Re: [PATCH RFC] usbip: fix use-after-free in event_handler()

#syz upstream

On Mon, Aug 3, 2026 at 11:26=E2=80=AFAM 'syzbot' via
syzkaller-upstream-moderation
<[email protected]> wrote:
>
> The event_handler function in drivers/usb/usbip/usbip_event.c is a
> workqueue item responsible for processing events for a struct usbip_devic=
e.
> During device teardown, usbip_stop_eh() is called to wait for the event
> handler to finish processing. However, usbip_stop_eh() uses
> wait_event_interruptible() and ignores its return value. If the process
> unbinding the driver receives a signal, wait_event_interruptible() return=
s
> immediately, causing the teardown process to falsely assume the event
> handler has finished. The teardown process then proceeds to free the
> usbip_device memory. Meanwhile, the event_handler workqueue is still
> running and attempts to access the freed usbip_device, resulting in a KAS=
AN
> slab-use-after-free crash.
>
> BUG: KASAN: slab-use-after-free in __mutex_lock_common
> kernel/locking/rtmutex_api.c:559 [inline]
> BUG: KASAN: slab-use-after-free in mutex_lock_nested+0x5a/0x1d0
> kernel/locking/rtmutex_api.c:578
> Read of size 1 at addr ffff8881145245b0 by task kworker/u8:5/6177
>
> Call Trace:
>  <TASK>
>  lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5842
>  __mutex_lock_common kernel/locking/rtmutex_api.c:559 [inline]
>  mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:578
>  event_handler+0x1e3/0x4a0 drivers/usb/usbip/usbip_event.c:73
>  process_one_work kernel/workqueue.c:3322 [inline]
>  process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
>  worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
>  kthread+0x388/0x470 kernel/kthread.c:436
>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
>
> To fix this, change wait_event_interruptible() to wait_event() in
> usbip_stop_eh(). This ensures that the teardown process strictly waits fo=
r
> the event handler to finish its execution and drop all references to the
> usbip_device before the memory is freed, preventing the use-after-free.
> This change is safe from deadlocks because usbip_stop_eh() is never calle=
d
> with locks held that the event_handler would need to acquire.
>
> Fixes: bb7871ad99ea ("usbip: event handler as one thread")
> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3Df4518ac0a3dd3aafde38
> Link: https://syzkaller.appspot.com/ai_job?id=3D88101c8e-4da9-45de-b879-0=
549d6fe5649
> To: "Greg Kroah-Hartman" <[email protected]>
> To: <[email protected]>
> To: "Shuah Khan" <[email protected]>
> To: "Valentina Manea" <[email protected]>
> To: "Nobuo Iwata" <[email protected]>
> Cc: "Hongren Zheng" <[email protected]>
> Cc: <[email protected]>
>
> ---
> diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_ev=
ent.c
> index 0e00c2d00..81d761891 100644
> --- a/drivers/usb/usbip/usbip_event.c
> +++ b/drivers/usb/usbip/usbip_event.c
> @@ -115,7 +115,7 @@ void usbip_stop_eh(struct usbip_device *ud)
>         if (pending)
>                 usbip_dbg_eh("usbip_eh waiting completion %lx\n", pending=
);
>
> -       wait_event_interruptible(ud->eh_waitq, !(ud->event & ~USBIP_EH_BY=
E));
> +       wait_event(ud->eh_waitq, !(ud->event & ~USBIP_EH_BYE));
>         usbip_dbg_eh("usbip_eh has stopped\n");
>  }
>  EXPORT_SYMBOL_GPL(usbip_stop_eh);
>
>
> base-commit: 075b74841bd0065a3bda3440873c747938e69b68
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated =
patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at [email protected].
>
> --
> You received this message because you are subscribed to the Google Groups=
 "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to [email protected].
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller=
-upstream-moderation/330619da-665c-4dd6-ac14-30e8bef174fd%40mail.kernel.org=
.