kernel/linux.git/drivers/usb/usbip/vudc_transfer.c, branch linux-7.1.y

usbip: vudc: Fix use after free bug in vudc_remove due to race condition

2026-05-22T09:13:06+00:00

This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request for runtime testing of the unplug/unbind path. This patch supplies that testing and keeps Zheng's original fix shape. In vudc_probe(), v_init_timer() binds udc->tr_timer.timer to v_timer(). usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer(). vudc_remove() can then free the containing struct vudc while the timer is still pending or executing. KASAN confirms the race on an unpatched x86_64 QEMU guest with CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop that repeatedly writes a socket fd to usbip_sockfd, closes the socket pair, and unbinds/rebinds usbip-vudc.0: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0 Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239 Allocated by task 239: vudc_probe+0x4d/0xaa0 Freed by task 239: kfree+0x18f/0x520 device_release_driver_internal+0x388/0x540 unbind_store+0xd9/0x100 This lands in the timer core rather than v_timer() itself because the embedded timer_list is being walked after its containing struct vudc has already been freed. The underlying lifetime bug is the same one Zheng reported. With v_stop_timer() called from vudc_remove() and the timer deleted synchronously, the same harness completed 5000 bind/unbind iterations with no KASAN report. Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops") Cc: stable Reported-by: Zheng Wang Closes: https://lore.kernel.org/linux-usb/20230317100954.2626573-1-zyytlz.wz@163.com/ Signed-off-by: Michael Bommarito Acked-by: Shuah Khan Link: https://patch.msgid.link/20260417163552.807548-1-michael.bommarito@gmail.com Signed-off-by: Greg Kroah-Hartman

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

usbip: Use fallthrough pseudo-keyword

2020-07-09T16:06:35+00:00

Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20200707195214.GA3932@embeddedor Signed-off-by: Greg Kroah-Hartman

USB: usbip: Remove redundant license text

2017-11-07T14:45:01+00:00

Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all. This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed. No copyright headers or other non-license-description text was removed. Cc: Valentina Manea Acked-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman

USB: add SPDX identifiers to all remaining files in drivers/usb/

2017-11-04T10:48:02+00:00

It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses. Update the drivers/usb/ and include/linux/usb* files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart. Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Signed-off-by: Greg Kroah-Hartman Acked-by: Felipe Balbi Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

usb: usbip: Convert timers to use timer_setup()

2017-11-01T15:57:23+00:00

In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Valentina Manea Cc: Shuah Khan Signed-off-by: Kees Cook Signed-off-by: Greg Kroah-Hartman

usbip: vudc: fix: Clear already_seen flag also for ep0

2016-12-05T14:08:45+00:00

ep_list inside gadget structure doesn't contain ep0. It is stored separately in ep0 field. This causes an urb hang if gadget driver decides to delay setup handling. On host side this is visible as timeout error when setting configuration. This bug can be reproduced using for example any gadget with mass storage function. Fixes: abdb29574322 ("usbip: vudc: Add vudc_transfer") Signed-off-by: Krzysztof Opasiak Cc: stable Acked-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman

usb: usbip:checkpatch; fix bare use of unsigned

2016-10-27T14:59:59+00:00

This patch fixes the following checkpatch warning for usbip files WARNING: Prefer 'unsigned int' to bare use of 'unsigned' Signed-off-by: Jai Krishna Signed-off-by: Greg Kroah-Hartman

usb: usbip: vudc: Rename find_endpoint() to vudc_find_endpoint()

2016-04-28T19:28:08+00:00

As find_endpoint() is a global funcion rename it to vudc_find_endpoint() to clearly mark where does it come from. Signed-off-by: Krzysztof Opasiak Signed-off-by: Greg Kroah-Hartman

usbip: vudc: Add vudc_transfer

2016-04-26T22:19:50+00:00

This file contains a function that simulates USB traffic, based on the one in dummy_hcd. Is also handles udc-directed control requests, and contains functions for setting up and controlling a timer for the emulation. This commit is a result of cooperation between Samsung R&D Institute Poland and Open Operating Systems Student Society at University of Warsaw (O2S3@UW) consisting of: Igor Kotrasinski Karol Kosik Ewelina Kosmider <3w3lfin@gmail.com> Dawid Lazarczyk Piotr Szulc Tutor and project owner: Krzysztof Opasiak Signed-off-by: Igor Kotrasinski Signed-off-by: Karol Kosik Signed-off-by: Krzysztof Opasiak Signed-off-by: Greg Kroah-Hartman