linux-kernel - Re: rsi: Fix use-after-free in rsi_rx_done

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <163818261048.17830.10234717976356726248.kvalo@codeaurora.org>
Date:   Mon, 29 Nov 2021 10:43:35 +0000 (UTC)
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Zekun Shen <bruceshenzk@...il.com>
Cc:     bruceshenzk@...il.com, Amitkumar Karwar <amitkarwar@...il.com>,
        Siva Rebbagondla <siva8118@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, brendandg@....edu
Subject: Re: rsi: Fix use-after-free in rsi_rx_done_handler()

Zekun Shen <bruceshenzk@...il.com> wrote:

> When freeing rx_cb->rx_skb, the pointer is not set to NULL,
> a later rsi_rx_done_handler call will try to read the freed
> address.
> This bug will very likley lead to double free, although
> detected early as use-after-free bug.
> 
> The bug is triggerable with a compromised/malfunctional usb
> device. After applying the patch, the same input no longer
> triggers the use-after-free.
> 
> Attached is the kasan report from fuzzing.
> 
> BUG: KASAN: use-after-free in rsi_rx_done_handler+0x354/0x430 [rsi_usb]
> Read of size 4 at addr ffff8880188e5930 by task modprobe/231
> Call Trace:
>  <IRQ>
>  dump_stack+0x76/0xa0
>  print_address_description.constprop.0+0x16/0x200
>  ? rsi_rx_done_handler+0x354/0x430 [rsi_usb]
>  ? rsi_rx_done_handler+0x354/0x430 [rsi_usb]
>  __kasan_report.cold+0x37/0x7c
>  ? dma_direct_unmap_page+0x90/0x110
>  ? rsi_rx_done_handler+0x354/0x430 [rsi_usb]
>  kasan_report+0xe/0x20
>  rsi_rx_done_handler+0x354/0x430 [rsi_usb]
>  __usb_hcd_giveback_urb+0x1e4/0x380
>  usb_giveback_urb_bh+0x241/0x4f0
>  ? __usb_hcd_giveback_urb+0x380/0x380
>  ? apic_timer_interrupt+0xa/0x20
>  tasklet_action_common.isra.0+0x135/0x330
>  __do_softirq+0x18c/0x634
>  ? handle_irq_event+0xcd/0x157
>  ? handle_edge_irq+0x1eb/0x7b0
>  irq_exit+0x114/0x140
>  do_IRQ+0x91/0x1e0
>  common_interrupt+0xf/0xf
>  </IRQ>
> 
> Reported-by: Brendan Dolan-Gavitt <brendandg@....edu>
> Signed-off-by: Zekun Shen <bruceshenzk@...il.com>

Patch applied to wireless-drivers-next.git, thanks.

b07e3c6ebc0c rsi: Fix use-after-free in rsi_rx_done_handler()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/YXxQL/vIiYcZUu/j@10-18-43-117.dynapool.wireless.nyu.edu/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches