Linaro-mm-sig April 2026

linaro-mm-sig@lists.linaro.org

91 participants
213 discussions

[PATCH] usb: gadget: f_fs: serialize DMABUF cancel against request completion

by Michael Bommarito

ffs_epfile_dmabuf_io_complete() calls usb_ep_free_request() on the completed request but leaves priv->req, the back-pointer that ffs_dmabuf_transfer() set on submission, pointing at the freed memory. A later FUNCTIONFS_DMABUF_DETACH ioctl or ffs_epfile_release() on the close path still sees priv->req non-NULL under ffs->eps_lock: if (priv->ep && priv->req) usb_ep_dequeue(priv->ep, priv->req); so usb_ep_dequeue() is called on a freed usb_request. On dummy_hcd the dequeue path only walks a live queue and pointer-compares, so the freed pointer reads without faulting and KASAN requires an explicit check at the FunctionFS call site to surface the use-after-free. On SG-capable in-tree UDCs the dequeue path dereferences the supplied request immediately: * chipidea's ep_dequeue() does container_of(req, struct ci_hw_req, req) and reads hwreq->req.status before acquiring its own lock. * cdnsp's cdnsp_gadget_ep_dequeue() reads request->status first. The narrower option of clearing priv->req via cmpxchg() in the completion does not close the race: the completion runs without eps_lock, so a cancel path holding eps_lock can still observe priv->req non-NULL, race a concurrent completion that clears and frees, and pass the freed pointer to usb_ep_dequeue(). A slightly longer fix that moves the free into the cleanup work is needed. Same class of lifetime race as the recent usbip-vudc timer fix [1]. Take eps_lock in the sole place that mutates priv->req from the callback direction by moving usb_ep_free_request() out of the completion into ffs_dmabuf_cleanup(), the existing work handler scheduled by ffs_dmabuf_signal_done() on ffs->io_completion_wq. Clear priv->req there under eps_lock before freeing, and only clear if priv->req still names our request (a subsequent ffs_dmabuf_transfer() on the same attachment may have queued a new one). This keeps the existing dummy_hcd sync-dequeue invariant: the completion callback is still invoked by the UDC without eps_lock held (dummy_hcd drops its own lock before calling the callback), and the callback now takes no f_fs lock at all. Serialization against the cancel path happens in cleanup, which runs from the workqueue with no f_fs lock held on entry. The priv ref count protects the containing ffs_dmabuf_priv: ffs_dmabuf_transfer() takes a ref via ffs_dmabuf_get(), cleanup drops it via ffs_dmabuf_put(), so priv stays live for the cleanup even after the cancel path's list_del + ffs_dmabuf_put. The ffs_dmabuf_transfer() error path no longer frees usb_req inline: fence->req and fence->ep are set before usb_ep_queue(), so ffs_dmabuf_cleanup() (scheduled by the error-path ffs_dmabuf_signal_done()) owns the free regardless of whether the queue succeeded. Reproduced under KASAN on both detach and close paths against dummy_hcd with an observability hook (kasan_check_byte(priv->req) immediately before usb_ep_dequeue) at the two FunctionFS cancel sites to surface the stale-pointer access; the hook is not part of this patch. The KASAN allocator / free stacks in the captured splats identify the same request: alloc in dummy_alloc_request, free in dummy_timer, fault reached from ffs_epfile_release (close) and from the FUNCTIONFS_DMABUF_DETACH ioctl (detach). With the patch applied, both paths are silent under the same hook. