Re: [PATCH] usb: gadget: u_serial: implement flush_buffer

Re: [PATCH] usb: gadget: u_serial: implement flush_buffer

[Mehmet Fide]

The window is real, but the use-after-free in it is older than this
patch.

I reproduced it on a Verdin AM62 with 6.12.113 and KASAN, with a 3 s
delay added at the top of gs_close() to widen the window. At shutdown
systemd closes ttyGS0 while the configfs teardown unbinds the gadget
and removes the acm function:

  BUG: KASAN: slab-use-after-free in check_tty_count+0x230/0x278
  Workqueue: events do_tty_hangup
   __tty_hangup.part.0
   do_tty_hangup
  Allocated by: gserial_alloc_line_no_console <- acm_alloc_instance
  Freed by: gserial_free_port <- gserial_free_line <- acm_free_instance

In one of the runs the closing task then faulted in release_tty() ->
tty_buffer_cancel_work(). The KASAN report is the same with this patch
not applied.

gserial_free_port() frees the gs_port, and with it the embedded
tty_port, while a tty still refers to it: the tty core keeps using
tty->port until release_tty(), and u_serial has no install/cleanup pair
that holds a reference on the port meanwhile. I will send a v2 as a
series: first keep the gs_port alive through the tty_port reference
count (get in install, put in cleanup, free in the destructor), then
flush_buffer on top of it.

Greg, please drop this version.

Thanks,
Mehmet

[PATCH] usb: gadget: u_serial: implement flush_buffer

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@screeningeagle.com>

gs_close() waits up to GS_CLOSE_TIMEOUT (15 s) for the write buffer
to drain while the gadget is connected. When the host does not read
the port, for example because no application on the host has it open,
the last close blocks for the full timeout. tcflush(TCOFLUSH) cannot
avoid that: u_serial has no flush_buffer operation, so the request is
a no-op.

Implement flush_buffer: discard the buffered output under the port
lock and wake up the close and write waiters. As on other tty drivers,
a hangup and an interrupt character (ISIG without NOFLSH) now discard
the pending output as well.

Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
---
 drivers/usb/gadget/function/u_serial.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index cdd1dfc666c4..2b99e33cbf3a 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -822,6 +822,19 @@ static void gs_flush_chars(struct tty_struct *tty)
 	spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
+static void gs_flush_buffer(struct tty_struct *tty)
+{
+	struct gs_port	*port = tty->driver_data;
+	unsigned long	flags;
+
+	spin_lock_irqsave(&port->port_lock, flags);
+	kfifo_reset(&port->port_write_buf);
+	spin_unlock_irqrestore(&port->port_lock, flags);
+
+	wake_up_interruptible(&port->drain_wait);
+	tty_wakeup(tty);
+}
+
 static unsigned int gs_write_room(struct tty_struct *tty)
 {
 	struct gs_port	*port = tty->driver_data;
@@ -914,6 +927,7 @@ static const struct tty_operations gs_tty_ops = {
 	.write =		gs_write,
 	.put_char =		gs_put_char,
 	.flush_chars =		gs_flush_chars,
+	.flush_buffer =		gs_flush_buffer,
 	.write_room =		gs_write_room,
 	.chars_in_buffer =	gs_chars_in_buffer,
 	.unthrottle =		gs_unthrottle,
-- 
2.55.0