linux-kernel - Need help in debugging "memory leak in em28xx_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAD-N9QXsUcczurqq9LdaVjXFZMBSbStynwFJyu0UayDazGe=nw@mail.gmail.com>
Date:   Mon, 1 Nov 2021 11:02:19 +0800
From:   Dongliang Mu <mudongliangabcd@...il.com>
To:     Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-media@...r.kernel.org,
        linux-kernel <linux-kernel@...r.kernel.org>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        Pavel Skripkin <paskripkin@...il.com>,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: Need help in debugging "memory leak in em28xx_init_dev"

Hi all,

My local syzkaller instance found one bug named "memory leak in
em28xx_init_dev" in 5.14-rc5. Kernel configuration and PoC file are
attached(I don't check if the latest kernel is vulnerable, but it
should be). The trace from memleak is as follows:

backtrace:
    [<ffffffff842cc66d>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff842cc66d>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff842cc66d>] em28xx_media_device_init
drivers/media/usb/em28xx/em28xx-cards.c:3444 [inline]
    [<ffffffff842cc66d>] em28xx_init_dev.isra.0+0x366/0x9bf
drivers/media/usb/em28xx/em28xx-cards.c:3624
    [<ffffffff842cd1bd>] em28xx_usb_probe.cold+0x4f7/0xf95
drivers/media/usb/em28xx/em28xx-cards.c:3979
    [<ffffffff82bf0815>] usb_probe_interface+0x185/0x350
drivers/usb/core/driver.c:396

After debugging this bug, I found a wired phenomenon: em28xx_usb_probe
is executed, but its disconnect function is not executed.

static struct usb_driver em28xx_usb_driver = {
        .name = "em28xx",
        .probe = em28xx_usb_probe,
        .disconnect = em28xx_usb_disconnect,
         ......
};

Then a moment later(debugging), I found the problem can be that
device_driver is incorrect as the remove function does not lead to
disconnect function (em28xx_usb_disconnect).

$14 = {name = 0xffffffff8548fcc9 "usb", bus = 0xffffffff864fd1e0
<usb_bus_type>, owner = 0x0 <fixed_percpu_data>, mod_name = 0x0
<fixed_percpu_data>, probe = 0xffffffff82bf0570 <usb_probe_device>,
remove = 0xffffffff82beed90 <usb_unbind_device>,...}

Actually, the device_driver should have the following content:

$16 = {name = 0xffffffff854ea723 "em28xx", bus = 0xffffffff864fd1e0
<usb_bus_type>, owner = 0x0 <fixed_percpu_data>, mod_name =
0xffffffff854ea723 "em28xx", probe = 0xffffffff82bf0690
<usb_probe_interface>, remove = 0xffffffff82befb60
<usb_unbind_interface>, ...}

After manually reviewing some code, I found two similar functions:
usb_register_device_driver and usb_register_driver. The former sets
probe and remove like this,

new_udriver->drvwrap.driver.probe = usb_probe_device;
new_udriver->drvwrap.driver.remove = usb_unbind_device;

The latter sets probe and remove like this,

new_driver->drvwrap.driver.probe = usb_probe_interface;
new_driver->drvwrap.driver.remove = usb_unbind_interface;

And in debugging, I found another interesting point: if you "waste"
some time after em28xx_usb_probe, the device driver would be correct.

Any suggestion on the debugging of the above bug?

--
My best regards to you.

     No System Is Safe!
     Dongliang Mu

View attachment "poc.c" of type "text/x-csrc" (23563 bytes)

Download attachment "kernel_config" of type "application/octet-stream" (224652 bytes)