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace or from a USB host on the cable. FunctionFS mounts default to GLOBAL_ROOT_UID, but the filesystem supports uid=, gid=, and fmode= delegation to a non-root gadget daemon, so on real deployments the attacker may be a less-privileged service rather than root. Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface") Link: https://lore.kernel.org/all/20260417163552.807548-1-michael.bommarito@gmail… [1] Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> --- drivers/usb/gadget/function/f_fs.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 815639506520..75912ce6ab55 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -150,6 +150,8 @@ struct ffs_dma_fence { struct dma_fence base; struct ffs_dmabuf_priv *priv; struct work_struct work; + struct usb_ep *ep; + struct usb_request *req; }; struct ffs_epfile { @@ -1385,6 +1387,21 @@ static void ffs_dmabuf_cleanup(struct work_struct *work) struct ffs_dmabuf_priv *priv = dma_fence->priv; struct dma_buf_attachment *attach = priv->attach; struct dma_fence *fence = &dma_fence->base; + struct usb_request *req = dma_fence->req; + struct usb_ep *ep = dma_fence->ep; + + /* + * eps_lock pairs with the cancel paths so they cannot pass a freed + * req to usb_ep_dequeue(). Only clear if priv->req still names ours; + * a re-queue on the same attachment may have taken that slot. + */ + spin_lock_irq(&priv->ffs->eps_lock); + if (priv->req == req) + priv->req = NULL; + spin_unlock_irq(&priv->ffs->eps_lock); + + if (ep && req) + usb_ep_free_request(ep, req); ffs_dmabuf_put(attach); dma_fence_put(fence); @@ -1414,8 +1431,8 @@ static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep, struct usb_request *req) { pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status); + /* req is freed by ffs_dmabuf_cleanup() under eps_lock. */ ffs_dmabuf_signal_done(req->context, req->status); - usb_ep_free_request(ep, req); } static const char *ffs_dmabuf_get_driver_name(struct dma_fence *fence) @@ -1699,6 +1716,10 @@ static int ffs_dmabuf_transfer(struct file *file, usb_req->context = fence; usb_req->complete = ffs_epfile_dmabuf_io_complete; + /* ffs_dmabuf_cleanup() frees usb_req via these two fields. */ + fence->req = usb_req; + fence->ep = ep->ep; + cookie = dma_fence_begin_signalling(); ret = usb_ep_queue(ep->ep, usb_req, GFP_ATOMIC); dma_fence_end_signalling(cookie); @@ -1708,7 +1729,6 @@ static int ffs_dmabuf_transfer(struct file *file, } else { pr_warn("FFS: Failed to queue DMABUF: %d\n", ret); ffs_dmabuf_signal_done(fence, ret); - usb_ep_free_request(ep->ep, usb_req); } spin_unlock_irq(&epfile->ffs->eps_lock); -- 2.53.0

