From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 498D6367B73 for ; Fri, 21 Aug 2026 03:13:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787282036; cv=none; b=e/G504EjxztZR6ux5HEgWfJXAlRm7EIdE3BxJ0LZ64DE1CB5tzEJDqxssdWtUN6sfNOrRuqRehqnuag7pcY3XpHAT9AP9LnNf/p/6bl9V3uCg/DxL1yUGeZVgeYjQKWm9m9efGqtUV7sDq6sfEc8ROd/hz/XFCdwB/2eG/VK3tE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787282036; c=relaxed/simple; bh=CTZKyQ+87j74/KecM7vxCjuA0gEmbfyU7nN/n+mQVeY=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=QkfBKIXciXGGMYy23rHj1wUmM+Y0EKhaA7fs3IMO1R/rwTfRKWf1WM9vt69uehc6mwkGVdE5LHYvNvfPdR3+5KPUvzDLkGuvI80R1W7crLhUWc7oe5tKhufSRp+zUzjj8i3JOCmeC4IrF+KFvEWnfejsdJhy6XBOQ0trGpgc4/8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=w2jAHHfH; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="w2jAHHfH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1787282014; bh=LZMcCjpbbZ/JJP7JWLuCUDO+4DIEOZ/evZmuq1KeCkA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=w2jAHHfHpQIeY37TYurEi3W1kGgwcaRSt+zM/q9jVrKnw7lbWmviZ7hzgjAMakKgJ ee2gCSgNtXmuQgWO+ygmnUmr6uJZFmtHvOygpI+b/nxyKw6+29U4sKxr5ffsw/qZAv UPmIWcyKsY1clJ4XnolpV2t5u0XAtY2iuCaW//T8= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszb51-0.qq.com (NewEsmtp) with SMTP id 36014CF1; Fri, 21 Aug 2026 11:13:32 +0800 X-QQ-mid: xmsmtpt1787282012tw4pq867b Message-ID: X-QQ-XMAILINFO: NmRjDopJZVxO5IjMA8vgUUi2zXvPPRto+sjmxbvGUWZxppMdBNjWdFx6m8NlZ9 wUxa1/TKPCBo5l+Pol8c020zpNlF8SCJl5eC1TUYDa3L/s6132otcpqd0FXcSa5G+8vXKDHucgO1 jPtLZ3p77rRPz7d1qWQYXiZMh7fznhTHkwwTJ23IV7cAD+ti4ghlqDxawJn1wqObNw1aOmAu5U3a mMzBqppa4zGXXrVJPY4abIKJDqr5OEl/MaaLZfDeL+gZJ2QsiSwXTkBgjALJPHhZBqUUF6gbUFSa E6YwT9PZdGOkhUXKsTTq3Jcgq6zCIjlErPx7KMT09Fgd6CeAOpNmaW3DEuP4Wcuhupqh+o4qQRIp pGie6WMOIMcNKRZkiGUbwUfy9eA4vwBISy3lusk4DlTqx5EdNhMtm/ST5DjM9BlLi89nziBm3vQQ VbZDaHFWa1rBG/bwuUHbWKbM6x2dkxVAUFYuUt0k66FuJ5GQpTdquYKUzOvZ3SFkTgF9EE7n7SA5 7nGzNfBP64XBPr59sxa7DHW6Vzfa5ihFqSYeLuGQvskzuSdc9trbfPixla/2uZSpq8gjTPhzXBUX IsEX0p5jpelmX6YkNHH0qyKFaSxfEsHFMmng6kh6+PuNIgBxVN6y5W18C5nIckguPSsblV69CPW3 hyVTGBmeK06pYFUS362SpDrZBgFDkHXX6y6C9J3NoioxlvDz2l9rof5yc/2nqFV8Kp0gqjAdLcVP 8z0Hb5RJZX1ANlQ68bupA8H9Fc3g29Q09krcUeBWjpf4umNglFLUdZdKZt/5f89JlWWGznb5j0Mb 6AwdJost4B/Ax3OSoRAfXjfiqjPmE5rJR/gEkSSJNz/tJ4EP4/xw16FVpiXpyEmyRHa6HZe984lY dwTeqfSkooLbDcmxt/YCqfnhXKsop52VUP6dgPIzHnVDxWpanAMrV5pwENl/zJB9yhqSpq+5X2Eo pMpZWOEBYxEnM3fnG2frckxBCKEhFSXOjLEM4BWPbZkFw7aOxt8Kj2Fw1X8lJ4Xrbc4nSlGNE= X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== From: Edward Adam Davis To: syzbot+ecbb1750082f7528b507@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] KASAN: slab-use-after-free Read in vhci_send_cmd_submit Date: Fri, 21 Aug 2026 11:13:32 +0800 X-OQ-MSGID: <20260821031331.11615-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6a871611.4d75e56a.c9a88.0041.GAE@google.com> References: <6a871611.4d75e56a.c9a88.0041.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c index 32e6fabccf72..c3aacbb6939f 100644 --- a/drivers/usb/usbip/vhci_tx.c +++ b/drivers/usb/usbip/vhci_tx.c @@ -13,7 +13,12 @@ static void setup_cmd_submit_pdu(struct usbip_header *pdup, struct urb *urb) { struct vhci_priv *priv = ((struct vhci_priv *)urb->hcpriv); - struct vhci_device *vdev = priv->vdev; + struct vhci_device *vdev; + + if (!priv) + return; + + vdev = priv->vdev; usbip_dbg_vhci_tx("URB, local devnum %u, remote devid %u\n", usb_pipedevice(urb->pipe), vdev->devid); @@ -68,7 +73,9 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) int ret; struct urb *urb = priv->urb; struct usbip_header pdu_header; + unsigned long flags; + usb_get_urb(urb); txsize = 0; memset(&pdu_header, 0, sizeof(pdu_header)); memset(&msg, 0, sizeof(msg)); @@ -85,6 +92,7 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) iov = kzalloc_objs(*iov, iovnum); if (!iov) { usbip_event_add(&vdev->ud, SDEV_EVENT_ERROR_MALLOC); + usb_put_urb(urb); return -ENOMEM; } @@ -92,7 +100,14 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) urb->transfer_flags |= URB_DMA_MAP_SG; /* 1. setup usbip_header */ + spin_lock_irqsave(&vdev->priv_lock, flags); + if (!urb->hcpriv) { + usb_put_urb(urb); + spin_unlock_irqrestore(&vdev->priv_lock, flags); + return -EIO; + } setup_cmd_submit_pdu(&pdu_header, urb); + spin_unlock_irqrestore(&vdev->priv_lock, flags); usbip_header_correct_endian(&pdu_header, 1); iovnum = 0; @@ -127,6 +142,7 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) if (!iso_buffer) { usbip_event_add(&vdev->ud, SDEV_EVENT_ERROR_MALLOC); + usb_put_urb(urb); goto err_iso_buffer; } @@ -143,6 +159,7 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) txsize); usbip_event_add(&vdev->ud, VDEV_EVENT_ERROR_TCP); err = -EPIPE; + usb_put_urb(urb); goto err_tx; } @@ -154,6 +171,7 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) usbip_dbg_vhci_tx("send txdata\n"); total_size += txsize; + usb_put_urb(urb); } return total_size;