* Forwarded: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware()
2026-06-29 21:09 [syzbot] [usb?] KASAN: slab-use-after-free Read in uea_upload_pre_firmware syzbot
@ 2026-06-30 0:31 ` syzbot
2026-07-11 14:49 ` [PATCH] usb: atm: ueagle-atm: fix use-after-free in uea_upload_pre_firmware Yuhong Cheng
2026-07-12 0:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Read " Hillf Danton
2 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-06-30 0:31 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
uea_load_firmware() calls request_firmware_nowait() passing a raw
struct usb_device pointer as the callback context, without holding
a reference to it.
If the USB device is disconnected before the firmware workqueue fires,
the usb_device is freed while uea_upload_pre_firmware() is still
executing, causing a slab-use-after-free:
BUG: KASAN: slab-use-after-free in __intf_to_usbdev
include/linux/usb.h:752 [inline]
BUG: KASAN: slab-use-after-free in uea_upload_pre_firmware+0x8d/0x640
drivers/usb/atm/ueagle-atm.c:598
Read of size 8 at addr ffff88802b0710b8 by task kworker/0:2/1664
The root cause: Eagle ADSL modems enumerate twice. On first plug-in
they present a pre-firmware PID; uea_probe() calls uea_load_firmware()
which queues the firmware upload asynchronously and returns immediately.
The USB core considers probing complete. If the cable is pulled at this
point, the usb_device is torn down while the firmware callback is still
pending or running on the workqueue.
Fix by calling usb_get_dev() before queuing the request to pin the
usb_device in memory for the lifetime of the async operation, and
usb_put_dev() in the callback once it is finished with the pointer.
On the error path where request_firmware_nowait() itself fails, drop
the reference immediately since the callback will never fire.
Reported-by: syzbot+3d45d763d18796f97412@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3d45d763d18796f97412
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/usb/atm/ueagle-atm.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index d610cdcef7d0..686cc58fb89f 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -663,6 +663,7 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry,
uea_err(usb, "firmware is corrupted\n");
err:
release_firmware(fw_entry);
+ usb_put_dev(usb);
}
/*
@@ -693,12 +694,14 @@ static int uea_load_firmware(struct usb_device *usb, unsigned int ver)
break;
}
+ usb_get_dev(usb);
ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev,
GFP_KERNEL, usb,
uea_upload_pre_firmware);
- if (ret)
+ if (ret) {
uea_err(usb, "firmware %s is not available\n", fw_name);
- else
+ usb_put_dev(usb);
+ } else
uea_info(usb, "loading firmware %s\n", fw_name);
return ret;
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH] usb: atm: ueagle-atm: fix use-after-free in uea_upload_pre_firmware
2026-06-29 21:09 [syzbot] [usb?] KASAN: slab-use-after-free Read in uea_upload_pre_firmware syzbot
2026-06-30 0:31 ` Forwarded: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware() syzbot
@ 2026-07-11 14:49 ` Yuhong Cheng
2026-07-12 0:09 ` [syzbot] [usb?] KASAN: slab-use-after-free Read " Hillf Danton
2 siblings, 0 replies; 5+ messages in thread
From: Yuhong Cheng @ 2026-07-11 14:49 UTC (permalink / raw)
To: castet.matthieu, stf_xl
Cc: linux-usb, linux-kernel, Yuhong Cheng, syzbot+3d45d763d18796f97412
syzbot reported a slab-use-after-free read in uea_upload_pre_firmware. This is because the usb_device is passed as context to request_firmware_nowait but its reference count is not incremented. Thus, if the USB device is disconnected before the firmware load completes, the callback accesses a freed usb_device.
Fix this by taking a reference with usb_get_dev() before calling request_firmware_nowait() and releasing it with usb_put_dev() in the completion callback or if the request fails to start.
Reported-by: syzbot+3d45d763d18796f97412@syzkaller.appspotmail.com
---
drivers/usb/atm/ueagle-atm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index d610cdcef..eaf2f2d3a 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -663,6 +663,7 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry,
uea_err(usb, "firmware is corrupted\n");
err:
release_firmware(fw_entry);
+ usb_put_dev(usb);
}
/*
@@ -693,13 +694,16 @@ static int uea_load_firmware(struct usb_device *usb, unsigned int ver)
break;
}
+ usb_get_dev(usb);
ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev,
GFP_KERNEL, usb,
uea_upload_pre_firmware);
- if (ret)
+ if (ret) {
uea_err(usb, "firmware %s is not available\n", fw_name);
- else
+ usb_put_dev(usb);
+ } else {
uea_info(usb, "loading firmware %s\n", fw_name);
+ }
return ret;
}
--
2.46.0.windows.1
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in uea_upload_pre_firmware
2026-06-29 21:09 [syzbot] [usb?] KASAN: slab-use-after-free Read in uea_upload_pre_firmware syzbot
2026-06-30 0:31 ` Forwarded: [PATCH] usb: atm: ueagle: fix use-after-free in uea_upload_pre_firmware() syzbot
2026-07-11 14:49 ` [PATCH] usb: atm: ueagle-atm: fix use-after-free in uea_upload_pre_firmware Yuhong Cheng
@ 2026-07-12 0:09 ` Hillf Danton
2026-07-12 2:07 ` syzbot
2 siblings, 1 reply; 5+ messages in thread
From: Hillf Danton @ 2026-07-12 0:09 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Mon, 29 Jun 2026 14:09:27 -0700
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3d5670d672ae Add linux-next specific files for 20260626
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10b76dfe580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2bb8183b2d472f18
> dashboard link: https://syzkaller.appspot.com/bug?extid=3d45d763d18796f97412
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fa0e1c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13519391580000
#syz test
--- x/drivers/usb/atm/ueagle-atm.c
+++ y/drivers/usb/atm/ueagle-atm.c
@@ -2605,9 +2605,11 @@ static void uea_disconnect(struct usb_in
usbatm_usb_disconnect(intf);
mutex_unlock(&uea_mutex);
uea_info(usb, "ADSL device removed\n");
- } else if (usb->config->desc.bNumInterfaces == 1) {
+ } else {
struct completion *fw_done = usb_get_intfdata(intf);
+ if (!fw_done)
+ return;
uea_dbg(usb, "pre-firmware device, waiting firmware upload\n");
wait_for_completion(fw_done);
uea_dbg(usb, "pre-firmware device, finished waiting\n");
--
^ permalink raw reply [flat|nested] 5+ messages in thread