3 weeks, 6 days

[PATCH v2 00/19] tracepoint: Avoid double static_branch evaluation at guarded call sites

by Vineeth Pillai (Google)

When a caller already guards a tracepoint with an explicit enabled check: if (trace_foo_enabled() && cond) trace_foo(args); trace_foo() internally re-evaluates the static_branch_unlikely() key. Since static branches are patched binary instructions the compiler cannot fold the two evaluations, so every such site pays the cost twice. This series introduces trace_call__##name() as a companion to trace_##name(). It calls __do_trace_##name() directly, bypassing the redundant static-branch re-check, while preserving all other correctness properties of the normal path (RCU-watching assertion, might_fault() for syscall tracepoints). The internal __do_trace_##name() symbol is not leaked to call sites; trace_call__##name() is the only new public API. if (trace_foo_enabled() && cond) trace_call__foo(args); /* calls __do_trace_foo() directly */ The first patch adds the three-location change to include/linux/tracepoint.h (__DECLARE_TRACE, __DECLARE_TRACE_SYSCALL, and the !TRACEPOINTS_ENABLED stub). The remaining 18 patches mechanically convert all guarded call sites found in the tree: kernel/, io_uring/, net/, accel/habanalabs, cpufreq/, devfreq/, dma-buf/, fsi/, drm/, HID, i2c/, spi/, scsi/ufs/, btrfs/, net/devlink/, kernel/time/, kernel/trace/, mm/damon/, and arch/x86/. This series is motivated by Peter Zijlstra's observation in the discussion around Dmitry Ilvokhin's locking tracepoint instrumentation series, where he noted that compilers cannot optimize static branches and that guarded call sites end up evaluating the static branch twice for no reason, and by Steven Rostedt's suggestion to add a proper API instead of exposing internal implementation details like __do_trace_##name() directly to call sites: https://lore.kernel.org/linux-trace-kernel/8298e098d3418cb446ef396f119edac5… Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Suggested-by: Peter Zijlstra <peterz(a)infradead.org> Changes in v2: - Renamed trace_invoke_##name() to trace_call__##name() (double underscore) per review comments. - Added 4 new patches covering sites missed in v1, found using coccinelle to scan the tree (Keith Busch): * net/devlink: guarded tracepoint_enabled() block in trap.c * kernel/time: early-return guard in tick-sched.c (tick_stop) * kernel/trace: early-return guard in trace_benchmark.c * mm/damon: early-return guard in core.c * arch/x86: do_trace_*() wrapper functions in lib/msr.c, which are called exclusively from tracepoint_enabled()-guarded sites in asm/msr.h v1: https://lore.kernel.org/linux-trace-kernel/abSqrJ1J59RQC47U@kbusch-mbp/ Vineeth Pillai (Google) (19): tracepoint: Add trace_call__##name() API kernel: Use trace_call__##name() at guarded tracepoint call sites io_uring: Use trace_call__##name() at guarded tracepoint call sites net: Use trace_call__##name() at guarded tracepoint call sites accel/habanalabs: Use trace_call__##name() at guarded tracepoint call sites cpufreq: Use trace_call__##name() at guarded tracepoint call sites devfreq: Use trace_call__##name() at guarded tracepoint call sites dma-buf: Use trace_call__##name() at guarded tracepoint call sites fsi: Use trace_call__##name() at guarded tracepoint call sites drm: Use trace_call__##name() at guarded tracepoint call sites HID: Use trace_call__##name() at guarded tracepoint call sites i2c: Use trace_call__##name() at guarded tracepoint call sites spi: Use trace_call__##name() at guarded tracepoint call sites scsi: ufs: Use trace_call__##name() at guarded tracepoint call sites btrfs: Use trace_call__##name() at guarded tracepoint call sites net: devlink: Use trace_call__##name() at guarded tracepoint call sites kernel: time, trace: Use trace_call__##name() at guarded tracepoint call sites mm: damon: Use trace_call__##name() at guarded tracepoint call sites x86: msr: Use trace_call__##name() at guarded tracepoint call sites arch/x86/lib/msr.c | 6 +++--- drivers/accel/habanalabs/common/device.c | 12 ++++++------ drivers/accel/habanalabs/common/mmu/mmu.c | 3 ++- drivers/accel/habanalabs/common/pci/pci.c | 4 ++-- drivers/cpufreq/amd-pstate.c | 10 +++++----- drivers/cpufreq/cpufreq.c | 2 +- drivers/cpufreq/intel_pstate.c | 2 +- drivers/devfreq/devfreq.c | 2 +- drivers/dma-buf/dma-fence.c | 4 ++-- drivers/fsi/fsi-master-aspeed.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 ++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- drivers/gpu/drm/scheduler/sched_entity.c | 4 ++-- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 2 +- drivers/i2c/i2c-core-slave.c | 2 +- drivers/spi/spi-axi-spi-engine.c | 4 ++-- drivers/ufs/core/ufshcd.c | 12 ++++++------ fs/btrfs/extent_map.c | 4 ++-- fs/btrfs/raid56.c | 4 ++-- include/linux/tracepoint.h | 11 +++++++++++ io_uring/io_uring.h | 2 +- kernel/irq_work.c | 2 +- kernel/sched/ext.c | 2 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 12 ++++++------ kernel/trace/trace_benchmark.c | 2 +- mm/damon/core.c | 2 +- net/core/dev.c | 2 +- net/core/xdp.c | 2 +- net/devlink/trap.c | 2 +- net/openvswitch/actions.c | 2 +- net/openvswitch/datapath.c | 2 +- net/sctp/outqueue.c | 2 +- net/tipc/node.c | 2 +- 35 files changed, 74 insertions(+), 62 deletions(-) -- 2.53.0

