linux-kernel - Re: [PATCH 0/6] usbip fixes to crashes found by syzbot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <afd1341b-2ed1-f781-d6c8-6064fea3aeb8@i-love.sakura.ne.jp>
Date:   Fri, 12 Mar 2021 14:44:05 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Shuah Khan <skhan@...uxfoundation.org>, shuah@...nel.org
Cc:     valentina.manea.m@...il.com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [PATCH 0/6] usbip fixes to crashes found by syzbot

I cloned git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux.git as you are testing changes there.

> commit 09e4522c87ff54c655c09f318a68b012eda8eb01 (HEAD -> usbip_test, origin/usbip_test)
> Author: Shuah Khan <skhan@...uxfoundation.org>
> Date:   Thu Mar 11 11:18:25 2021 -0700
>
>    usbip: fix vhci races in connection tear down
>
>    - Change vhci_device_reset() to reset tcp_socket and sockfd.
>      if !in_disconnect

How it can happen? vhci_device_reset() can be called only after vhci_shutdown_connection()
completed, and vhci_shutdown_connection() from subsequent requests cannot be called until
vhci_device_reset() completes. I consider it as a dead code which should be removed by
my "[PATCH v4 05/12] usb: usbip: don't reset tcp_socket at vhci_device_reset()".

And what you are missing in your [PATCH 4,5,6/6] is

  diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
  index c4457026d5ad..3c64bd06ab53 100644
  --- a/drivers/usb/usbip/vhci_sysfs.c
  +++ b/drivers/usb/usbip/vhci_sysfs.c
  @@ -423,6 +423,7 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
          /* end the lock */

          wake_up_process(vdev->ud.tcp_rx);
  +       schedule_timeout_uninterruptible(HZ); // Consider being preempted here.
          wake_up_process(vdev->ud.tcp_tx);

          rh_port_connect(vdev, speed);

. wake_up_process(tcp_tx) can call vhci_shutdown_connection() before wake_up_process(tcp_tx) is called.
Since vhci_shutdown_connection() destroys tcp_tx thread and releases tcp_tx memory via kthread_stop_put(tcp_tx),
wake_up_process(tcp_tx) will access already freed memory. Your patch converted "NULL pointer dereference caused by
failing to call kthread_stop_put(tcp_tx)" into "use after free caused by succeeding to call kthread_stop_put(tcp_tx)".