Re: [PATCH v2] media: gspca: use vb2_video_unregister_device() on disconnect

[Wang Xiong]

Hello Hans, Mauro and Shuangpeng,

Could you help check whether this gspca read/start use-after-free is the
same issue as the disconnect lifetime problem discussed in this thread,
and whether the v2 queue-unregister change covers this access path?

The archived reports from runs 8, 20 and 73 show a KASAN read inside
usb_ifnum_to_if(), reached through:

  read -> v4l2_read -> vb2_fop_read -> vb2 file-I/O stream start
       -> gspca_start_streaming -> gspca_init_transfer
       -> usb_ifnum_to_if

The affected storage was allocated by usb_alloc_dev() and freed through
device_release()/put_device() in the USB hub disconnect path. Thus the
first reported access concerns the parent usb_device, rather than an
input URB or a NULL interface returned by usb_ifnum_to_if(). The device
labels in these runs are stv0680, spca506 and finepix.

The recorded kernels identify themselves as 7.1.2-dirty (#70, #81 and
#83). The exact tested source commit and dirty diff, and their association
with the saved configurations, have not been established. The test setup
used custom QEMU USB devices. These reports have not been retested on an
unmodified current kernel, and I have not verified the runtime effect of
your patch on this read/start case. No standalone reproducer is included.

Your v1 describes the parent USB reference lifetime gap, while v2 stops
the queue during disconnect and describes a late-close/stop access. I do
not want to assume that the different access phase either proves or
rules out a common cause.

Could you point me to the original public report if this particular
read/start access is already known? If v2 does not cover it, is an
additional start/disconnect synchronization fix required?

Related original messages:
https://lore.kernel.org/r/20260718025434.2259756-1-shuangpeng.kernel@xxxxxxxxx/
https://lore.kernel.org/r/20260813031235.2468144-1-shuangpeng.kernel@xxxxxxxxx/

Below is the complete first KASAN event from run 8, quoted without edits.
Boot output before it and subsequent cascading faults are omitted. The
full archived reports for all three runs are retained separately.

I used an AI assistant to organize the archived evidence and draft this
inquiry; the quoted KASAN output is from the original saved report.

Thank you,
Wang Xiong

----- first KASAN event: archived run 8 -----
BUG: KASAN: slab-use-after-free in usb_ifnum_to_if+0x1cb/0x1d0 drivers/usb/core/usb.c:352
Read of size 8 at addr ffff88802d00e2a8 by task syz.0.12542/30330

CPU: 0 UID: 0 PID: 30330 Comm: syz.0.12542 Not tainted 7.1.2-dirty #70 PREEMPTLAZY 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xa7/0xd0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcb/0x5d0 mm/kasan/report.c:482
 ? _raw_write_unlock_irq+0x60/0x60
 ? usb_ifnum_to_if+0x1cb/0x1d0 drivers/usb/core/usb.c:352
 kasan_report+0xaf/0xe0 mm/kasan/report.c:595
 ? usb_ifnum_to_if+0x1cb/0x1d0 drivers/usb/core/usb.c:352
 usb_ifnum_to_if+0x1cb/0x1d0 drivers/usb/core/usb.c:352
 ? vb2_vmalloc_alloc+0x136/0x3c0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
 gspca_init_transfer.constprop.0+0x193/0x1ff0 drivers/media/usb/gspca/gspca.c:772
 ? vb2_vmalloc_alloc+0x297/0x3c0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:60
 ? kasan_save_track+0x10/0x30 mm/kasan/common.c:78
 ? dma_unmap_sgtable include/linux/dma-mapping.h:565 [inline]
 ? vb2_vmalloc_dmabuf_ops_detach+0x190/0x190 drivers/media/common/videobuf2/videobuf2-vmalloc.c:264
 ? __vb2_queue_alloc+0xdae/0x1240 drivers/media/common/videobuf2/videobuf2-core.c:495
 ? gspca_stop_streaming+0x50/0x50 include/media/videobuf2-core.h:1200
 ? instrument_read_write include/linux/instrumented.h:55 [inline]
 ? atomic_long_try_cmpxchg_release include/linux/atomic/atomic-instrumented.h:4480 [inline]
 ? __mutex_unlock_fast kernel/locking/mutex.c:172 [inline]
 ? mutex_unlock+0x6a/0xa0 kernel/locking/mutex.c:579
 ? __mutex_unlock_slowpath.constprop.0+0x360/0x360 arch/x86/include/asm/atomic64_64.h:15
 ? instrument_read_write include/linux/instrumented.h:55 [inline]
 ? atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1301 [inline]
 ? queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
 ? do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 ? __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:133 [inline]
 ? _raw_spin_lock_irqsave+0x72/0xb0 kernel/locking/spinlock.c:166
 ? _raw_write_unlock_irq+0x60/0x60
 ? __fill_vb2_buffer+0x32c/0x420 drivers/media/common/videobuf2/videobuf2-v4l2.c:604
 gspca_start_streaming+0x62/0xb0 drivers/media/usb/gspca/gspca.c:1360
 ? gspca_init_transfer.constprop.0+0x1ff0/0x1ff0 drivers/media/usb/gspca/gspca.c:851
 vb2_start_streaming+0x211/0x680 drivers/media/common/videobuf2/videobuf2-core.c:1783
 ? __bitmap_weight+0xd4/0x100 lib/bitmap.c:341
 vb2_core_streamon+0x285/0x470 drivers/media/common/videobuf2/videobuf2-core.c:2336
 __vb2_init_fileio+0xdc1/0x1120 drivers/media/common/videobuf2/videobuf2-core.c:2949
 ? vb2_vmalloc_dmabuf_ops_vmap+0xb0/0xb0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:313
 __vb2_perform_fileio+0x981/0x15e0 drivers/media/common/videobuf2/videobuf2-core.c:3025
 ? vb2_thread_start+0x380/0x380 drivers/media/common/videobuf2/videobuf2-core.c:3273
 ? __mutex_lock_interruptible_slowpath+0x10/0x10 kernel/locking/mutex.c:1129
 ? instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
 ? atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
 ? __refcount_sub_and_test include/linux/refcount.h:389 [inline]
 ? __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 ? refcount_dec_and_test include/linux/refcount.h:450 [inline]
 ? put_task_struct include/linux/sched/task.h:130 [inline]
 ? wake_up_q+0xaf/0x130 kernel/sched/core.c:1159
 vb2_fop_read+0x219/0x3e0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1215
 v4l2_read+0x1fc/0x320 drivers/media/v4l2-core/v4l2-dev.c:316
 ? v4l2_write+0x320/0x320 include/linux/kobject.h:89
 vfs_read+0x1d9/0x980 fs/read_write.c:572
 ? kernel_read+0x220/0x220 fs/read_write.c:41
 ? _copy_to_user+0x80/0xa0 lib/usercopy.c:26
 ? __fget_files+0x1a0/0x250 fs/file.c:1103
 ksys_read+0x111/0x210 fs/read_write.c:717
 ? vfs_write+0xcb0/0xcb0 include/linux/fsnotify.h:88
 ? __x64_sys_clock_settime+0x250/0x250 kernel/time/posix-timers.c:1538
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xad/0x480 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7fcc4f2e283d
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcc4dd05f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fcc4f576090 RCX: 00007fcc4f2e283d
RDX: 00000000000000e1 RSI: 00002000000006c0 RDI: 0000000000000003
RBP: 00007fcc4f3800b7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcc4f576128 R14: 00007fcc4f576090 R15: 00007fcc4dce6000
 </TASK>

