linux-kernel - Re: [PATCH] usb: raw_gadget: Add debug logs to a troubleshoot a double-free bug in raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+fCnZeThG-J7kCraPbr4NCpys=jne3dD4sOLT_0h6iPw2YZEw@mail.gmail.com>
Date: Wed, 6 Nov 2024 13:35:27 +0900
From: Andrey Konovalov <andreyknvl@...il.com>
To: Chang Yu <marcus.yu.56@...il.com>
Cc: gregkh@...uxfoundation.org, viro@...iv.linux.org.uk, 
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, 
	stern@...land.harvard.edu, skhan@...uxfoundation.org, 
	syzbot+3e563d99e70973c0755c@...kaller.appspotmail.com
Subject: Re: [PATCH] usb: raw_gadget: Add debug logs to a troubleshoot a
 double-free bug in raw_release.

On Wed, Nov 6, 2024 at 1:11 PM Chang Yu <marcus.yu.56@...il.com> wrote:
>
> syzkaller reported a double free bug
> (https://syzkaller.appspot.com/bug?extid=3e563d99e70973c0755c) in
> raw_release.
>
> From the stack traces it looks like either raw_release was invoked
> twice or there were some between kref_get in raw_ioctl_run and
> kref_put raw_release. But these should not be possible. We need
> more logs to understand the cause.
>
> Make raw_release and raw_ioctl_run report the ref count before
> and after get/put to help debug this.
>
> Signed-off-by: Chang Yu <marcus.yu.56@...il.com>
> Reported-by: syzbot+3e563d99e70973c0755c@...kaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=3e563d99e70973c0755c
> ---
>  drivers/usb/gadget/legacy/raw_gadget.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>
> diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
> index 112fd18d8c99..ac4e319c743f 100644
> --- a/drivers/usb/gadget/legacy/raw_gadget.c
> +++ b/drivers/usb/gadget/legacy/raw_gadget.c
> @@ -194,6 +194,8 @@ static struct raw_dev *dev_new(void)
>                 return NULL;
>         /* Matches kref_put() in raw_release(). */
>         kref_init(&dev->count);
> +       dev_dbg(dev->dev, "%s kref count initialized: %d\n",
> +               __func__, kref_read(&dev->count));
>         spin_lock_init(&dev->lock);
>         init_completion(&dev->ep0_done);
>         raw_event_queue_init(&dev->queue);
> @@ -464,13 +466,21 @@ static int raw_release(struct inode *inode, struct file *fd)
>                         dev_err(dev->dev,
>                                 "usb_gadget_unregister_driver() failed with %d\n",
>                                 ret);
> +               dev_dbg(dev->dev, "%s kref count before unregister driver put: %d\n",
> +                               __func__, kref_read(&dev->count));
>                 /* Matches kref_get() in raw_ioctl_run(). */
>                 kref_put(&dev->count, dev_free);
> +               dev_dbg(dev->dev, "%s kref count after unregister driver put: %d\n",
> +                               __func__, kref_read(&dev->count));
>         }
>
>  out_put:
> +       dev_dbg(dev->dev, "%s kref count before final put: %d\n",
> +                       __func__, kref_read(&dev->count));
>         /* Matches dev_new() in raw_open(). */
>         kref_put(&dev->count, dev_free);
> +       dev_dbg(dev->dev, "%s kref count after final put: %d\n",
> +                       __func__, kref_read(&dev->count));
>         return ret;
>  }
>
> @@ -603,8 +613,12 @@ static int raw_ioctl_run(struct raw_dev *dev, unsigned long value)
>         }
>         dev->gadget_registered = true;
>         dev->state = STATE_DEV_RUNNING;
> +       dev_dbg(dev->dev, "%s kref count before get: %d\n",
> +                       __func__, kref_read(&dev->count));
>         /* Matches kref_put() in raw_release(). */
>         kref_get(&dev->count);
> +       dev_dbg(dev->dev, "%s kref count after get: %d\n",
> +                       __func__, kref_read(&dev->count));
>
>  out_unlock:
>         spin_unlock_irqrestore(&dev->lock, flags);
> --
> 2.47.0
>

Hi Chang,

This patch looks very specific to the bug we're trying to debug - I
don't think it makes sense to apply it to the mainline.

What you can do instead is ask syzbot to run the reproducer it has
with this patch applied via the #syz test command.

Thank you!