archive mirror
 help / color / mirror / Atom feed
From: Guenter Roeck <>
To: Greg KH <>
Cc: Kalle Valo <>, Hui Peng <>,, Mathias Payer <>,
	"David S. Miller" <>,,,
Subject: Re: [PATCH] Fix a double free bug in rsi_91x_deinit
Date: Mon, 2 Sep 2019 12:32:37 -0700	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On 9/2/19 11:47 AM, Greg KH wrote:
> On Sun, Sep 01, 2019 at 07:08:29AM -0700, Guenter Roeck wrote:
>> On 9/1/19 1:03 AM, Kalle Valo wrote:
>>> Guenter Roeck <> writes:
>>>> On Mon, Aug 19, 2019 at 06:02:29PM -0400, Hui Peng wrote:
>>>>> `dev` (struct rsi_91x_usbdev *) field of adapter
>>>>> (struct rsi_91x_usbdev *) is allocated  and initialized in
>>>>> `rsi_init_usb_interface`. If any error is detected in information
>>>>> read from the device side,  `rsi_init_usb_interface` will be
>>>>> freed. However, in the higher level error handling code in
>>>>> `rsi_probe`, if error is detected, `rsi_91x_deinit` is called
>>>>> again, in which `dev` will be freed again, resulting double free.
>>>>> This patch fixes the double free by removing the free operation on
>>>>> `dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also
>>>>> used in `rsi_disconnect`, in that code path, the `dev` field is not
>>>>>    (and thus needs to be) freed.
>>>>> This bug was found in v4.19, but is also present in the latest version
>>>>> of kernel.
>>>>> Reported-by: Hui Peng <>
>>>>> Reported-by: Mathias Payer <>
>>>>> Signed-off-by: Hui Peng <>
>>>> FWIW:
>>>> Reviewed-by: Guenter Roeck <>
>>>> This patch is listed as fix for CVE-2019-15504, which has a CVSS 2.0 score
>>>> of 10.0 (high) and CVSS 3.0 score of 9.8 (critical).
>>> A double free in error path is considered as a critical CVE issue? I'm
>>> very curious, why is that?
>> You'd have to ask the people assigning CVSS scores. However, if the memory
>> was reallocated, that reallocated memory (which is still in use) is freed.
>> Then all kinds of bad things can happen.
> Yes, but moving from "bad things _can_ happen" to "bad things happen" in
> an instance like this will be a tough task.  It also requires physical
> access to the machine.

Is this correct even with usbip enabled ?

> Anyway, that doesn't mean we shouldn't fix it, it's just that CVSS can
> be crazy when it comes to kernel patches (i.e. almost all fixes should
> be "critical"...)

Not all of them, but probably too many. That is why I asked if the problem
is real. I _used_ to trust CVSS scores, but by now I am at least somewhat
suspicious - especially if a patch wasn't applied for a period of time,
like this series of usb patches.

Having said that, I am even more wary of double-free problems - those tend
to be notoriously difficult to debug. I'd rather have them out of my way,
even if they are unlikely to be seen in the real world (plus, Murphy
says that anything unlikely is going to happen almost immediately).


  reply	other threads:[~2019-09-02 19:32 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-19 22:02 [PATCH] Fix a double free bug in rsi_91x_deinit Hui Peng
2019-08-31 18:18 ` Guenter Roeck
2019-08-31 18:32   ` Hui Peng
2019-09-01  8:03   ` Kalle Valo
2019-09-01 14:08     ` Guenter Roeck
2019-09-02 18:47       ` Greg KH
2019-09-02 19:32         ` Guenter Roeck [this message]
2019-09-02 20:06           ` Greg KH
2019-09-03  0:35             ` Guenter Roeck
2019-09-03 13:55 ` [PATCH] rsi: fix a double free bug in rsi_91x_deinit() Kalle Valo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).