linux-kernel - [PATCH 0/6] usbip fixes to crashes found by syzbot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <cover.1615171203.git.skhan@linuxfoundation.org>
Date:   Sun,  7 Mar 2021 20:53:25 -0700
From:   Shuah Khan <skhan@...uxfoundation.org>
To:     shuah@...nel.org, valentina.manea.m@...il.com,
        gregkh@...uxfoundation.org
Cc:     Shuah Khan <skhan@...uxfoundation.org>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, penguin-kernel@...ove.SAKURA.ne.jp
Subject: [PATCH 0/6] usbip fixes to crashes found by syzbot

This patch series fixes the following problems founds in syzbot
fuzzing.

1. The first 3 patches fix usbip-host, vhci_hcd, vudc sub-drivers to
   validate the passed in file descriptor is a stream socket. If the
   file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg()
   can't detect end of stream. Reported and fix suggested by Tetsuo Handa
2. All 3 sub-drivers use a common kthread_get_run() to create and 
   start threads. There are races in updating the local and shared status
   in the current stub-up (usbip-host, vudc) and attach (vhci) sequences
   resulting in crashes. These stem from starting rx and tx threads before
   local and shared state is updated correctly to be in sync.

    1. Doesn't handle kthread_create() error and saves invalid ptr in local
       state that drives rx and tx threads. Reported and fix suggested by
       Tetsuo Handa.
    2. Updates tcp_socket and sockfd,  starts stub_rx and stub_tx threads
       before updating usbip_device status to correct state. This opens up
       a race condition between the threads and tear down sequences.

TODO: Once these fixes are in, kthread_get_run() macro can be removed
      in a cleanup patch.

Credit goes to syzbot and Tetsuo Handa for finding and root-causing the
kthread_get_run() improper error handling problem and others. This is a
hard problem to find and debug since the races aren't seen in a normal
case. Fuzzing forces the race window to be small enough for the
kthread_get_run() error path bug and starting threads before updating the
local and shared state bug in the stub-up sequence.

Shuah Khan (6):
  usbip: fix stub_dev to check for stream socket
  usbip: fix vhci_hcd to check for stream socket
  usbip: fix vudc to check for stream socket
  usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
  usbip: fix vhci_hcd attach_store() races leading to gpf
  usbip: fix vudc usbip_sockfd_store races leading to gpf

 drivers/usb/usbip/stub_dev.c   | 42 ++++++++++++++++++++++++-----
 drivers/usb/usbip/vhci_sysfs.c | 39 +++++++++++++++++++++++----
 drivers/usb/usbip/vudc_sysfs.c | 49 +++++++++++++++++++++++++++++-----
 3 files changed, 111 insertions(+), 19 deletions(-)

-- 
2.27.0