linux-kernel - Re: [PATCH] usb: gadget: configfs: Fix KASAN use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87bmv6kpa7.fsf@linux.intel.com>
Date:   Tue, 17 Jan 2017 11:29:36 +0200
From:   Felipe Balbi <balbi@...nel.org>
To:     Greg KH <greg@...ah.com>
Cc:     Jim Lin <jilin@...dia.com>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: gadget: configfs: Fix KASAN use-after-free


Hi,

Greg KH <greg@...ah.com> writes:
> On Tue, Jan 17, 2017 at 10:07:40AM +0200, Felipe Balbi wrote:
>> 
>> Hi,
>> 
>> Jim Lin <jilin@...dia.com> writes:
>> > When gadget is disconnected, running sequence is like this.
>> > . android_work: sent uevent USB_STATE=DISCONNECTED
>> 
>> I'm gonna have to ask you to try with actual mainline where there are no
>> Android changes.
>
> What is android changing these days in the gadget stack that is not
> already upstream?

quite a bit, actually. They have their own android_setup() and an
android_worker thread for notifications. These notifications actually
duplicate (poorly) what we already have for usb_gadget_set_state(). They
also completely ditch composite_setup() to reimplement it with their own
additions. There's also an android class added to
configfs. Android-specific uevents. Android-specific ->disconnect()
implementation, overwriting what we have on composite.c. I just took a
diff from v4.4.10 to current Android head which we're using for some
other project

 drivers/usb/gadget/Kconfig                   |   50 +++++
 drivers/usb/gadget/composite.c               |    6 +
 drivers/usb/gadget/configfs.c                |  264 +++++++++++++++++++++++-
 drivers/usb/gadget/function/Makefile         |    8 +
 drivers/usb/gadget/function/f_accessory.c    | 1335 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 drivers/usb/gadget/function/f_audio_source.c | 1060 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 drivers/usb/gadget/function/f_fs.c           |   11 +-
 drivers/usb/gadget/function/f_midi.c         |   66 ++++++
 drivers/usb/gadget/function/f_mtp.c          | 1533 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 drivers/usb/gadget/function/f_mtp.h          |   18 ++
 drivers/usb/gadget/function/f_ptp.c          |   38 ++++
 drivers/usb/gadget/function/f_rndis.c        |   30 +++
 drivers/usb/gadget/function/rndis.c          |  112 ++++++++--
 drivers/usb/gadget/function/rndis.h          |    2 +
 drivers/usb/gadget/function/u_ether.c        |  305 ++++++++++++++++++++++------
 drivers/usb/gadget/function/u_ether.h        |    3 +
 drivers/usb/gadget/functions.c               |    2 +-
 17 files changed, 4757 insertions(+), 86 deletions(-)

rather extensive.

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)