From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zheyu Ma <zheyuma97@gmail.com>,
Ulf Hansson <ulf.hansson@linaro.org>,
Sasha Levin <sashal@kernel.org>,
maximlevitsky@gmail.com, oakad@yahoo.com,
linux-mmc@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 20/30] memstick: r592: Fix a UAF bug when removing the driver
Date: Mon, 8 Nov 2021 20:09:08 -0500 [thread overview]
Message-ID: <20211109010918.1192063-20-sashal@kernel.org> (raw)
In-Reply-To: <20211109010918.1192063-1-sashal@kernel.org>
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit 738216c1953e802aa9f930c5d15b8f9092c847ff ]
In r592_remove(), the driver will free dma after freeing the host, which
may cause a UAF bug.
The following log reveals it:
[ 45.361796 ] BUG: KASAN: use-after-free in r592_remove+0x269/0x350 [r592]
[ 45.364286 ] Call Trace:
[ 45.364472 ] dump_stack_lvl+0xa8/0xd1
[ 45.364751 ] print_address_description+0x87/0x3b0
[ 45.365137 ] kasan_report+0x172/0x1c0
[ 45.365415 ] ? r592_remove+0x269/0x350 [r592]
[ 45.365834 ] ? r592_remove+0x269/0x350 [r592]
[ 45.366168 ] __asan_report_load8_noabort+0x14/0x20
[ 45.366531 ] r592_remove+0x269/0x350 [r592]
[ 45.378785 ]
[ 45.378903 ] Allocated by task 4674:
[ 45.379162 ] ____kasan_kmalloc+0xb5/0xe0
[ 45.379455 ] __kasan_kmalloc+0x9/0x10
[ 45.379730 ] __kmalloc+0x150/0x280
[ 45.379984 ] memstick_alloc_host+0x2a/0x190
[ 45.380664 ]
[ 45.380781 ] Freed by task 5509:
[ 45.381014 ] kasan_set_track+0x3d/0x70
[ 45.381293 ] kasan_set_free_info+0x23/0x40
[ 45.381635 ] ____kasan_slab_free+0x10b/0x140
[ 45.381950 ] __kasan_slab_free+0x11/0x20
[ 45.382241 ] slab_free_freelist_hook+0x81/0x150
[ 45.382575 ] kfree+0x13e/0x290
[ 45.382805 ] memstick_free+0x1c/0x20
[ 45.383070 ] device_release+0x9c/0x1d0
[ 45.383349 ] kobject_put+0x2ef/0x4c0
[ 45.383616 ] put_device+0x1f/0x30
[ 45.383865 ] memstick_free_host+0x24/0x30
[ 45.384162 ] r592_remove+0x242/0x350 [r592]
[ 45.384473 ] pci_device_remove+0xa9/0x250
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1634383581-11055-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/host/r592.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index b3857445d6736..7779aaa6b9b81 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -842,15 +842,15 @@ static void r592_remove(struct pci_dev *pdev)
}
memstick_remove_host(dev->host);
+ if (dev->dummy_dma_page)
+ dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
+ dev->dummy_dma_page_physical_address);
+
free_irq(dev->irq, dev);
iounmap(dev->mmio);
pci_release_regions(pdev);
pci_disable_device(pdev);
memstick_free_host(dev->host);
-
- if (dev->dummy_dma_page)
- dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
- dev->dummy_dma_page_physical_address);
}
#ifdef CONFIG_PM_SLEEP
--
2.33.0
next prev parent reply other threads:[~2021-11-09 1:28 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-09 1:08 [PATCH AUTOSEL 4.4 01/30] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 02/30] Bluetooth: fix use-after-free error in lock_sock_nested() Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 03/30] platform/x86: wmi: do not fail if disabling fails Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 04/30] MIPS: lantiq: dma: add small delay after reset Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 05/30] MIPS: lantiq: dma: reset correct number of channel Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 06/30] smackfs: Fix use-after-free in netlbl_catmap_walk() Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 07/30] NET: IPV4: fix error "do not initialise globals to 0" Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 08/30] x86: Increase exception stack sizes Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 09/30] media: mt9p031: Fix corrupted frame after restarting stream Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 10/30] media: netup_unidvb: handle interrupt properly according to the firmware Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 11/30] media: uvcvideo: Set capability in s_param Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 12/30] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 13/30] media: mceusb: return without resubmitting URB in case of -EPROTO error Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 14/30] ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 15/30] ACPICA: Avoid evaluating methods too early during system resume Sasha Levin
2021-11-10 15:10 ` Moore, Robert
2021-11-10 15:18 ` Rafael J. Wysocki
2021-11-10 15:52 ` Moore, Robert
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 16/30] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 17/30] tracefs: Have tracefs directories not set OTH permission bits by default Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 18/30] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 19/30] ACPI: battery: Accept charges over the design capacity as full Sasha Levin
2021-11-09 1:09 ` Sasha Levin [this message]
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 21/30] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 22/30] lib/xz: Validate the value before assigning it to an enum variable Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 23/30] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 24/30] PM: hibernate: Get block device exclusively in swsusp_check() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 25/30] iwlwifi: mvm: disable RX-diversity in powersave Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 26/30] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 27/30] ARM: clang: Do not rely on lr register for stacktrace Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 28/30] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 29/30] parisc: fix warning in flush_tlb_all Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 30/30] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211109010918.1192063-20-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mmc@vger.kernel.org \
--cc=maximlevitsky@gmail.com \
--cc=oakad@yahoo.com \
--cc=stable@vger.kernel.org \
--cc=ulf.hansson@linaro.org \
--cc=zheyuma97@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).