[PATCH 0/1] USB: cdc-acm: skip URB restart in port_shutdown if disconnected

[PATCH 0/1] USB: cdc-acm: skip URB restart in port_shutdown if disconnected

[Yuchao Zhang]

Hi Greg and USB maintainers,

This patch fixes a use-after-free race in drivers/usb/class/cdc-acm.c
introduced by commit f58752ebcb35 ("USB: cdc-acm: Add quirks for Yoga
Book 9 14IAH10 INGENIC touchscreen").

Problem:

When a CDC-ACM device is unplugged, acm_disconnect() sets
acm->disconnected = true and then calls tty_port_tty_vhangup(), which
eventually triggers acm_port_shutdown() from the tty-port layer.

acm_disconnect() has already called acm_poison_urbs() at this point
and is about to proceed to usb_free_urb() and usb_free_coherent()
for all control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs()
and — when the ALWAYS_POLL_CTRL quirk is set — immediately re-submits
the ctrlurb and read URBs via usb_submit_urb() and
acm_submit_read_urbs().

If acm_disconnect() then frees those URBs and their DMA buffers while
they are still in flight, acm_ctrl_irq() or acm_read_bulk_callback()
will fire and access freed DMA memory, causing a kernel use-after-free.

Fix:

Add an early return in acm_port_shutdown() after the delayed-anchor
drain loop when acm->disconnected is set.  This keeps the URBs
poisoned and prevents any resubmission during the disconnect path.

The fix is a 2-line guard, no locking changes or functional impact on
the normal (non-disconnect) tty-close path.

Yuchao Zhang (1):
  USB: cdc-acm: skip URB restart in port_shutdown if disconnected

 drivers/usb/class/cdc-acm.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.53.0

[PATCH 1/1] USB: cdc-acm: skip URB restart in port_shutdown if disconnected

[Yuchao Zhang]

acm_port_shutdown() is called from the tty-port machinery whenever the
last user closes the port.  acm_disconnect() sets acm->disconnected and
calls tty_port_tty_vhangup(), which eventually triggers port_shutdown().
At that point acm_disconnect() has already called acm_poison_urbs() and
is about to free the control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs()
and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the
ctrlurb and all read URBs.  If the concurrent acm_disconnect() then
frees those URBs and their DMA buffers while they are in-flight, the
result is a use-after-free in acm_ctrl_irq() or acm_read_bulk_callback()
accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and
returning early: if we are in a disconnect path the URBs must remain
poisoned and must not be resubmitted.

The early return is placed after the delayed-anchor drain loop because
that loop only cancels write-side accounting (wb->use = false and
autopm counter) and does not touch the hardware path.

Fixes: f58752ebcb35 ("USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
---
 drivers/usb/class/cdc-acm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 7bc5329fa3ed..a7ef89a8da84 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -788,6 +788,9 @@ static void acm_port_shutdown(struct tty_port *port)
 		usb_autopm_put_interface_async(acm->control);
 	}
 
+	if (acm->disconnected)
+		return;
+
 	acm_unpoison_urbs(acm);
 
 	if (acm->quirks & ALWAYS_POLL_CTRL) {
-- 
2.53.0