Linux-USB Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] usb: iowarrior: fix access to freed data structure
@ 2019-10-08 22:23 Valentin Vidic
  2019-10-09  7:36 ` Johan Hovold
  0 siblings, 1 reply; 2+ messages in thread
From: Valentin Vidic @ 2019-10-08 22:23 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Oliver Neukum, linux-usb, linux-kernel, Valentin Vidic,
	syzbot+0761012cebf7bdb38137

struct iowarrior gets freed prematurely in iowarrior_release while
it is still being referenced from usb_interface, so let only
iowarrior_disconnect call iowarrior_delete.

Fixes: KMSAN: uninit-value in iowarrior_disconnect
Reported-by: syzbot+0761012cebf7bdb38137@syzkaller.appspotmail.com
Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
---
 drivers/usb/misc/iowarrior.c | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index f5bed9f29e56..0492ea76c4bf 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -638,7 +638,6 @@ static int iowarrior_open(struct inode *inode, struct file *file)
 static int iowarrior_release(struct inode *inode, struct file *file)
 {
 	struct iowarrior *dev;
-	int retval = 0;
 
 	dev = file->private_data;
 	if (!dev)
@@ -650,27 +649,23 @@ static int iowarrior_release(struct inode *inode, struct file *file)
 	mutex_lock(&dev->mutex);
 
 	if (dev->opened <= 0) {
-		retval = -ENODEV;	/* close called more than once */
 		mutex_unlock(&dev->mutex);
-	} else {
-		dev->opened = 0;	/* we're closing now */
-		retval = 0;
-		if (dev->present) {
-			/*
-			   The device is still connected so we only shutdown
-			   pending read-/write-ops.
-			 */
-			usb_kill_urb(dev->int_in_urb);
-			wake_up_interruptible(&dev->read_wait);
-			wake_up_interruptible(&dev->write_wait);
-			mutex_unlock(&dev->mutex);
-		} else {
-			/* The device was unplugged, cleanup resources */
-			mutex_unlock(&dev->mutex);
-			iowarrior_delete(dev);
-		}
+		return -ENODEV;	/* close called more than once */
 	}
-	return retval;
+
+	dev->opened = 0;	/* we're closing now */
+	if (dev->present) {
+		/*
+		 * The device is still connected so we only shutdown
+		 * pending read/write ops.
+		 */
+		usb_kill_urb(dev->int_in_urb);
+		wake_up_interruptible(&dev->read_wait);
+		wake_up_interruptible(&dev->write_wait);
+	}
+
+	mutex_unlock(&dev->mutex);
+	return 0;
 }
 
 static __poll_t iowarrior_poll(struct file *file, poll_table * wait)
-- 
2.20.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] usb: iowarrior: fix access to freed data structure
  2019-10-08 22:23 [PATCH] usb: iowarrior: fix access to freed data structure Valentin Vidic
@ 2019-10-09  7:36 ` Johan Hovold
  0 siblings, 0 replies; 2+ messages in thread
From: Johan Hovold @ 2019-10-09  7:36 UTC (permalink / raw)
  To: Valentin Vidic
  Cc: Greg Kroah-Hartman, Oliver Neukum, linux-usb, linux-kernel,
	syzbot+0761012cebf7bdb38137

On Wed, Oct 09, 2019 at 12:23:07AM +0200, Valentin Vidic wrote:
> struct iowarrior gets freed prematurely in iowarrior_release while
> it is still being referenced from usb_interface, so let only
> iowarrior_disconnect call iowarrior_delete.

The proposed fix is broken since release() may happen long after
disconnect(), in which case you'd now leak memory.

> Fixes: KMSAN: uninit-value in iowarrior_disconnect

Fixes tags are supposed to refer to the commit introducing the issue.

> Reported-by: syzbot+0761012cebf7bdb38137@syzkaller.appspotmail.com
> Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
> ---
>  drivers/usb/misc/iowarrior.c | 35 +++++++++++++++--------------------
>  1 file changed, 15 insertions(+), 20 deletions(-)
> 
> diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
> index f5bed9f29e56..0492ea76c4bf 100644
> --- a/drivers/usb/misc/iowarrior.c
> +++ b/drivers/usb/misc/iowarrior.c
> @@ -638,7 +638,6 @@ static int iowarrior_open(struct inode *inode, struct file *file)
>  static int iowarrior_release(struct inode *inode, struct file *file)
>  {
>  	struct iowarrior *dev;
> -	int retval = 0;
>  
>  	dev = file->private_data;
>  	if (!dev)
> @@ -650,27 +649,23 @@ static int iowarrior_release(struct inode *inode, struct file *file)
>  	mutex_lock(&dev->mutex);
>  
>  	if (dev->opened <= 0) {
> -		retval = -ENODEV;	/* close called more than once */
>  		mutex_unlock(&dev->mutex);
> -	} else {
> -		dev->opened = 0;	/* we're closing now */
> -		retval = 0;
> -		if (dev->present) {
> -			/*
> -			   The device is still connected so we only shutdown
> -			   pending read-/write-ops.
> -			 */
> -			usb_kill_urb(dev->int_in_urb);
> -			wake_up_interruptible(&dev->read_wait);
> -			wake_up_interruptible(&dev->write_wait);
> -			mutex_unlock(&dev->mutex);
> -		} else {
> -			/* The device was unplugged, cleanup resources */
> -			mutex_unlock(&dev->mutex);
> -			iowarrior_delete(dev);

So you cannot just remove this bit.

> -		}
> +		return -ENODEV;	/* close called more than once */
>  	}
> -	return retval;
> +
> +	dev->opened = 0;	/* we're closing now */
> +	if (dev->present) {
> +		/*
> +		 * The device is still connected so we only shutdown
> +		 * pending read/write ops.
> +		 */
> +		usb_kill_urb(dev->int_in_urb);
> +		wake_up_interruptible(&dev->read_wait);
> +		wake_up_interruptible(&dev->write_wait);
> +	}
> +
> +	mutex_unlock(&dev->mutex);
> +	return 0;
>  }
>  
>  static __poll_t iowarrior_poll(struct file *file, poll_table * wait)

Johan

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-08 22:23 [PATCH] usb: iowarrior: fix access to freed data structure Valentin Vidic
2019-10-09  7:36 ` Johan Hovold

Linux-USB Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-usb/0 linux-usb/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-usb linux-usb/ https://lore.kernel.org/linux-usb \
		linux-usb@vger.kernel.org
	public-inbox-index linux-usb

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-usb


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git