linux-kernel - net/gadget: slab-out-of-bounds write in dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 6 Dec 2016 15:29:46 +0100
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Felipe Balbi <balbi@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Marek Szyprowski <m.szyprowski@...sung.com>,
        David Sterba <dsterba@...e.com>,
        Ryusuke Konishi <konishi.ryusuke@....ntt.co.jp>,
        David Eccher <d.eccher@...il.com>, Bin Liu <b-liu@...com>,
        Mathieu Laurendeau <mat.lau@...oste.net>,
        Binyamin Sharet <s.binyamin@...il.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        linux-usb@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: net/gadget: slab-out-of-bounds write in dev_config

Hi!

I've got the following error report while running the syzkaller fuzzer.

ep0_write() doesn't check the length, so a user can cause an
out-of-bounds with both size and data controlled.
There's a comment which says "IN DATA+STATUS caller makes len <=
wLength". While I'm not exactly sure what that means, the length seems
to be passed unmodified directly from dev_config().

This doesn't seem to be a critical security issue since gadgetfs can't
be mounted from a user namespace.

On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2).

==================================================================
BUG: KASAN: slab-out-of-bounds in dev_config+0x86f/0x1190 at addr
ffff88003c47e160
Write of size 65537 by task syz-executor0/6356
CPU: 3 PID: 6356 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff88003c107ad8 ffffffff81f96aba ffffffff3dc11ef0 1ffff10007820eee
 ffffed0007820ee6 ffff88003dc11f00 0000000041b58ab3 ffffffff8598b4c8
 ffffffff81f96828 ffffffff813fb4a0 ffff88003b6eadc0 ffff88003c107738
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff81f96aba>] dump_stack+0x292/0x398 lib/dump_stack.c:51
 [<ffffffff817e4dec>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:159
 [<     inline     >] print_address_description mm/kasan/report.c:197
 [<ffffffff817e5080>] kasan_report_error+0x1f0/0x4e0 mm/kasan/report.c:286
 [<ffffffff817e5705>] kasan_report+0x35/0x40 mm/kasan/report.c:306
 [<     inline     >] check_memory_region_inline mm/kasan/kasan.c:308
 [<ffffffff817e3fb9>] check_memory_region+0x139/0x190 mm/kasan/kasan.c:315
 [<ffffffff817e4044>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
 [<     inline     >] copy_from_user arch/x86/include/asm/uaccess.h:689
 [<     inline     >] ep0_write drivers/usb/gadget/legacy/inode.c:1135
 [<ffffffff83228caf>] dev_config+0x86f/0x1190
drivers/usb/gadget/legacy/inode.c:1759
 [<ffffffff817fdd55>] __vfs_write+0x5d5/0x760 fs/read_write.c:510
 [<ffffffff817ff650>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<     inline     >] SYSC_write fs/read_write.c:607
 [<ffffffff81803a5b>] SyS_write+0xfb/0x230 fs/read_write.c:599
 [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003c47e038, in cache kmalloc-1024 size: 1024
Allocated:
PID = 4565
 [   43.417154] [<ffffffff81203526>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
 [   43.417154] [<ffffffff817e40d3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 [   43.417154] [<     inline     >] set_track mm/kasan/kasan.c:507
 [   43.417154] [<ffffffff817e435d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
 [   43.417154] [<ffffffff817dfa02>] kmem_cache_alloc_trace+0x82/0x270
mm/slub.c:2735
 [   43.417154] [<     inline     >] kmalloc include/linux/slab.h:490
 [   43.417154] [<     inline     >] kzalloc include/linux/slab.h:636
 [   43.417154] [<     inline     >] dev_new
drivers/usb/gadget/legacy/inode.c:170
 [   43.417154] [<ffffffff832276ca>] gadgetfs_fill_super+0x24a/0x540
drivers/usb/gadget/legacy/inode.c:1987
 [   43.417154] [<ffffffff8180bb61>] mount_single+0xf1/0x160 fs/super.c:1146
 [   43.417154] [<ffffffff8322290c>] gadgetfs_mount+0x2c/0x40
drivers/usb/gadget/legacy/inode.c:2013
 [   43.417154] [<ffffffff8180be87>] mount_fs+0x97/0x2e0 fs/super.c:1177
 [   43.417154] [<ffffffff8187fc47>] vfs_kern_mount.part.24+0x67/0x2f0
fs/namespace.c:954
 [   43.417154] [<     inline     >] vfs_kern_mount fs/namespace.c:2433
 [   43.417154] [<     inline     >] do_new_mount fs/namespace.c:2436
 [   43.417154] [<ffffffff81888f58>] do_mount+0x418/0x2da0 fs/namespace.c:2758
 [   43.417154] [<     inline     >] SYSC_mount fs/namespace.c:2974
 [   43.417154] [<ffffffff8188c2ab>] SyS_mount+0xab/0x120 fs/namespace.c:2951
 [   43.417154] [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 0
(stack is not available)
Memory state around the buggy address:
 ffff88003c47e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88003c47e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88003c47e200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
                                                       ^
 ffff88003c47e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88003c47e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================