usb: raw_gadget: Add debug logs to a troubleshoot a double-free bug in raw_release.
Subsystems (2)
PATCH 1/1 usb: raw_gadget: Add debug logs to a troubleshoot a double-free bug in raw_release.
#syz test
syzkaller reported a double free bug
(https://syzkaller.appspot.com/bug?extid=3e563d99e70973c0755c) in raw_release.
From the stack traces it looks like either raw_release was invoked twice or there were some between kref_get in raw_ioctl_run and kref_put raw_release. But these should not be possible. We need more logs to understand the cause.
Make raw_release and raw_ioctl_run report the ref count before and after get/put to help debug this.
--- drivers/usb/gadget/legacy/raw_gadget.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/gadget/legacy/raw_gadget.c +14 -0
@@ -194,6 +194,8 @@ static struct raw_dev *dev_new(void)return NULL ;/* Matches kref_put() in raw_release(). */ kref_init (&dev->count); +dev_dbg (dev->dev,"%s kref count initialized: %d\n" , + __func__,kref_read (&dev->count));spin_lock_init (&dev->lock);init_completion (&dev->ep0_done);raw_event_queue_init (&dev->queue);
@@ -464,13 +466,21 @@ static int raw_release(struct inode *inode, struct file *fd)dev_err (dev->dev,"usb_gadget_unregister_driver() failed with %d\n" , ret); +dev_dbg (dev->dev,"%s kref count before unregister driver put: %d\n" , + __func__,kref_read (&dev->count));/* Matches kref_get() in raw_ioctl_run(). */ kref_put (&dev->count, dev_free); +dev_dbg (dev->dev,"%s kref count after unregister driver put: %d\n" , + __func__,kref_read (&dev->count)); } out_put: +dev_dbg (dev->dev,"%s kref count before final put: %d\n" , + __func__,kref_read (&dev->count));/* Matches dev_new() in raw_open(). */ kref_put (&dev->count, dev_free); +dev_dbg (dev->dev,"%s kref count after final put: %d\n" , + __func__,kref_read (&dev->count));return ret; }
@@ -603,8 +613,12 @@ static int raw_ioctl_run(struct raw_dev *dev, unsigned long value) } dev->gadget_registered = true; dev->state =STATE_DEV_RUNNING ; +dev_dbg (dev->dev,"%s kref count before get: %d\n" , + __func__,kref_read (&dev->count));/* Matches kref_put() in raw_release(). */ kref_get (&dev->count); +dev_dbg (dev->dev,"%s kref count after get: %d\n" , + __func__,kref_read (&dev->count)); out_unlock:spin_unlock_irqrestore (&dev->lock, flags);
Signature · 1 line
2.47.0
Re: [syzbot] [usb?] KASAN: invalid-free in dev_free
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Tested on:
commit: 6ff78df5 usb: Use (of|device)_property_present() for n.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing console output: https://syzkaller.appspot.com/x/log.txt?x=108d4e30580000 kernel config: https://syzkaller.appspot.com/x/.config?x=8f0eaad4c825e2e9 dashboard link: https://syzkaller.appspot.com/bug?extid=3e563d99e70973c0755c compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=17154e30580000
Note: testing is done by a robot and is best-effort only.