linux-kernel - Re: [PATCH] usbip: fix vhci races in connection tear down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3d2c0b3b-07fb-8f59-d7b4-81d7d992636c@linuxfoundation.org>
Date:   Fri, 12 Mar 2021 11:43:02 -0700
From:   Shuah Khan <skhan@...uxfoundation.org>
To:     Johan Hovold <johan@...nel.org>
Cc:     valentina.manea.m@...il.com, shuah@...nel.org,
        gregkh@...uxfoundation.org, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        syzbot+a93fba6d384346a761e3@...kaller.appspotmail.com,
        Shuah Khan <skhan@...uxfoundation.org>
Subject: Re: [PATCH] usbip: fix vhci races in connection tear down

On 3/12/21 3:45 AM, Johan Hovold wrote:
> On Thu, Mar 11, 2021 at 07:27:37PM -0700, Shuah Khan wrote:
>> vhci_shutdown_connection() references connection state (tcp_socket,
>> tcp_rx, tcp_tx, sockfd) saved in usbpip_device without holding the
>> lock.
>>
>> Current connection tear down sequence:
>> Step 1: shutdown the socket
>> Step 2: stop rx thread and reset tcp_rx pointer
>> Step 3: stop tx thread and reset tcp_tx pointer
>> Step 4: Reset tcp_socket and sockfd
>>
>> There are several race windows between these steps. In addition, device
>> reset routine (vhci_device_reset) resets tcp_socket and sockfd holding
>> the lock.
>>
>> Fix these races:
>> - Introduce in_disconnect flag to ensure vhci_shutdown_connection() runs
>>    only once.
>> - Change attach_store() to initialize in_disconnect to false while
>>    initializing connection status (tcp_socket, tcp_rx, tcp_tx, sockfd)
>> - Change vhci_shutdown_connection() to check in_disconnect and bail
>>    out if disconnect is in progress.
>> - Change vhci_shutdown_connection() to
>>    -- hold lock to save connection state pointers and unlock.
>>    -- Shutdown the socket and stop threads.
>>    -- Hold lock to clear connection status and in_disconnect flag.
>> - Change vhci_device_reset() to reset tcp_socket and sockfd.
>>    if !in_disconnect
>>
>> Tested syzbot and the reproducer did not trigger any issue.
>>
>> Reported-and-tested-by: syzbot+a93fba6d384346a761e3@...kaller.appspotmail.com
>> Signed-off-by: Shuah Khan <skhan@...uxfoundation.org>
>> ---
>>   drivers/usb/usbip/usbip_common.h |  1 +
>>   drivers/usb/usbip/vhci_hcd.c     | 55 +++++++++++++++++++++++---------
>>   drivers/usb/usbip/vhci_sysfs.c   |  4 +++
>>   3 files changed, 45 insertions(+), 15 deletions(-)
> 
>> diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
>> index 3209b5ddd30c..c1917efe5737 100644
>> --- a/drivers/usb/usbip/vhci_hcd.c
>> +++ b/drivers/usb/usbip/vhci_hcd.c
>> @@ -1007,31 +1007,54 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
>>   static void vhci_shutdown_connection(struct usbip_device *ud)
>>   {
>>   	struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);
>> +	unsigned long flags;
>> +	struct socket *socket;
>> +	struct task_struct *tcp_rx = NULL;
>> +	struct task_struct *tcp_tx = NULL;
>> +	int sockfd = 0;
>> +
>> +	spin_lock_irqsave(&ud->lock, flags);
>> +	if (vdev->ud.in_disconnect) {
>> +		pr_info("%s: Disconnect in progress for sockfd %d\n",
>> +			__func__, ud->sockfd);
> 
> Looks like you forgot to remove all you debug printks like this one
> before submitting.
> 

Some printks were already in there and helped with debug. Yes I added
a few more when I submitted for syzbot testing.

I will clean them up i v2.

thanks,
-- Shuah