linux-kernel - Re: typec_altmode_release → refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b1f77ee7-0684-4260-bcaf-d826af19978d@molgen.mpg.de>
Date: Mon, 29 Jan 2024 22:27:44 +0100
From: Paul Menzel <pmenzel@...gen.mpg.de>
To: "Christian A. Ehrhardt" <lk@...e.de>
Cc: Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
 linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: typec_altmode_release → refcount_t: underflow; use-after-free.

Dear Christian,


Am 29.01.24 um 20:06 schrieb Christian A. Ehrhardt:

> On Mon, Jan 29, 2024 at 12:57:11PM +0100, Paul Menzel wrote:

>> I noticed the message first time with Linux 6.6.8 on December 26th, and also
>> with 6.6.11, 6.7 and 6.7.1. I am unsure how to reproduce it though.
>>
>> Here the trace from Linux 6.7.1-1~exp1:
>>
>> ```
>> [    0.000000] Linux version 6.7-amd64 (debian-kernel@...ts.debian.org) (x86_64-linux-gnu-gcc-13 (Debian 13.2.0-10) 13.2.0, GNU ld (GNU Binutils for Debian) 2.41.90.20240115) #1 SMP PREEMPT_DYNAMIC Debian 6.7.1-1~exp1 (2024-01-22)
>> […]
>> [    0.000000] DMI: Dell Inc. XPS 13 9360/0596KF, BIOS 2.21.0 06/02/2022
>> […]
>> [ 9068.294345] ucsi_acpi USBC000:00: failed to re-enable notifications (-110)
>> [ 9068.499156] ------------[ cut here ]------------
>> [ 9068.499172] refcount_t: underflow; use-after-free.
>> [ 9068.499199] WARNING: CPU: 0 PID: 5598 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110

[…]
>> [ 9068.499517] Call Trace:
>> [ 9068.499521]  <TASK>
>> [ 9068.499522]  ? refcount_warn_saturate+0xbe/0x110
>> [ 9068.499526]  ? __warn+0x81/0x130
>> [ 9068.499533]  ? refcount_warn_saturate+0xbe/0x110
>> [ 9068.499545]  ? report_bug+0x171/0x1a0
>> [ 9068.499549]  ? console_unlock+0x78/0x120
>> [ 9068.499553]  ? handle_bug+0x3c/0x80
>> [ 9068.499557]  ? exc_invalid_op+0x17/0x70
>> [ 9068.499565]  ? asm_exc_invalid_op+0x1a/0x20
>> [ 9068.499570]  ? refcount_warn_saturate+0xbe/0x110
>> [ 9068.499576]  typec_altmode_release+0x49/0xc0 [typec]
>> [ 9068.499615]  device_release+0x34/0x90
>> [ 9068.499624]  kobject_put+0x78/0x190
>> [ 9068.499629]  ucsi_unregister_altmodes+0x41/0xa0 [typec_ucsi]
>> [ 9068.499648]  ucsi_unregister_partner.part.0+0x77/0xa0 [typec_ucsi]
>> [ 9068.499662]  ucsi_handle_connector_change+0x1bb/0x310 [typec_ucsi]
>> [ 9068.499671]  process_one_work+0x171/0x340
>> [ 9068.499676]  worker_thread+0x27b/0x3a0
>> [ 9068.499679]  ? __pfx_worker_thread+0x10/0x10
>> [ 9068.499681]  kthread+0xe5/0x120
>> [ 9068.499690]  ? __pfx_kthread+0x10/0x10
>> [ 9068.499693]  ret_from_fork+0x31/0x50
>> [ 9068.499698]  ? __pfx_kthread+0x10/0x10
>> [ 9068.499700]  ret_from_fork_asm+0x1b/0x30
>> [ 9068.499714]  </TASK>
>> [ 9068.499715] ---[ end trace 0000000000000000 ]---
>> ```
>>
>> Please find the full output of `dmesg` attached.
> 
> This should be fixed by
> 
> | commit 5962ded777d689cd8bf04454273e32228d7fb71f
> | Author: RD Babiera <rdbabiera@...gle.com>
> | Date:   Wed Jan 3 18:17:55 2024 +0000
> |
> |     usb: typec: class: fix typec_altmode_put_partner to put plugs
> 
> which is in mainline and 6.7.2.

Awesome. Thank you for mentioning this, and nice timing, as the commit 
referenced in the Fixed-by tag is from v4.19-rc1 from August 2018. ;-)


Kind regards,

Paul