Allocated by task 70:
 kasan_save_stack+0x20/0x40 mm/kasan/common.c:57
 kasan_save_track+0x10/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x77/0x90 mm/kasan/common.c:415
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 usb_alloc_dev+0x50/0xdc0 drivers/usb/core/usb.c:651
 hub_port_connect drivers/usb/core/hub.c:5470 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x1c82/0x4050 drivers/usb/core/hub.c:5953
 process_one_work+0x662/0xdb0 kernel/workqueue.c:3314
 process_scheduled_works kernel/workqueue.c:3397 [inline]
 worker_thread+0x58b/0xc70 kernel/workqueue.c:3478
 kthread+0x394/0x4b0 kernel/kthread.c:436
 ret_from_fork+0x37f/0x7b0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245

Freed by task 30325:
 kasan_save_stack+0x20/0x40 mm/kasan/common.c:57
 kasan_save_track+0x10/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x37/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x3b/0x60 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6251 [inline]
 kfree+0xf8/0x390 mm/slub.c:6566
 device_release+0xcd/0x270 drivers/base/core.c:2566
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x15b/0x260 lib/kobject.c:737
 put_device+0x1b/0x30 drivers/base/core.c:3814
 hub_quiesce+0x159/0x310 drivers/usb/core/hub.c:1405
 hub_disconnect+0xd1/0x460 drivers/usb/core/hub.c:1811
 usb_unbind_interface+0x188/0x770 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:621 [inline]
 device_remove+0x11f/0x170 drivers/base/dd.c:613
 __device_release_driver drivers/base/dd.c:1352 [inline]
 device_release_driver_internal+0x4b6/0x660 drivers/base/dd.c:1375
 usb_driver_release_interface+0x105/0x180 drivers/usb/core/driver.c:640
 proc_ioctl drivers/usb/core/devio.c:2359 [inline]
 proc_ioctl_default drivers/usb/core/devio.c:2402 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2766 [inline]
 usbdev_ioctl+0x6f05/0x86d0 drivers/usb/core/devio.c:2826
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x877/0x1640 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xad/0x480 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

The buggy address belongs to the object at ffff88802d00e000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 680 bytes inside of
 freed 2048-byte region [ffff88802d00e000, ffff88802d00e800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d008
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x4000000000000040(head|zone=1)
page_type: f5(slab)
raw: 4000000000000040 ffff888003842000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 4000000000000040 ffff888003842000 dead000000000100 dead000000000122
head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 4000000000000003 ffffea0000b40201 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88802d00e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802d00e200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802d00e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff88802d00e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802d00e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb