linux-kernel - Re: typec_altmode_release → refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 29 Jan 2024 22:57:04 +0100
From: "Christian A. Ehrhardt" <lk@...e.de>
To: Paul Menzel <pmenzel@...gen.mpg.de>
Cc: Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: typec_altmode_release → refcount_t: underflow; use-after-free.


Hi Paul,

On Mon, Jan 29, 2024 at 10:27:44PM +0100, Paul Menzel wrote:
> Dear Christian,
> 
> 
> Am 29.01.24 um 20:06 schrieb Christian A. Ehrhardt:
> 
> > On Mon, Jan 29, 2024 at 12:57:11PM +0100, Paul Menzel wrote:
> 
> > > I noticed the message first time with Linux 6.6.8 on December 26th, and also
> > > with 6.6.11, 6.7 and 6.7.1. I am unsure how to reproduce it though.
> > > 
> > > Here the trace from Linux 6.7.1-1~exp1:
> > > 
> > > ```
> > > [    0.000000] Linux version 6.7-amd64 (debian-kernel@...ts.debian.org) (x86_64-linux-gnu-gcc-13 (Debian 13.2.0-10) 13.2.0, GNU ld (GNU Binutils for Debian) 2.41.90.20240115) #1 SMP PREEMPT_DYNAMIC Debian 6.7.1-1~exp1 (2024-01-22)
> > > […]
> > > [    0.000000] DMI: Dell Inc. XPS 13 9360/0596KF, BIOS 2.21.0 06/02/2022
> > > […]
> > > [ 9068.294345] ucsi_acpi USBC000:00: failed to re-enable notifications (-110)
> > > [ 9068.499156] ------------[ cut here ]------------
> > > [ 9068.499172] refcount_t: underflow; use-after-free.
> > > [ 9068.499199] WARNING: CPU: 0 PID: 5598 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
> 
> […]
> > > [ 9068.499517] Call Trace:
> > > [ 9068.499521]  <TASK>
> > > [ 9068.499522]  ? refcount_warn_saturate+0xbe/0x110
> > > [ 9068.499526]  ? __warn+0x81/0x130
> > > [ 9068.499533]  ? refcount_warn_saturate+0xbe/0x110
> > > [ 9068.499545]  ? report_bug+0x171/0x1a0
> > > [ 9068.499549]  ? console_unlock+0x78/0x120
> > > [ 9068.499553]  ? handle_bug+0x3c/0x80
> > > [ 9068.499557]  ? exc_invalid_op+0x17/0x70
> > > [ 9068.499565]  ? asm_exc_invalid_op+0x1a/0x20
> > > [ 9068.499570]  ? refcount_warn_saturate+0xbe/0x110
> > > [ 9068.499576]  typec_altmode_release+0x49/0xc0 [typec]
> > > [ 9068.499615]  device_release+0x34/0x90
> > > [ 9068.499624]  kobject_put+0x78/0x190
> > > [ 9068.499629]  ucsi_unregister_altmodes+0x41/0xa0 [typec_ucsi]
> > > [ 9068.499648]  ucsi_unregister_partner.part.0+0x77/0xa0 [typec_ucsi]
> > > [ 9068.499662]  ucsi_handle_connector_change+0x1bb/0x310 [typec_ucsi]
> > > [ 9068.499671]  process_one_work+0x171/0x340
> > > [ 9068.499676]  worker_thread+0x27b/0x3a0
> > > [ 9068.499679]  ? __pfx_worker_thread+0x10/0x10
> > > [ 9068.499681]  kthread+0xe5/0x120
> > > [ 9068.499690]  ? __pfx_kthread+0x10/0x10
> > > [ 9068.499693]  ret_from_fork+0x31/0x50
> > > [ 9068.499698]  ? __pfx_kthread+0x10/0x10
> > > [ 9068.499700]  ret_from_fork_asm+0x1b/0x30
> > > [ 9068.499714]  </TASK>
> > > [ 9068.499715] ---[ end trace 0000000000000000 ]---
> > > ```
> > > 
> > > Please find the full output of `dmesg` attached.
> > 
> > This should be fixed by
> > 
> > | commit 5962ded777d689cd8bf04454273e32228d7fb71f
> > | Author: RD Babiera <rdbabiera@...gle.com>
> > | Date:   Wed Jan 3 18:17:55 2024 +0000
> > |
> > |     usb: typec: class: fix typec_altmode_put_partner to put plugs
> > 
> > which is in mainline and 6.7.2.
> 
> Awesome. Thank you for mentioning this, and nice timing, as the commit
> referenced in the Fixed-by tag is from v4.19-rc1 from August 2018. ;-)

A first attempt to fix that 2018 commit made it into 6.7 and caused
the regression and the warning (b17b7fe6dd5c). This commit was then
reverted (9c6b789e954f). The final fix (5962ded777d6) is a new
version of the reverted fix that does not cause regressions.

The Fixes: tag for the revert does point into the post 6.7 range.

    regards  Christian