linux-kernel - Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171109120147.GA7776@kroah.com>
Date:   Thu, 9 Nov 2017 13:01:47 +0100
From:   Greg KH <greg@...ah.com>
To:     Andrew Gabbasov <andrew_gabbasov@...tor.com>
Cc:     Felipe Balbi <balbi@...nel.org>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote:
> KASAN enabled configuration reports an error
> 
> BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
> Write of size 8 by task ...
> 
> This is observed after "ffs-test" is run and interrupted. If after that
> functionfs is unmounted and g_ffs module is unloaded, that use-after-free
> occurs during g_ffs module removal.
> 
> Although the report indicates ffs_free_inst() function, the actual
> use-after-free condition occurs in _ffs_free_dev() function, which
> is probably inlined into ffs_free_inst().
> 
> This happens due to keeping the ffs_data reference in device structure
> during functionfs unmounting, while ffs_data itself is freed as no longer
> needed. The fix is to clear that reference in ffs_closed() function,
> which is a counterpart of ffs_ready(), where the reference is stored.
> 
> Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
> Cc: stable@...r.kernel.org
> Signed-off-by: Andrew Gabbasov <andrew_gabbasov@...tor.com>
> ---
>  drivers/usb/gadget/function/f_fs.c | 1 +
>  1 file changed, 1 insertion(+)

Felipe, want me to take this directly?

thanks,

greg k-h