linux-kernel - Re: [PATCH] driver core : Fix use after free of dev->parent in device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Sep 2013 15:10:11 -0700
From:	Greg KH <gregkh@...uxfoundation.org>
To:	Benson Leung <bleung@...omium.org>
Cc:	ming.lei@...onical.com, linux-kernel@...r.kernel.org,
	olofj@...omium.org, stable@...r.kernel.org
Subject: Re: [PATCH] driver core : Fix use after free of dev->parent in
 device_shutdown

On Tue, Sep 24, 2013 at 02:39:08PM -0700, Benson Leung wrote:
> The put_device(dev) at the bottom of the loop of device_shutdown
> may result in the dev being cleaned up. In device_create_release,
> the dev is kfreed.
> 
> However, device_shutdown attempts to use the dev pointer again after
> put_device by referring to dev->parent.
> 
> Copy the parent pointer instead to avoid this condition.
> 
> This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
> See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
> This can easily be reproduced when shutting down with
> hidraw devices that report battery condition.
> Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
> For example, with the magic mouse :
> The dev in question is "hidraw0"
> dev->parent is "magicmouse"
> 
> In the course of the shutdown for this device, the input event cleanup calls
> a put on hidraw0, decrementing its reference count.
> When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
> is called and device_create_release does kfree(dev).
> dev->parent is no longer valid, and we may crash in
> put_device(dev->parent).
> 
> This change should be applied on any kernel with this change :
> d1c6c030fcec6f860d9bb6c632a3ebe62e28440b
> 
> Cc: stable@...r.kernel.org
> Signed-off-by: Benson Leung <bleung@...omium.org>

The patch makes sense, but I wonder why no one has ever seen this
problem before.

Odd...

thanks for the fix, I'll queue it up for 3.12-final soon.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/