usb: gadget: udc: fix use-after-free in usb_gadget_state_work

[ Upstream commit baeb66fbd4201d1c4325074e78b1f557dff89b5b ]

A race condition during gadget teardown can lead to a use-after-free
in usb_gadget_state_work(), as reported by KASAN:

  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0
  Workqueue: events usb_gadget_state_work

The fundamental race occurs because a concurrent event (e.g., an
interrupt) can call usb_gadget_set_state() and schedule gadget->work
at any time during the cleanup process in usb_del_gadget().

Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after
device removal") attempted to fix this by moving flush_work() to after
device_del(). However, this does not fully solve the race, as a new
work item can still be scheduled *after* flush_work() completes but
before the gadget's memory is freed, leading to the same use-after-free.

This patch fixes the race condition robustly by introducing a 'teardown'
flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is
set during cleanup in usb_del_gadget() *before* calling flush_work() to
prevent any new work from being scheduled once cleanup has commenced.
The scheduling site, usb_gadget_set_state(), now checks this flag under
the lock before queueing the work, thus safely closing the race window.

Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue")
Cc: stable <stable@kernel.org>
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index dd2fafc5b0c3e606a3884d7d2726cef239d39ea7..598053bf985db0083bc713ae69b44238a28b1017 100644 (file)
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1037,8 +1037,13 @@ static void usb_gadget_state_work(struct work_struct *work)
 void usb_gadget_set_state(struct usb_gadget *gadget,
                enum usb_device_state state)
 {
+       unsigned long flags;
+
+       spin_lock_irqsave(&gadget->state_lock, flags);
        gadget->state = state;
-       schedule_work(&gadget->work);
+       if (!gadget->teardown)
+               schedule_work(&gadget->work);
+       spin_unlock_irqrestore(&gadget->state_lock, flags);
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
@@ -1199,6 +1204,8 @@ void usb_initialize_gadget(struct device *parent, struct usb_gadget *gadget,
                void (*release)(struct device *dev))
 {
        dev_set_name(&gadget->dev, "gadget");
+       spin_lock_init(&gadget->state_lock);
+       gadget->teardown = false;
        INIT_WORK(&gadget->work, usb_gadget_state_work);
        gadget->dev.parent = parent;
 
@@ -1376,6 +1383,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
 void usb_del_gadget(struct usb_gadget *gadget)
 {
        struct usb_udc *udc = gadget->udc;
+       unsigned long flags;
 
        if (!udc)
                return;
@@ -1394,6 +1402,13 @@ void usb_del_gadget(struct usb_gadget *gadget)
        mutex_unlock(&udc_lock);
 
        kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
+       /*
+        * Set the teardown flag before flushing the work to prevent new work
+        * from being scheduled while we are cleaning up.
+        */
+       spin_lock_irqsave(&gadget->state_lock, flags);
+       gadget->teardown = true;
+       spin_unlock_irqrestore(&gadget->state_lock, flags);
        flush_work(&gadget->work);
        device_unregister(&udc->dev);
        device_del(&gadget->dev);

diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
index 11df3d5b40c6b85f11f8eb49585d7ef2b10cce20..8bdeced70a339cbd02ee9db4b67901d1f0bb7280 100644 (file)
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -341,6 +341,9 @@ struct usb_gadget_ops {
  * @max_speed: Maximal speed the UDC can handle.  UDC must support this
  *      and all slower speeds.
  * @state: the state we are now (attached, suspended, configured, etc)
+ * @state_lock: Spinlock protecting the `state` and `teardown` members.
+ * @teardown: True if the device is undergoing teardown, used to prevent
+ *     new work from being scheduled during cleanup.
  * @name: Identifies the controller hardware type.  Used in diagnostics
  *     and sometimes configuration.
  * @dev: Driver model state for this abstract device.
@@ -408,6 +411,8 @@ struct usb_gadget {
        enum usb_device_speed           speed;
        enum usb_device_speed           max_speed;
        enum usb_device_state           state;
+       spinlock_t                      state_lock;
+       bool                            teardown;
        const char                      *name;
        struct device                   dev;
        unsigned                        isoch_delay;