* [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-18 2:45 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:45 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: stable, Macpaul Lin, Eddie Hung, Macpaul Lin, Mediatek WSD Upstream
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 9dc06a4e1b30..21110b2865b9 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.18.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-18 2:45 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:45 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: stable, Macpaul Lin, Eddie Hung, Macpaul Lin, Mediatek WSD Upstream
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 9dc06a4e1b30..21110b2865b9 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.18.0
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` Macpaul Lin
(?)
@ 2020-07-18 2:58 ` Macpaul Lin
-1 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:58 UTC (permalink / raw)
To: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Greg Kroah-Hartman, Felipe Balbi, Matthias Brugger, Eddie Hung,
stable, Mediatek WSD Upstream, Macpaul Lin
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
Well, it's strange, I simply replaced the uploader's name to my
colleague, git send-email pop up this line automatically.
Shouldn't I do that kind of change. It did not happened before.
Do I need to change it back and update patch v3?
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
Thanks.
Macpaul Lin
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-18 2:58 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:58 UTC (permalink / raw)
To: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Felipe Balbi, Mediatek WSD Upstream, Greg Kroah-Hartman,
Eddie Hung, stable, Matthias Brugger, Macpaul Lin
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
Well, it's strange, I simply replaced the uploader's name to my
colleague, git send-email pop up this line automatically.
Shouldn't I do that kind of change. It did not happened before.
Do I need to change it back and update patch v3?
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
Thanks.
Macpaul Lin
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-18 2:58 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:58 UTC (permalink / raw)
To: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Felipe Balbi, Mediatek WSD Upstream, Greg Kroah-Hartman,
Eddie Hung, stable, Matthias Brugger, Macpaul Lin
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
Well, it's strange, I simply replaced the uploader's name to my
colleague, git send-email pop up this line automatically.
Shouldn't I do that kind of change. It did not happened before.
Do I need to change it back and update patch v3?
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
Thanks.
Macpaul Lin
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:58 ` Macpaul Lin
(?)
@ 2020-07-21 11:33 ` Greg Kroah-Hartman
-1 siblings, 0 replies; 30+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-21 11:33 UTC (permalink / raw)
To: Macpaul Lin
Cc: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek,
Felipe Balbi, Matthias Brugger, Eddie Hung, stable,
Mediatek WSD Upstream, Macpaul Lin
On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > From: Eddie Hung <eddie.hung@mediatek.com>
> >
>
> Well, it's strange, I simply replaced the uploader's name to my
> colleague, git send-email pop up this line automatically.
>
> Shouldn't I do that kind of change. It did not happened before.
> Do I need to change it back and update patch v3?
Who is the real author of this, Eddie or you? If Eddie, this is
correct, if you, it is not.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-21 11:33 ` Greg Kroah-Hartman
0 siblings, 0 replies; 30+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-21 11:33 UTC (permalink / raw)
To: Macpaul Lin
Cc: Felipe Balbi, Eddie Hung, Mediatek WSD Upstream, linux-usb,
linux-kernel, stable, linux-mediatek, Matthias Brugger,
Macpaul Lin, linux-arm-kernel
On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > From: Eddie Hung <eddie.hung@mediatek.com>
> >
>
> Well, it's strange, I simply replaced the uploader's name to my
> colleague, git send-email pop up this line automatically.
>
> Shouldn't I do that kind of change. It did not happened before.
> Do I need to change it back and update patch v3?
Who is the real author of this, Eddie or you? If Eddie, this is
correct, if you, it is not.
thanks,
greg k-h
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-21 11:33 ` Greg Kroah-Hartman
0 siblings, 0 replies; 30+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-21 11:33 UTC (permalink / raw)
To: Macpaul Lin
Cc: Felipe Balbi, Eddie Hung, Mediatek WSD Upstream, linux-usb,
linux-kernel, stable, linux-mediatek, Matthias Brugger,
Macpaul Lin, linux-arm-kernel
On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > From: Eddie Hung <eddie.hung@mediatek.com>
> >
>
> Well, it's strange, I simply replaced the uploader's name to my
> colleague, git send-email pop up this line automatically.
>
> Shouldn't I do that kind of change. It did not happened before.
> Do I need to change it back and update patch v3?
Who is the real author of this, Eddie or you? If Eddie, this is
correct, if you, it is not.
thanks,
greg k-h
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-21 11:33 ` Greg Kroah-Hartman
(?)
