[PATCH] usb: musb: Fix potential NULL dereference

[PATCH] usb: musb: Fix potential NULL dereference

[Matwey V. Kornilov]

We assign "urb->hcpriv = qh;" a few lines down. The valid qh for the urb is
hep->hcpriv in this code path.

Fixes: 714bc5ef3eda ("musb: potential use after free")
Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
---
 drivers/usb/musb/musb_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index c6118a962d37..6f267716768e 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2336,7 +2336,7 @@ static int musb_urb_enqueue(
 		 * odd, rare, error prone, but legal.
 		 */
 		kfree(qh);
-		qh = NULL;
+		qh = hep->hcpriv;
 		ret = 0;
 	} else
 		ret = musb_schedule(musb, qh,
-- 
2.16.4

Re: [PATCH] usb: musb: Fix potential NULL dereference

[Matwey V. Kornilov]

By the way, why do we need to store the qh in urb->hcpriv?
qh can always be accessible through urb->ep->hcpriv
Wouldn't it be better to drop entire urb->hcpriv usage?

ср, 23 янв. 2019 г. в 20:52, Matwey V. Kornilov <matwey@sai.msu.ru>:
>
> We assign "urb->hcpriv = qh;" a few lines down. The valid qh for the urb is
> hep->hcpriv in this code path.
>
> Fixes: 714bc5ef3eda ("musb: potential use after free")
> Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
> ---
>  drivers/usb/musb/musb_host.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
> index c6118a962d37..6f267716768e 100644
> --- a/drivers/usb/musb/musb_host.c
> +++ b/drivers/usb/musb/musb_host.c
> @@ -2336,7 +2336,7 @@ static int musb_urb_enqueue(
>                  * odd, rare, error prone, but legal.
>                  */
>                 kfree(qh);
> -               qh = NULL;
> +               qh = hep->hcpriv;
>                 ret = 0;
>         } else
>                 ret = musb_schedule(musb, qh,
> --
> 2.16.4
>


-- 
With best regards,
Matwey V. Kornilov

Re: [PATCH] usb: musb: Fix potential NULL dereference

[Bin Liu]

On Wed, Jan 23, 2019 at 08:51:42PM +0300, Matwey V. Kornilov wrote:
> We assign "urb->hcpriv = qh;" a few lines down. The valid qh for the urb is
> hep->hcpriv in this code path.
> 
> Fixes: 714bc5ef3eda ("musb: potential use after free")
> Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
> ---
>  drivers/usb/musb/musb_host.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
> index c6118a962d37..6f267716768e 100644
> --- a/drivers/usb/musb/musb_host.c
> +++ b/drivers/usb/musb/musb_host.c
> @@ -2336,7 +2336,7 @@ static int musb_urb_enqueue(
>  		 * odd, rare, error prone, but legal.
>  		 */
>  		kfree(qh);
> -		qh = NULL;
> +		qh = hep->hcpriv;
>  		ret = 0;
>  	} else
>  		ret = musb_schedule(musb, qh,

Did you run into any issue? The original code seems to be correct to me.

Regards,
-Bin.

Re: [PATCH] usb: musb: Fix potential NULL dereference

[Bin Liu]

On Thu, Jan 24, 2019 at 09:47:02PM +0300, Matwey V. Kornilov wrote:
> By the way, why do we need to store the qh in urb->hcpriv?
> qh can always be accessible through urb->ep->hcpriv
> Wouldn't it be better to drop entire urb->hcpriv usage?

I am not sure why. The code is there since the first commit in a decade
ago. But I tend to agree with you.

In a quick search for urb->hcpriv and urb->ep->hcpriv, based on the
usage in core/hcd.c, it seems to me that urb->hcpriv should not be
changed in each controller driver, but I see both have been used in most
controller drivers. I will leave this to others to educate me.

Regards,
-Bin.

Re: [PATCH] usb: musb: Fix potential NULL dereference

[Alan Stern]

On Fri, 25 Jan 2019, Bin Liu wrote:

> On Thu, Jan 24, 2019 at 09:47:02PM +0300, Matwey V. Kornilov wrote:
> > By the way, why do we need to store the qh in urb->hcpriv?
> > qh can always be accessible through urb->ep->hcpriv
> > Wouldn't it be better to drop entire urb->hcpriv usage?
> 
> I am not sure why. The code is there since the first commit in a decade
> ago. But I tend to agree with you.
> 
> In a quick search for urb->hcpriv and urb->ep->hcpriv, based on the
> usage in core/hcd.c, it seems to me that urb->hcpriv should not be
> changed in each controller driver, but I see both have been used in most
> controller drivers. I will leave this to others to educate me.

In some of the older HCDs, urb->hcpriv != NULL is used to indicate that 
urb is on an endpoint queue.  Perhaps that usage was copied.

Alan Stern

Re: [PATCH] usb: musb: Fix potential NULL dereference

[Matwey V. Kornilov]

сб, 26 янв. 2019 г. в 00:37, Alan Stern <stern@rowland.harvard.edu>:
>
> On Fri, 25 Jan 2019, Bin Liu wrote:
>
> > On Thu, Jan 24, 2019 at 09:47:02PM +0300, Matwey V. Kornilov wrote:
> > > By the way, why do we need to store the qh in urb->hcpriv?
> > > qh can always be accessible through urb->ep->hcpriv
> > > Wouldn't it be better to drop entire urb->hcpriv usage?
> >
> > I am not sure why. The code is there since the first commit in a decade
> > ago. But I tend to agree with you.
> >
> > In a quick search for urb->hcpriv and urb->ep->hcpriv, based on the
> > usage in core/hcd.c, it seems to me that urb->hcpriv should not be
> > changed in each controller driver, but I see both have been used in most
> > controller drivers. I will leave this to others to educate me.
>
> In some of the older HCDs, urb->hcpriv != NULL is used to indicate that
> urb is on an endpoint queue.  Perhaps that usage was copied.
>
> Alan Stern
>

Hi,

Thank you for the explanation. I think that It would be great to
document it somewhere. Such a purpose for variable named `hcpriv' is
not entirely obvious.
Now it is clear to me, why __usb_hcd_giveback_urb() sets urb->hcpriv to NULL.

Returning to my initial patch. I think that it is still valid, though
I admit that the commit message must be rewritten.
In this code path we successfully queued the new urb, so urb->hcpriv
should be NOT NULL indicating that the urb is queued according to Alan
explanation.

musb_urb_enqueue(), musb_host.c line 2345:

        if (ret == 0) {
                urb->hcpriv = qh;
                /* FIXME set urb->start_frame for iso/intr, it's tested in
                 * musb_start_urb(), but otherwise only konicawc cares ...
                 */
        }

-- 
With best regards,
Matwey V. Kornilov

[PATCH v2] usb: musb: Fix urb->hcpriv value

[Matwey V. Kornilov]

urb->hcpriv != NULL is used to indicate that the URB is queued [1].
Also see __usb_hcd_giveback_urb() and usb_hcd_submit_urb() for
the reference.

In this code path, the URB is actually queued and valid qh is hep->hcpriv.

[1] https://lkml.org/lkml/2019/1/25/750

Fixes: 714bc5ef3eda ("musb: potential use after free")
Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
---
 drivers/usb/musb/musb_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index b59ce9ad14ce..a60d52c7e112 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2302,7 +2302,7 @@ static int musb_urb_enqueue(
 		 * odd, rare, error prone, but legal.
 		 */
 		kfree(qh);
-		qh = NULL;
+		qh = hep->hcpriv;
 		ret = 0;
 	} else
 		ret = musb_schedule(musb, qh,
-- 
2.16.4