* [PATCH] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-07-16 6:41 Macpaul Lin
2020-07-17 4:14 ` Peter Chen
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
0 siblings, 2 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-07-16 6:41 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Mediatek WSD Upstream, Macpaul Lin, Macpaul Lin, Eddie Hung, stable
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Contex 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Contex 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Cc: stable@vger.kernel.org
---
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 9dc06a4e1b30..21110b2865b9 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.18.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [PATCH] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-16 6:41 [PATCH] usb: gadget: configfs: Fix use-after-free issue with udc_name Macpaul Lin
@ 2020-07-17 4:14 ` Peter Chen
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
1 sibling, 0 replies; 12+ messages in thread
From: Peter Chen @ 2020-07-17 4:14 UTC (permalink / raw)
To: Macpaul Lin
Cc: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin, Eddie Hung, stable
On 20-07-16 14:41:06, Macpaul Lin wrote:
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Contex 1:
%s/contex/context
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Contex 2:
The same, otherwise:
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Peter
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Cc: stable@vger.kernel.org
> ---
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 9dc06a4e1b30..21110b2865b9 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(&gi->lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(&gi->lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
> --
> 2.18.0
--
Thanks,
Peter Chen
^ permalink raw reply [flat|nested] 12+ messages in thread* [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-16 6:41 [PATCH] usb: gadget: configfs: Fix use-after-free issue with udc_name Macpaul Lin
2020-07-17 4:14 ` Peter Chen
@ 2020-07-18 2:45 ` Macpaul Lin
2020-07-18 2:58 ` Macpaul Lin
` (4 more replies)
1 sibling, 5 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:45 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Mediatek WSD Upstream, Macpaul Lin, Macpaul Lin, Eddie Hung, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 9dc06a4e1b30..21110b2865b9 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.18.0
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
@ 2020-07-18 2:58 ` Macpaul Lin
2020-07-21 11:33 ` Greg Kroah-Hartman
2020-10-20 6:36 ` Macpaul Lin
` (3 subsequent siblings)
4 siblings, 1 reply; 12+ messages in thread
From: Macpaul Lin @ 2020-07-18 2:58 UTC (permalink / raw)
To: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Greg Kroah-Hartman, Felipe Balbi, Matthias Brugger, Eddie Hung,
stable, Mediatek WSD Upstream, Macpaul Lin
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
Well, it's strange, I simply replaced the uploader's name to my
colleague, git send-email pop up this line automatically.
Shouldn't I do that kind of change. It did not happened before.
Do I need to change it back and update patch v3?
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
Thanks.
Macpaul Lin
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:58 ` Macpaul Lin
@ 2020-07-21 11:33 ` Greg Kroah-Hartman
2020-07-22 1:59 ` Macpaul Lin
0 siblings, 1 reply; 12+ messages in thread
From: Greg Kroah-Hartman @ 2020-07-21 11:33 UTC (permalink / raw)
To: Macpaul Lin
Cc: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek,
Felipe Balbi, Matthias Brugger, Eddie Hung, stable,
Mediatek WSD Upstream, Macpaul Lin
On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > From: Eddie Hung <eddie.hung@mediatek.com>
> >
>
> Well, it's strange, I simply replaced the uploader's name to my
> colleague, git send-email pop up this line automatically.
>
> Shouldn't I do that kind of change. It did not happened before.
> Do I need to change it back and update patch v3?
Who is the real author of this, Eddie or you? If Eddie, this is
correct, if you, it is not.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-21 11:33 ` Greg Kroah-Hartman
@ 2020-07-22 1:59 ` Macpaul Lin
0 siblings, 0 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-07-22 1:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-usb, linux-kernel, linux-arm-kernel, linux-mediatek,
Felipe Balbi, Matthias Brugger, Eddie Hung, stable,
Mediatek WSD Upstream, Macpaul Lin
On Tue, 2020-07-21 at 13:33 +0200, Greg Kroah-Hartman wrote:
> On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote:
> > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> > > From: Eddie Hung <eddie.hung@mediatek.com>
> > >
> >
> > Well, it's strange, I simply replaced the uploader's name to my
> > colleague, git send-email pop up this line automatically.
> >
> > Shouldn't I do that kind of change. It did not happened before.
> > Do I need to change it back and update patch v3?
>
> Who is the real author of this, Eddie or you? If Eddie, this is
> correct, if you, it is not.
>
> thanks,
>
> greg k-h
It is Eddie! I just changed the uploader to the correct author from my
working tree!
Thanks!
Regards,
Macpaul Lin
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
2020-07-18 2:58 ` Macpaul Lin
@ 2020-10-20 6:36 ` Macpaul Lin
2020-10-27 9:23 ` Felipe Balbi
` (2 subsequent siblings)
4 siblings, 0 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-10-20 6:36 UTC (permalink / raw)
To: Felipe Balbi
Cc: Greg Kroah-Hartman, Matthias Brugger, linux-usb, linux-kernel,
linux-arm-kernel, linux-mediatek, wsd_upstream, Macpaul Lin,
Eddie Hung (洪正鑫),
stable
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 9dc06a4e1b30..21110b2865b9 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(&gi->lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(&gi->lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Just want to remind we have a fix here for usb/gadget/configfs.c.
