linux-kernel - Re: [PATCH v2] usb: fix reference leak in usb_new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2aae349c-dd80-44da-9715-a214f6946b75@rowland.harvard.edu>
Date: Tue, 17 Dec 2024 22:13:08 -0500
From: Alan Stern <stern@...land.harvard.edu>
To: Ma Ke <make_ruc2021@....com>
Cc: gregkh@...uxfoundation.org, christophe.jaillet@...adoo.fr,
	stanley_chang@...ltek.com, mka@...omium.org, oneukum@...e.com,
	quic_ugoswami@...cinc.com, javier.carrasco@...fvision.net,
	kay.sievers@...y.org, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] usb: fix reference leak in usb_new_device()

On Wed, Dec 18, 2024 at 10:19:40AM +0800, Ma Ke wrote:
> When device_add(&udev->dev) failed, calling put_device() to explicitly
> release udev->dev. And the routine which calls usb_new_device() does
> not call put_device() when an error occurs.

That is wrong.

usb_new_device() is called by hub_port_connect().  The code does:

			status = usb_new_device(udev);
			...

		if (status)
			goto loop_disable;
		...

loop_disable:
		hub_port_disable(hub, port1, 1);
loop:
		usb_ep0_reinit(udev);
		release_devnum(udev);
		hub_free_dev(udev);
		if (retry_locked) {
			mutex_unlock(hcd->address0_mutex);
			usb_unlock_port(port_dev);
		}
		usb_put_dev(udev);

And usb_put_dev() is defined in usb.c as:

void usb_put_dev(struct usb_device *dev)
{
	if (dev)
		put_device(&dev->dev);
}

So you see, if usb_new_device() returns a nonzero value then 
put_device() _is_ called.

>  As comment of device_add()
> says, 'if device_add() succeeds, you should call device_del() when you
> want to get rid of it. If device_add() has not succeeded, use only
> put_device() to drop the reference count'.

You are correct that if device_add() succeeds and a later call fails, 
then usb_new_device() does not properly call device_del().  Please 
rewrite your patch to fix only that problem.

Alan Stern