@ 2020-07-22 1:59 ` Macpaul Lin
-1 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-22 1:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek,
Felipe Balbi, Matthias Brugger, Eddie Hung, stable,
Mediatek WSD Upstream, Macpaul Lin
On Tue, 2020-07-21 at 13:33 +0200, Greg Kroah-Hartman wrote:
> On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > > From: Eddie Hung <eddie.hung@mediatek.com>
> > >
> >
> > Well, it's strange, I simply replaced the uploader's name to my
> > colleague, git send-email pop up this line automatically.
> >
> > Shouldn't I do that kind of change. It did not happened before.
> > Do I need to change it back and update patch v3?
>
> Who is the real author of this, Eddie or you? If Eddie, this is
> correct, if you, it is not.
>
> thanks,
>
> greg k-h
It is Eddie! I just changed the uploader to the correct author from my
working tree!
Thanks!
Regards,
Macpaul Lin
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-22 1:59 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-22 1:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Felipe Balbi, Eddie Hung, Mediatek WSD Upstream, linux-usb,
linux-kernel, stable, linux-mediatek, Matthias Brugger,
Macpaul Lin, linux-arm-kernel
On Tue, 2020-07-21 at 13:33 +0200, Greg Kroah-Hartman wrote:
> On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > > From: Eddie Hung <eddie.hung@mediatek.com>
> > >
> >
> > Well, it's strange, I simply replaced the uploader's name to my
> > colleague, git send-email pop up this line automatically.
> >
> > Shouldn't I do that kind of change. It did not happened before.
> > Do I need to change it back and update patch v3?
>
> Who is the real author of this, Eddie or you? If Eddie, this is
> correct, if you, it is not.
>
> thanks,
>
> greg k-h
It is Eddie! I just changed the uploader to the correct author from my
working tree!
Thanks!
Regards,
Macpaul Lin
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-22 1:59 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-07-22 1:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Felipe Balbi, Eddie Hung, Mediatek WSD Upstream, linux-usb,
linux-kernel, stable, linux-mediatek, Matthias Brugger,
Macpaul Lin, linux-arm-kernel
On Tue, 2020-07-21 at 13:33 +0200, Greg Kroah-Hartman wrote:
> On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > > From: Eddie Hung <eddie.hung@mediatek.com>
> > >
> >
> > Well, it's strange, I simply replaced the uploader's name to my
> > colleague, git send-email pop up this line automatically.
> >
> > Shouldn't I do that kind of change. It did not happened before.
> > Do I need to change it back and update patch v3?
>
> Who is the real author of this, Eddie or you? If Eddie, this is
> correct, if you, it is not.
>
> thanks,
>
> greg k-h
It is Eddie! I just changed the uploader to the correct author from my
working tree!
Thanks!
Regards,
Macpaul Lin
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` Macpaul Lin
(?)
@ 2020-10-20 6:36 ` Macpaul Lin
-1 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-10-20 6:36 UTC (permalink / raw)
To: Felipe Balbi
Cc: Greg Kroah-Hartman, Matthias Brugger, linux-usb, linux-kernel,
linux-arm-kernel, linux-mediatek, wsd_upstream, Macpaul Lin,
Eddie Hung (洪正鑫),
stable
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 9dc06a4e1b30..21110b2865b9 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(&gi->lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(&gi->lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Just want to remind we have a fix here for usb/gadget/configfs.c.
If the patch need to be further revised, please let us know.
Thanks!
Macpaul Lin
^ permalink raw reply [flat|nested] 30+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-10-20 6:36 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-10-20 6:36 UTC (permalink / raw)
To: Felipe Balbi
Cc: Eddie Hung (洪正鑫),
wsd_upstream, Greg Kroah-Hartman, linux-usb, linux-kernel,
stable, linux-mediatek, Matthias Brugger, Macpaul Lin,
linux-arm-kernel
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 9dc06a4e1b30..21110b2865b9 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(&gi->lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(&gi->lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Just want to remind we have a fix here for usb/gadget/configfs.c.
If the patch need to be further revised, please let us know.
Thanks!