If the patch need to be further revised, please let us know.
Thanks!
Macpaul Lin
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
2020-07-18 2:58 ` Macpaul Lin
2020-10-20 6:36 ` Macpaul Lin
@ 2020-10-27 9:23 ` Felipe Balbi
2020-11-01 5:37 ` [RESEND PATCH " Macpaul Lin
2020-12-29 10:53 ` [PATCH RESEND " Macpaul Lin
4 siblings, 0 replies; 12+ messages in thread
From: Felipe Balbi @ 2020-10-27 9:23 UTC (permalink / raw)
To: Macpaul Lin, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek
Cc: Mediatek WSD Upstream, Macpaul Lin, Macpaul Lin, Eddie Hung, stable
[-- Attachment #1: Type: text/plain, Size: 1402 bytes --]
Hi,
Macpaul Lin <macpaul.lin@mediatek.com> writes:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
patch doesn't apply:
$ patch -p1 --dry-run
/usr/bin/patch: **** Only garbage was found in the patch input.
Please resend using git send-email and make sure your smtp server sends
it as plain text, not base64.
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* [RESEND PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
` (2 preceding siblings ...)
2020-10-27 9:23 ` Felipe Balbi
@ 2020-11-01 5:37 ` Macpaul Lin
2020-12-29 10:53 ` [PATCH RESEND " Macpaul Lin
4 siblings, 0 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-11-01 5:37 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Eddie Hung, Peter Chen, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index cbff3b02840d..8501b27f3c95 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -230,9 +230,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.26.2
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH RESEND v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
` (3 preceding siblings ...)
2020-11-01 5:37 ` [RESEND PATCH " Macpaul Lin
@ 2020-12-29 10:53 ` Macpaul Lin
4 siblings, 0 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-12-29 10:53 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Matthias Brugger, linux-usb,
linux-kernel, linux-arm-kernel, linux-mediatek,
Mediatek WSD Upstream, Macpaul Lin
Cc: Ainge Hsu, Eddie Hung, Chunfeng Yun, Macpaul Lin, stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
@ 2020-10-28 17:55 Macpaul Lin
2020-10-28 17:59 ` Macpaul Lin
0 siblings, 1 reply; 12+ messages in thread
From: Macpaul Lin @ 2020-10-28 17:55 UTC (permalink / raw)
To: macpaul, chunfeng.yun, eddie.hung
Cc: Ainge Hsu, Mediatek WSD Upstream, Macpaul Lin, Macpaul Lin,
linux-kernel, linux-arm-kernel, linux-usb, linux-mediatek,
stable
From: Eddie Hung <eddie.hung@mediatek.com>
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(&gi->lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(&gi->lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
2020-10-28 17:55 [PATCH " Macpaul Lin
@ 2020-10-28 17:59 ` Macpaul Lin
0 siblings, 0 replies; 12+ messages in thread
From: Macpaul Lin @ 2020-10-28 17:59 UTC (permalink / raw)
To: macpaul
Cc: chunfeng.yun, eddie.hung, Ainge Hsu, Mediatek WSD Upstream,
Macpaul Lin, linux-kernel, linux-arm-kernel, linux-usb,
linux-mediatek, stable
On Thu, 2020-10-29 at 01:55 +0800, Macpaul Lin wrote:
> From: Eddie Hung <eddie.hung@mediatek.com>
>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
> Reviewed-by: Peter Chen <peter.chen@nxp.com>
> Cc: stable@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 56051bb..d9743f4 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(&gi->lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(&gi->lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Sorry, it looks like still a base64 encoded mail.
I'll feedback to our IT department again.
Please ignore this mail.
Thanks
Macpaul Lin
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2020-12-29 10:55 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-16 6:41 [PATCH] usb: gadget: configfs: Fix use-after-free issue with udc_name Macpaul Lin
2020-07-17 4:14 ` Peter Chen
2020-07-18 2:45 ` [PATCH v2] " Macpaul Lin
2020-07-18 2:58 ` Macpaul Lin
2020-07-21 11:33 ` Greg Kroah-Hartman
2020-07-22 1:59 ` Macpaul Lin
2020-10-20 6:36 ` Macpaul Lin
2020-10-27 9:23 ` Felipe Balbi
2020-11-01 5:37 ` [RESEND PATCH " Macpaul Lin
2020-12-29 10:53 ` [PATCH RESEND " Macpaul Lin
2020-10-28 17:55 [PATCH " Macpaul Lin
2020-10-28 17:59 ` Macpaul Lin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).