| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1396921817.10644.16.camel@bichao>
Date: Tue, 08 Apr 2014 09:50:17 +0800
From: Chao Bi <chao.bi@...el.com>
To: balbi@...com, gregkh@...uxfoundation.org
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] Gadget: race between ffs_epfile_io() and
ffs_func_eps_disable()
ffs_epfile_io() is called from userspace, while ffs_func_esp_disable() might
be called from USB disconnect interrupt, the two functions would run in parallel
but they are not well protected, that epfile->ep would be removed by
ffs_func_esp_disable() during ffs_epfile_io() is referring this pointer, then it
leads to kernel PANIC.
The scenario is as below:
Thread 1 Thread 2
| |
SyS_read dwc3_gadget_disconnect_interrupt
| |From 772c1c9ef451a9a84e48acf14ba613328920a2f4 Mon Sep 17 00:00:00 2001
From: channing <chao.bi@...el.com>
Date: Wed, 2 Apr 2014 16:37:57 +0800
Subject: [PATCH] Gadget: race between ffs_epfile_io() and
ffs_func_eps_disable()
ffs_epfile_io() is called from userspace, while ffs_func_esp_disable() might
be called from USB disconnect interrupt, the two functions would run in parallel
but they are not well protected, that epfile->ep would be removed by
ffs_func_esp_disable() during ffs_epfile_io() is referring this pointer, then it
leads to kernel PANIC.
The scenario is as below:
Thread 1 Thread 2
| |
SyS_read dwc3_gadget_disconnect_interrupt
| |
ffs_epfile_read reset_config
| |
ffs_epfile_io ffs_func_eps_disable
| |
----- usb_ep_disable(): epfile->ep->ep->desc = NULL
| |
usb_ep_align_maybe(): -----
it refers ep->desc->wMaxPacketSize -----
Signed-off-by: Chao Bi <chao.bi@...el.com>
---
drivers/usb/gadget/f_fs.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 2e164dc..1e12b3e 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -745,6 +745,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
*/
struct usb_gadget *gadget = epfile->ffs->gadget;
+ spin_lock_irq(&epfile->ffs->eps_lock);
+ /* In the meantime, endpoint got disabled or changed. */
+ if (epfile->ep != ep) {
+ spin_unlock_irq(&epfile->ffs->eps_lock);
+ return -ESHUTDOWN;
+ }
/*
* Controller may require buffer size to be aligned to
* maxpacketsize of an out endpoint.
@@ -752,6 +758,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
data_len = io_data->read ?
usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
io_data->len;
+ spin_unlock_irq(&epfile->ffs->eps_lock);
data = kmalloc(data_len, GFP_KERNEL);
if (unlikely(!data))
--
1.7.9.5
ffs_epfile_read reset_config
| |
ffs_epfile_io ffs_func_eps_disable
| |
----- usb_ep_disable(): epfile->ep->ep->desc = NULL
| |
usb_ep_align_maybe(): -----
it refers ep->desc->wMaxPacketSize -----
Signed-off-by: Chao Bi <chao.bi@...el.com>
---
drivers/usb/gadget/f_fs.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 2e164dc..1e12b3e 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -745,6 +745,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
*/
struct usb_gadget *gadget = epfile->ffs->gadget;
+ spin_lock_irq(&epfile->ffs->eps_lock);
+ /* In the meantime, endpoint got disabled or changed. */
+ if (epfile->ep != ep) {
+ spin_unlock_irq(&epfile->ffs->eps_lock);
+ return -ESHUTDOWN;
+ }
/*
* Controller may require buffer size to be aligned to
* maxpacketsize of an out endpoint.
@@ -752,6 +758,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
data_len = io_data->read ?
usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
io_data->len;
+ spin_unlock_irq(&epfile->ffs->eps_lock);
data = kmalloc(data_len, GFP_KERNEL);
if (unlikely(!data))
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists