linux-kernel - Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <878tqakmiy.fsf@linux.intel.com>
Date:   Tue, 17 Jan 2017 12:29:09 +0200
From:   Felipe Balbi <balbi@...nel.org>
To:     Jim Lin <jilin@...dia.com>
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        Jim Lin <jilin@...dia.com>
Subject: Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free


Hi,

Jim Lin <jilin@...dia.com> writes:
> When gadget is disconnected, running sequence is like this.
> . composite_disconnect
> . Call trace:
>   usb_string_copy+0xd0/0x128
>   gadget_config_name_configuration_store+0x4
>   gadget_config_name_attr_store+0x40/0x50
>   configfs_write_file+0x198/0x1f4
>   vfs_write+0x100/0x220
>   SyS_write+0x58/0xa8
> . configfs_composite_unbind
> . configfs_composite_bind
>
> In configfs_composite_bind, it has
> "cn->strings.s = cn->configuration;"
>
> When usb_string_copy is invoked. it would
> allocate memory, copy input string, release previous pointed memory space,
> and use new allocated memory.
>
> When gadget is connected, host sends down request to get information.
> Call trace:
>   usb_gadget_get_string+0xec/0x168
>   lookup_string+0x64/0x98
>   composite_setup+0xa34/0x1ee8
>
> If gadget is disconnected and connected quickly, in the failed case,
> cn->configuration memory has been released by usb_string_copy kfree but
> configfs_composite_bind hasn't been run in time to assign new allocated
> "cn->configuration" pointer to "cn->strings.s".
>
> When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
> memory is accessed, "BUG: KASAN: use-after-free" error occurs.
>
> Signed-off-by: Jim Lin <jilin@...dia.com>
> ---
> Changes in v2:
> Changes in v3:
>  Change commit description

well, I need to be sure you tested this with Linus' tree. The reason I'm
asking is because this could be a bug caused by Android changes. From
your previous patch, the problem started with android_setup().

Please test with v4.10-rc4 and any configfs-based gadget.

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)