4 weeks

PENJUAL OBAT ABORSI LAMPUNG

by CYTOTEC 087776558899

⭐⭐PEMESANAN OBAT WHATSAPP⭐⭐ ☎️ KLIK LINK. ☎️ https://wa.me/6287776558899 💊OBAT ABORSI PENGGUGUR💊 TEMPAT CYTOTEC ASLI LINK KE LINK. 👇 Nomor telepon 087776558899 Obat Penggugur Kandungan BPOM adalah tempat yang bagus untuk membeli Cytotec, dan Anda perlu mengeluarkan banyak uang untuk membayarnya. Obat cytotec misoprostol 200mcg digunakan untuk mengobati mengguurkan dan janin kuat (Bandel) 100%. KAMI SIAP MENERIMA PESANAN KE SELURUH INDONESIA : 👉 OBAT penggugur kandungan Ambon, OBAT penggugur kandungan Banda Aceh, OBAT penggugur kandungan Bandung, OBAT penggugur kandungan Banjarbaru, OBAT penggugur kandungan Batam, OBAT penggugur kandungan Bau-Bau, OBAT penggugur kandungan Bengkulu, OBAT penggugur kandungan Binjai, OBAT penggugur kandungan Blitar, OBAT penggugur kandungan Bontang, OBAT penggugur kandungan Cilegon, OBAT penggugur kandungan Cirebon, OBAT penggugur kandungan Depok, OBAT penggugur kandungan Gorontalo, OBAT penggugur OBAT penggugur kandungan Jayapura, OBAT penggugur kandungan Kendari, OBAT penggugur kandungan Kota Mobagu, OBAT penggugur kandungan Kupang, OBAT penggugur kandungan Lhokseumawe, OBAT penggugur kandungan Madiun, OBAT penggugur kandungan Makasar, OBAT penggugur kandungan Manado, OBAT penggugur kandungan Metro, OBAT penggugur kandungan Mojokerto, OBAT penggugur kandungan Panjang, OBAT penggugur kandungan Pagar Alam, OBAT penggugur kandungan Palembang, OBAT penggugur kandungan Palu, OBAT penggugur candungan Pare Pare, OBAT penggugur candungan Pasuruan, OBAT penggugur kandungan Pekalongan, OBAT penggugur kandungan Pematang Siantar, OBAT penggugur kandungan Prabumulih, OBAT penggugur kandungan Purwokerto, OBAT penggugur kandungan Salatiga, OBAT penggugur kandungan Semarang, OBAT penggugur kandungan Sibolga, Solok, OBAT penggugur kandungan Subulussalam, OBAT penggugur kandungan Penuh, OBAT penggugur kandungan Tangerang, OBAT penggugur kandungan Tanjung Pinang, OBAT penggugur kandungan Tasikmalaya, OBAT penggugur kandungan Tebing Tinggi, OBAT penggugur kandungan Ternate, OBAT penggugur kandungan Tomohon, OBAT penggugur candungan Yogyakarta/Jogja, OBAT penggugur candungan Tual, OBAT pengguguur candungan Tidore Kepulauan, OBAT penggugur candungan Tanjung Balai, OBAT pengguguur candungan Tegal, OBAT pengguguur candungan Tarakan, OBAT penggugur candungan Tangerang Selatan, OBAT penggugur kandungan Surakarta, OBAT penggugur kandungan Sukabumi, OBAT penggugur kandungan Sorong, OBAT penggugur kandungan Singkawang, OBAT penggugur kandungan Serang, OBAT penggugur kandungan Samarinda, OBAT penggugur kandungan Sabang, OBAT penggugur kandungan Probolinggo, OBAT penggugur kandungan Pariaman, OBAT penggugur kandungan Pangkal Pinang, OBAT penggugur kandungan Palopo, OBAT penggugur kandungan Palangkaraya, OBAT penggugur kandungan Padang Sidempuan, OBAT penggugur kandungan Padang, OBAT penggugur kandungan Meulaboh, OBAT penggugur kandungan Mataram, OBAT penggugur kandungan Malang, OBAT penggugur kandungan Magelang, OBAT penggugur kandungan Lubuk Linggau, OBAT penggugur kandungan Langsa, OBAT penggugur kandungan Kota Surabaya, OBAT penggugur kandungan Kota Medan, OBAT penggugur kandungan Kediri, OBAT penggugur kandungan Jambi, OBAT penggugur kandungan Sawah Lunto, OBAT ABORSI Dumai,OBAT penggugur kandungan Denpasar,OBAT penggugur kandungan Cimahi, OBAT penggugur kandungan Bukit Tinggi, OBAT penggugur kandungan Bogor, OBAT penggugur kandungan Bitung, OBAT penggugur kandungan Bima, OBAT penggugur kandungan Bekasi, OBAT penggugur kandungan Batu, OBAT penggugur kandungan Banjarmasin, OBAT penggugur kandungan Banjar, OBAT penggugur kandungan Lampung, OBAT penggugur kandungan Balikpapan, OBAT penggugur kandungan Jepara, OBAT penggugur kandungan Sukoharjo, OBAT gugur kandungan Klaten, OBAT gugur kandungan Sragen, OBAT gugur OBAT gugur kandungan Solo, OBAT gugur kandungan Boyolali, OBAT gugur kandungan Sukabumi, OBAT gugur kandungan Ciamis, OBAT gugur kandungan Cianjur, OBAT gugur kandungan Subang, OBAT gugur kandungan Purwakarta, OBAT gugur kandungan Purwakarta, OBAT gugur kandungan Boyolali, OBAT gugur kandungan Sukabumi OBAT gugur kandungan Gresik, OBAT gugur kandungan kandungan Kediri, OBAT gugur kandungan Lamongan, OBAT gugur kandungan Tuban, OBAT gugur kandungan Bojonegoro, OBAT gugur kandungan Jember, OBAT gugur kandungan Bali, OBAT gugur kandungan Bali, OBAT gugur kandungan Makasar, OBAT gugur kandungan Balikpapan, OBAT gugur kandungan Banjarmasin, OBAT gugur kandungan Jambi, OBAT gugur kandungan Wonosobo, Obat penggugur kandungan di apotik, obat penggugur kandungan postinor, cara Menggugurkan kandungan,

4 weeks