[PATCH] usbip: fix use-after-free in usbip_stop_eh()

[Syed Tayyab Farooq]

During device teardown (e.g. when unbinding a device), vhci_stop()
calls usbip_stop_eh() to wait for the event_handler workqueue to
finish processing shutdown events. usbip_stop_eh() uses
wait_event_interruptible(), so if the user-space process triggering
the teardown receives a signal, the wait is aborted immediately.

Since the return value is ignored, the teardown path proceeds to
free the vhci_hcd (and the embedded usbip_device) while the
event_handler is still actively using it, resulting in a
use-after-free:

  BUG: KASAN: slab-use-after-free in vhci_shutdown_connection

Fix this by switching to the uninterruptible wait_event(), so the
wait cannot be short-circuited by a signal and always completes
after the event handler has finished processing pending events for
this device.

Reported-by: syzbot+31117fde582fe6a0cd62@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=31117fde582fe6a0cd62
Fixes: bb7871ad99ea ("usbip: event handler as one thread")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Syed Tayyab Farooq <syedtayyabfarooq08@xxxxxxxxx>
---
 drivers/usb/usbip/usbip_event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 0e00c2d000f8..81d761891184 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -115,7 +115,7 @@ void usbip_stop_eh(struct usbip_device *ud)
 	if (pending)
 		usbip_dbg_eh("usbip_eh waiting completion %lx\n", pending);
 
-	wait_event_interruptible(ud->eh_waitq, !(ud->event & ~USBIP_EH_BYE));
+	wait_event(ud->eh_waitq, !(ud->event & ~USBIP_EH_BYE));
 	usbip_dbg_eh("usbip_eh has stopped\n");
 }
 EXPORT_SYMBOL_GPL(usbip_stop_eh);
-- 
2.43.0