linux-kernel - [PATCH] media: usb: hackrf: fix device unregister order in hackrf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250127173112.446048-1-n.zhandarovich@fintech.ru>
Date: Mon, 27 Jan 2025 09:31:12 -0800
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Mauro Carvalho Chehab <mchehab@...nel.org>, Hans Verkuil
	<hverkuil@...all.nl>
CC: Nikita Zhandarovich <n.zhandarovich@...tech.ru>,
	<linux-media@...r.kernel.org>,
	<syzbot+6b52c2b24e341804a58c@...kaller.appspotmail.com>,
	<syzkaller-bugs@...glegroups.com>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>
Subject: [PATCH] media: usb: hackrf: fix device unregister order in hackrf_probe()

Syzkaller reports [1] a slab-use-after-free error identified by KASAN
sanitizer and most likely caused by the wrong order of device
unregister steps once a call to video_register_device() fails.

Fix aforementioned flaw by first freeing control and reference handlers and
only then dealing with dev->v4l2_dev() via v4l2_device_unregister().

[1] Syzkaller (partial) report:
BUG: KASAN: slab-use-after-free in v4l2_release+0x3e2/0x460 drivers/media/v4l2-core/v4l2-dev.c:453
Read of size 8 at addr ffff8880502e80c8 by task v4l_id/7854

CPU: 1 UID: 0 PID: 7854 Comm: v4l_id Not tainted 6.12.0-rc7-syzkaller-00125-gcfaaa7d010d1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 v4l2_release+0x3e2/0x460 drivers/media/v4l2-core/v4l2-dev.c:453
 __fput+0x3f6/0xb60 fs/file_table.c:431
 __fput_sync+0x45/0x50 fs/file_table.c:516
 __do_sys_close fs/open.c:1567 [inline]
 __se_sys_close fs/open.c:1552 [inline]
 __x64_sys_close+0x86/0x100 fs/open.c:1552
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...

Allocated by task 6058:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:878 [inline]
 kzalloc_noprof include/linux/slab.h:1014 [inline]
 hackrf_probe+0xd1/0x1cf0 drivers/media/usb/hackrf/hackrf.c:1353
 usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399
...

Freed by task 6058:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:2342 [inline]
 slab_free mm/slub.c:4579 [inline]
 kfree+0x14f/0x4b0 mm/slub.c:4727
 hackrf_probe+0x4c9/0x1cf0 drivers/media/usb/hackrf/hackrf.c:1525
 usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399
...

Reported-and-tested-by: syzbot+6b52c2b24e341804a58c@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6b52c2b24e341804a58c
Fixes: 8bc4a9ed8504 ("[media] hackrf: add support for transmitter")
Cc: stable@...r.kernel.org
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
---
P.S. since my setup failed to reliably test both the repro and the
patch locally, I had to rely exclusively on syzbot capabilities. At
the moment this patch is being sent, syzkaller seems to be acting
out though...

 drivers/media/usb/hackrf/hackrf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index 0b50de8775a3..bc910b35f605 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -1513,12 +1513,12 @@ static int hackrf_probe(struct usb_interface *intf,
 	return 0;
 err_video_unregister_device_rx:
 	video_unregister_device(&dev->rx_vdev);
-err_v4l2_device_unregister:
-	v4l2_device_unregister(&dev->v4l2_dev);
 err_v4l2_ctrl_handler_free_tx:
 	v4l2_ctrl_handler_free(&dev->tx_ctrl_handler);
 err_v4l2_ctrl_handler_free_rx:
 	v4l2_ctrl_handler_free(&dev->rx_ctrl_handler);
+err_v4l2_device_unregister:
+	v4l2_device_unregister(&dev->v4l2_dev);
 err_kfree:
 	kfree(dev);
 err: