[PATCH 0/1] USB: cdc-acm: skip URB restart in port_shutdown if disconnected

[Yuchao Zhang]

Hi Greg and USB maintainers,

This patch fixes a use-after-free race in drivers/usb/class/cdc-acm.c
introduced by commit f58752ebcb35 ("USB: cdc-acm: Add quirks for Yoga
Book 9 14IAH10 INGENIC touchscreen").

Problem:

When a CDC-ACM device is unplugged, acm_disconnect() sets
acm->disconnected = true and then calls tty_port_tty_vhangup(), which
eventually triggers acm_port_shutdown() from the tty-port layer.

acm_disconnect() has already called acm_poison_urbs() at this point
and is about to proceed to usb_free_urb() and usb_free_coherent()
for all control and read URBs.

However, acm_port_shutdown() unconditionally calls acm_unpoison_urbs()
and — when the ALWAYS_POLL_CTRL quirk is set — immediately re-submits
the ctrlurb and read URBs via usb_submit_urb() and
acm_submit_read_urbs().

If acm_disconnect() then frees those URBs and their DMA buffers while
they are still in flight, acm_ctrl_irq() or acm_read_bulk_callback()
will fire and access freed DMA memory, causing a kernel use-after-free.

Fix:

Add an early return in acm_port_shutdown() after the delayed-anchor
drain loop when acm->disconnected is set.  This keeps the URBs
poisoned and prevents any resubmission during the disconnect path.

The fix is a 2-line guard, no locking changes or functional impact on
the normal (non-disconnect) tty-close path.

Yuchao Zhang (1):
  USB: cdc-acm: skip URB restart in port_shutdown if disconnected

 drivers/usb/class/cdc-acm.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.53.0