Macpaul Lin
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 30+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-10-20 6:36 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-10-20 6:36 UTC (permalink / raw)
To: Felipe Balbi
Cc: Eddie Hung (洪正鑫),
wsd_upstream, Greg Kroah-Hartman, linux-usb, linux-kernel,
stable, linux-mediatek, Matthias Brugger, Macpaul Lin,
linux-arm-kernel
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 9dc06a4e1b30..21110b2865b9 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(&gi->lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(&gi->lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Just want to remind we have a fix here for usb/gadget/configfs.c.
If the patch need to be further revised, please let us know.
Thanks!
Macpaul Lin
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` Macpaul Lin
(?)
@ 2020-10-27 9:23 ` Felipe Balbi
-1 siblings, 0 replies; 30+ messages in thread
From: Felipe Balbi @ 2020-10-27 9:23 UTC (permalink / raw)
To: Macpaul Lin, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Mediatek WSD Upstream, Macpaul Lin, Macpaul Lin, Eddie Hung, stable
[-- Attachment #1: Type: text/plain, Size: 1402 bytes --]
Hi,
Macpaul Lin <macpaul.lin@mediatek.com> writes:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
patch doesn't apply:
$ patch -p1 --dry-run
/usr/bin/patch: **** Only garbage was found in the patch input.
Please resend using git send-email and make sure your smtp server sends
it as plain text, not base64.
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-10-27 9:23 ` Felipe Balbi
0 siblings, 0 replies; 30+ messages in thread
From: Felipe Balbi @ 2020-10-27 9:23 UTC (permalink / raw)
To: Macpaul Lin, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: stable, Macpaul Lin, Eddie Hung, Macpaul Lin, Mediatek WSD Upstream
[-- Attachment #1.1: Type: text/plain, Size: 1402 bytes --]
Hi,
Macpaul Lin <macpaul.lin@mediatek.com> writes:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
patch doesn't apply:
$ patch -p1 --dry-run
/usr/bin/patch: **** Only garbage was found in the patch input.
Please resend using git send-email and make sure your smtp server sends
it as plain text, not base64.
--
balbi
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]
[-- Attachment #2: Type: text/plain, Size: 176 bytes --]
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-10-27 9:23 ` Felipe Balbi
0 siblings, 0 replies; 30+ messages in thread
From: Felipe Balbi @ 2020-10-27 9:23 UTC (permalink / raw)
To: Macpaul Lin, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: stable, Macpaul Lin, Eddie Hung, Macpaul Lin, Mediatek WSD Upstream
[-- Attachment #1.1: Type: text/plain, Size: 1402 bytes --]
Hi,
Macpaul Lin <macpaul.lin@mediatek.com> writes:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
patch doesn't apply:
$ patch -p1 --dry-run
/usr/bin/patch: **** Only garbage was found in the patch input.
Please resend using git send-email and make sure your smtp server sends
it as plain text, not base64.
--
balbi
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]
[-- Attachment #2: Type: text/plain, Size: 170 bytes --]
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 30+ messages in thread
* [RESEND PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` Macpaul Lin
(?)
@ 2020-11-01 5:37 ` Macpaul Lin
-1 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-11-01 5:37 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Eddie Hung, Peter Chen, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index cbff3b02840d..8501b27f3c95 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -230,9 +230,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.26.2
^ permalink raw reply related [flat|nested] 30+ messages in thread* [RESEND PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-11-01 5:37 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-11-01 5:37 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Peter Chen, Eddie Hung, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index cbff3b02840d..8501b27f3c95 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -230,9 +230,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.26.2
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 30+ messages in thread* [RESEND PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-11-01 5:37 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-11-01 5:37 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Peter Chen, Eddie Hung, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index cbff3b02840d..8501b27f3c95 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -230,9 +230,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.26.2
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [PATCH RESEND v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` Macpaul Lin
(?)
@ 2020-12-29 10:53 ` Macpaul Lin
-1 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-12-29 10:53 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Ainge Hsu, Eddie Hung, Chunfeng Yun, Macpaul Lin, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH RESEND v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-12-29 10:53 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-12-29 10:53 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Chunfeng Yun, Eddie Hung, Ainge Hsu, stable, Macpaul Lin
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH RESEND v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-12-29 10:53 ` Macpaul Lin
0 siblings, 0 replies; 30+ messages in thread
From: Macpaul Lin @ 2020-12-29 10:53 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Chunfeng Yun, Eddie Hung, Ainge Hsu, stable, Macpaul Lin
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply related [flat|nested] 30+ messages in thread