[PATCH v2 0/4] usb: gadget: f_hid: three GET_REPORT fixes

[Shunbo Shi]

Cover-letter:

Hi Greg,

v2 of this series.  Changes from v1, driven by the Sashiko AI
review and further self-review:

  - the dedicated response buffer introduced in patch 3 is now
    freed in hidg_unbind() and on the bind() error paths instead
    of hidg_disable(): hidg_set_alt() never reallocates it, so the
    v1 placement caused a use-after-free after a USB reset;
  - the tail of the response buffer is zeroed so no uninitialized
    slab memory is sent to the host;
  - the now unused get_report member is removed from struct f_hidg;
  - a pre-existing leak of get_req when usb_gstrings_attach()
    fails, found while auditing the bind() error paths, is split
    out into its own patch (4).

Patch 1 and 2 are unchanged from v1.

While reviewing the f_hid GET_REPORT userspace ioctl feature
(a139c98f760e, v6.11) I found these bugs in it:

  1. sleep-in-atomic-context: the second copy_from_user() in
     f_hidg_get_report() runs under spin_lock_irqsave(); a page
     fault on the user buffer deadlocks the scheduler.

  2. memory leak: report_list entries allocated by the ioctl are
     never freed in hidg_release().

  3. data race: the GET_REPORT response is served by pointing
     get_req->buf directly at a report_list entry's data; the
     request completes asynchronously after the spinlock is
     dropped, so a concurrent ioctl updating the same entry
     corrupts the data on the wire (a torn write).

  4. memory leak: get_req is leaked when usb_gstrings_attach()
     fails in hidg_bind().

All four were introduced by the same commit and are fixable
deterministically from the code.

Shunbo Shi (4):
  usb: gadget: f_hid: fix sleep-in-atomic-context in f_hidg_get_report()
  usb: gadget: f_hid: fix report_list entries leak
  usb: gadget: f_hid: fix race between userspace report update and
  GET_REPORT response
  usb: gadget: f_hid: fix get_req leak when usb_gstrings_attach() fails

 drivers/usb/gadget/function/f_hid.c | 61 +++++++++++++++++++++++++++----
 1 file changed, 48 insertions(+), 13 deletions(-)

--
2.53.0