linux-kernel - Re: [PATCH] usb: gadget: f_fs: Fix setting of device and driver data cross-references

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210702184957.4479-1-andrew_gabbasov@mentor.com>
Date:   Fri, 2 Jul 2021 13:49:56 -0500
From:   Andrew Gabbasov <andrew_gabbasov@...tor.com>
To:     Macpaul Lin <macpaul.lin@...iatek.com>,
        Eugeniu Rosca <erosca@...adit-jv.com>,
        <linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <stable@...r.kernel.org>, Felipe Balbi <balbi@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Eugeniu Rosca <roscaeugeniu@...il.com>,
        Eddie Hung <eddie.hung@...iatek.com>,
        Andrew Gabbasov <andrew_gabbasov@...tor.com>
Subject: Re: [PATCH] usb: gadget: f_fs: Fix setting of device and driver data cross-references


> -----Original Message-----
> From: Macpaul Lin <macpaul@...il.com>
> Sent: Friday, July 02, 2021 6:02 PM
> To: Eugeniu Rosca <erosca@...adit-jv.com>; stable@...r.kernel.org
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>; Felipe Balbi <balbi@...nel.org>; Gabbasov, Andrew
> <Andrew_Gabbasov@...tor.com>; linux-usb@...r.kernel.org; linux-kernel@...r.kernel.org; Eugeniu Rosca
> <roscaeugeniu@...il.com>; Macpaul Lin <macpaul.lin@...iatek.com>; Eddie Hung <eddie.hung@...iatek.com>
> Subject: Re: [PATCH] usb: gadget: f_fs: Fix setting of device and driver data cross-references
> 
> Eugeniu Rosca <erosca@...adit-jv.com> wrote:
> >
> > Hello,
> >
> > On Thu, Jun 03, 2021 at 12:15:07PM -0500, Andrew Gabbasov wrote:
> > > FunctionFS device structure 'struct ffs_dev' and driver data structure
> > > 'struct ffs_data' are bound to each other with cross-reference pointers
> > > 'ffs_data->private_data' and 'ffs_dev->ffs_data'. While the first one
> > > is supposed to be valid through the whole life of 'struct ffs_data'
> > > (and while 'struct ffs_dev' exists non-freed), the second one is cleared
> > > in 'ffs_closed()' (called from 'ffs_data_reset()' or the last
> > > 'ffs_data_put()'). This can be called several times, alternating in
> > > different order with 'ffs_free_inst()', that, if possible, clears
> > > the other cross-reference.
> > >
> 
> [Skip some comment...]
> 
> > I confirm there are at least two KASAN use-after-free issues
> > consistently/100% reproducible on v5.13-rc4-88-gf88cd3fb9df2:
> >
> > https://gist.github.com/erosca/b5976a96789e574b319cb9e076938b5c
> > https://gist.github.com/erosca/4ded55ed32f0133bc2f4ccfe821c7776
> >
> > These two can no longer be seen after the patch is applied.
> >
> > In addition, below static analysis tools did not spot any regressions:
> > cppcheck 2.4, smatch v0.5.0-7445-g58776ae33ae8, make W=1, coccicheck
> >
> > Reviewed-by: Eugeniu Rosca <erosca@...adit-jv.com>
> > Tested-by: Eugeniu Rosca <erosca@...adit-jv.com>
> >
> > --
> > Best regards,
> > Eugeniu Rosca
> 
> It like there is similar issue on kernel-4.14 reported by our customer
> (Android).
> The back trace are similar.
> It looks like this patch has fixed issue existed in earlier kernels.
> Could Engeniu and Andrew help to comment if this fix is suggested to be pick to
> stable-tree? I've tried to port it onto kernel-4.14, kernel-4.19, and
> kernel-5.10.
> But it seems there is some revise work to do.
> If the origin issue affect multiple LTS kernel versions, then it will
> be better to be
> cherry-pick to stable-tree after it has been merged.
> Thanks!
> 
> --
> Best regards,
> Macpaul Lin

Hello!

Originally this issue was discovered exactly in v4.14 (non-Android),
and the fix was developed for that version and later forward-ported to
latest mainline 5.13. So, indeed, it makes sense to apply the fix
to stable versions (after it has been merged to mainline).

I'm submitting the same patch, back-ported to stable/linux-4.14.y.
It can also be applied to linux-4.19.y. While original 5.13 fix is
applicable to linux-5.10.y.

Thanks!

Best regards,
Andrew Gabbasov