Re: [PATCH] usb: gadget: f_uac1_legacy: fix double close of the ALSA devices

[Vasileios Almpanis]

> f_audio_bind() records that the ALSA files are open in the function
> instance flag opts->bound, but keeps the file pointers in the
> per-function gaudio card. Its error path calls gaudio_cleanup(), which
> closes the files without clearing the filp pointers or opts->bound.
> A failed bind does not destroy the usb_function, configfs_composite_bind()
> puts it back on cfg->func_list, so the next write to UDC binds the same
> f_audio, skips gaudio_setup() because opts->bound is still set, and on
> failure closes the files a second time. Dropping the config symlink after
> a failed bind closes them again via f_audio_free().
> 
> BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190 fs/open.c:1464
> Read of size 8 at addr ffff888045f01990 by task syz-executor659/5617
> Call Trace:
>  filp_close+0x1d/0x40 fs/open.c:1484
>  gaudio_close_snd_dev drivers/usb/gadget/function/u_uac1_legacy.c:263 [inline]
>  gaudio_cleanup+0x54/0xf0 drivers/usb/gadget/function/u_uac1_legacy.c:305
>  f_audio_bind+0x4a0/0x630 drivers/usb/gadget/function/f_uac1_legacy.c:792
>  usb_add_function+0x290/0x930 drivers/usb/gadget/composite.c:333
>  configfs_composite_bind+0xde0/0x1410 drivers/usb/gadget/configfs.c:1802
>  gadget_bind_driver+0x2ca/0x9e0 drivers/usb/gadget/udc/core.c:1662
>  gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300
> 
> Clear filp, substream and card in gaudio_close_snd_dev() so cleanup is
> idempotent, and close the devices on the bind error path only if that
> bind opened them, resetting opts->bound as well.
> 
Hi everyone,

Just following up on this patch. It has been already been tested with
syzbot and the issue appears as fixed with this patch. Could you please
take a look when you get a chance?

Kind regards,

-- 
Vasileios Almpanis <vasilisalmpanis@xxxxxxxxx>