linux-kernel - [PATCH] usb: iowarrior: fix access to freed data structure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  9 Oct 2019 00:23:07 +0200
From:   Valentin Vidic <vvidic@...entin-vidic.from.hr>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Oliver Neukum <oneukum@...e.com>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Valentin Vidic <vvidic@...entin-vidic.from.hr>,
        syzbot+0761012cebf7bdb38137@...kaller.appspotmail.com
Subject: [PATCH] usb: iowarrior: fix access to freed data structure

struct iowarrior gets freed prematurely in iowarrior_release while
it is still being referenced from usb_interface, so let only
iowarrior_disconnect call iowarrior_delete.

Fixes: KMSAN: uninit-value in iowarrior_disconnect
Reported-by: syzbot+0761012cebf7bdb38137@...kaller.appspotmail.com
Signed-off-by: Valentin Vidic <vvidic@...entin-vidic.from.hr>
---
 drivers/usb/misc/iowarrior.c | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index f5bed9f29e56..0492ea76c4bf 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -638,7 +638,6 @@ static int iowarrior_open(struct inode *inode, struct file *file)
 static int iowarrior_release(struct inode *inode, struct file *file)
 {
 	struct iowarrior *dev;
-	int retval = 0;
 
 	dev = file->private_data;
 	if (!dev)
@@ -650,27 +649,23 @@ static int iowarrior_release(struct inode *inode, struct file *file)
 	mutex_lock(&dev->mutex);
 
 	if (dev->opened <= 0) {
-		retval = -ENODEV;	/* close called more than once */
 		mutex_unlock(&dev->mutex);
-	} else {
-		dev->opened = 0;	/* we're closing now */
-		retval = 0;
-		if (dev->present) {
-			/*
-			   The device is still connected so we only shutdown
-			   pending read-/write-ops.
-			 */
-			usb_kill_urb(dev->int_in_urb);
-			wake_up_interruptible(&dev->read_wait);
-			wake_up_interruptible(&dev->write_wait);
-			mutex_unlock(&dev->mutex);
-		} else {
-			/* The device was unplugged, cleanup resources */
-			mutex_unlock(&dev->mutex);
-			iowarrior_delete(dev);
-		}
+		return -ENODEV;	/* close called more than once */
 	}
-	return retval;
+
+	dev->opened = 0;	/* we're closing now */
+	if (dev->present) {
+		/*
+		 * The device is still connected so we only shutdown
+		 * pending read/write ops.
+		 */
+		usb_kill_urb(dev->int_in_urb);
+		wake_up_interruptible(&dev->read_wait);
+		wake_up_interruptible(&dev->write_wait);
+	}
+
+	mutex_unlock(&dev->mutex);
+	return 0;
 }
 
 static __poll_t iowarrior_poll(struct file *file, poll_table * wait)
-- 
2.20.1