.222.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDB6B385D7E for ; Fri, 14 Aug 2026 22:23:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786746202; cv=none; b=Koxg9ikawuPdv75Dc9RQAbFTQOpvgtaifLFzmpexETLhYl8n7KpuCk9mdOcC0UcHYWuefmxqBLP1xF7hG7Twu3MZh3YUKNkV/3C8leO+XHvYnfQAXazuCGLYhx5e/FseNPq1G+oFiFewz+YdoTP00Uz68F/j3ogiHmCXJNHZQ6c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786746202; c=relaxed/simple; bh=mqSJttTdo+n0mPl2WuY2VUEG5F4GmpsRn26cLo+5jQ0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YULoo44jr5WS8IObLDc5zAMYi7QRh0yhJzcCyObWqjdqey1FQVdmfVs44h5VnyhmPaF+HVeu01huGCTf0S9B/0Is8A3mzXfXkmcLi6nomCrgqoHjGXXNC0krQzXEWg5uHIRuxKG2dqxRN+UTxyviHPf/s3YBH5gyoAVuJL0skTM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oBc3fJtZ; arc=none smtp.client-ip=209.85.222.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oBc3fJtZ" Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-930c0f9c1b1so90005985a.1 for ; Fri, 14 Aug 2026 15:23:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786746199; x=1787350999; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=08sUbb6fujQhCY3IeGKjx4yAsK5SOx6MmNZ5dS/j5Rs=; b=oBc3fJtZmDpqCxlciULifR/NG/jzZdNIF3cKZJL7qbsvGjsCF6PQBMi1wVxC/zSapg wWNIOEa6ZpeQ62eO5lgm6FbwXwDCkpBdHkeeG0cL0nwB46Oz+qHNw1X7FlaCZCb79mWa sQ2hn0s0IdHko1TZIPlKYXSd6/fLhNY6rZ4N3YeHulvgBxJyS/f50MpNS2tRSXf9br37 T+yox3jI2b8iBGRQFMTB9mz5313Cg/Uw+ml6neVDtgyGZv13P2BguV98tXwWtqL8BfID hIYY8wmmIJw8q4iXYXXRDG14roaZcYlFzTLqT1vn4WN8gQYnl2kbUG3ZdpnvajykHgRA iCmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786746199; x=1787350999; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=08sUbb6fujQhCY3IeGKjx4yAsK5SOx6MmNZ5dS/j5Rs=; b=Zz2Vr60ImOsihO8ytYECxX7KoEaRWwepaMOpa2cz13eTJ+GVfqkVl9Z+cltqmn+XTo nz4b30SLbMqjOe7Mx611b2JKOlgBskVoQHUomzEnLrhQ1o8iT+MSLfmS9MDjIgvbarjH 33nP1MKi84uWoBBjKYHytMlqrZL6EJd51wCoB+qR67OmX12SU+1KAAyXgWjVPgOoNJcZ vhyq1LwFksyftbJ1TJK/o+OEEmoesPjbgb2O8nHW0zq7JZpXswYEXrkCF7tHOTiqkw1s Cx0Qm0dJyP/Nemrh08POB73b3vPmQZQfGNJZQFyRgJJ3Zbyii26eE3ezQxX/KKU0p0wo Z3Gw== X-Forwarded-Encrypted: i=1; AHgh+RoFUszJWq0TI20nvAjva28z7K5NweCnjk1hpXqUBf4blGI06VnLSxK7PA966/nsRHLlYeSmnjtqPrLP1S4=@vger.kernel.org X-Gm-Message-State: AOJu0Yyn9GdyMjfjqFqTNjhDekvsUuJi4CkLgFza9oDflB/p2I5wyKyV rpctN2f99ulGbKLtAP0ws7rlfr7n8m9lMaTAKzF8bo4aQwBiI8smzd5B X-Gm-Gg: AR+sD11eJitFD0svH8NYvbWMpxBhx07aZZhvacRb6ioZatH9+fauRCdSF2HOyKS+CKA J9EOjtPf9ktCL402OG/+y+zuSh+dIOZo6R5QerGLoduD7UjryIhA/2CCoLmTP27oZq9+iFYXPKu wmrhZ8DvEKQ7Q0kV/rr8b/n6OxmQ9URt8tIG1vUbS+5NIzbNimpGlq6m/vP5uG7q+8xl1Phzg/c kCKxmqoMkV3v9YNkhIMXm2EN1DqdB3M0m7zes6xgsekTBW9u7IjgL9w/hCXv9L8apbvlBUA8jia DjIVTxid94KWC8pwgOzHQ/Y9SwSF+lS4gMFS4x/GtZW8IQVDA1t/IvF33y9/aTK0kmEZjL9kI2J LGpvY97qqQ6RXAkkgUEi1bKHrvl+tIEPRPPOzc7f+c7txPEoJk4m+6/ie9fr8LbdYH8sLbTg83Y +9nEb5v6q9TpmQYzz9hC2jLkzHCm1QE+D0hALlqa8K/GJDLyvSosIUcokKE6TcKPlf+lgdljXP8 l+45l4n81oYNVJ+nA== X-Received: by 2002:a05:620a:2804:b0:915:9fba:8794 with SMTP id af79cd13be357-936d2248b7emr1070690285a.6.1786746198687; Fri, 14 Aug 2026 15:23:18 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id af79cd13be357-936ce1ea6cfsm381481985a.27.2026.08.14.15.23.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 15:23:18 -0700 (PDT) From: Shuangpeng Bai To: gregkh@linuxfoundation.org Cc: dan.scally@ideasonboard.com, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Shuangpeng Bai , stable@vger.kernel.org Subject: [PATCH] usb: gadget: uvc: fix use-after-free in extension drop Date: Fri, 14 Aug 2026 18:22:54 -0400 Message-ID: <20260814222254.4104235-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit uvcg_extension_make() adds a newly allocated extension unit to the extension_units list before configfs attaches the item. If attaching the item fails, configfs unlinks it and invokes the drop callback during error cleanup. On this path, config_item_put() in uvcg_extension_drop() can drop the last reference and free the extension unit. The subsequent list_del() and descriptor cleanup then access the freed object. Remove the extension unit from the list and free its descriptors while the config item still holds the object alive. Drop the config item reference only after all accesses to the extension unit are complete. Fixes: 0525210c9840 ("usb: gadget: uvc: Allow definition of XUs in configfs") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- drivers/usb/gadget/function/uvc_configfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c index 70a1415ea401..86facba5109f 100644 --- a/drivers/usb/gadget/function/uvc_configfs.c +++ b/drivers/usb/gadget/function/uvc_configfs.c @@ -1256,12 +1256,13 @@ static void uvcg_extension_drop(struct config_group *group, struct config_item * mutex_lock(&opts->lock); - config_item_put(item); list_del(&xu->list); kfree(xu->desc.baSourceID); kfree(xu->desc.bmControls); mutex_unlock(&opts->lock); + + config_item_put(item); } static struct config_item *uvcg_extension_make(struct config_group *group, const char *name) -- 2.43.0