* [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
@ 2017-11-08 17:13 Andrew Gabbasov
2017-11-09 12:01 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Andrew Gabbasov @ 2017-11-08 17:13 UTC (permalink / raw)
To: Felipe Balbi, linux-usb, linux-kernel
KASAN enabled configuration reports an error
BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...
This is observed after "ffs-test" is run and interrupted. If after that
functionfs is unmounted and g_ffs module is unloaded, that use-after-free
occurs during g_ffs module removal.
Although the report indicates ffs_free_inst() function, the actual
use-after-free condition occurs in _ffs_free_dev() function, which
is probably inlined into ffs_free_inst().
This happens due to keeping the ffs_data reference in device structure
during functionfs unmounting, while ffs_data itself is freed as no longer
needed. The fix is to clear that reference in ffs_closed() function,
which is a counterpart of ffs_ready(), where the reference is stored.
Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
---
drivers/usb/gadget/function/f_fs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 8b34258..ef8f7d6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3677,6 +3677,7 @@ static void ffs_closed(struct ffs_data *ffs)
goto done;
ffs_obj->desc_ready = false;
+ ffs_obj->ffs_data = NULL;
if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
ffs_obj->ffs_closed_callback)
--
2.1.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
2017-11-08 17:13 [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst Andrew Gabbasov
@ 2017-11-09 12:01 ` Greg KH
2017-11-09 12:03 ` Felipe Balbi
0 siblings, 1 reply; 3+ messages in thread
From: Greg KH @ 2017-11-09 12:01 UTC (permalink / raw)
To: Andrew Gabbasov; +Cc: Felipe Balbi, linux-usb, linux-kernel
On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote:
> KASAN enabled configuration reports an error
>
> BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
> Write of size 8 by task ...
>
> This is observed after "ffs-test" is run and interrupted. If after that
> functionfs is unmounted and g_ffs module is unloaded, that use-after-free
> occurs during g_ffs module removal.
>
> Although the report indicates ffs_free_inst() function, the actual
> use-after-free condition occurs in _ffs_free_dev() function, which
> is probably inlined into ffs_free_inst().
>
> This happens due to keeping the ffs_data reference in device structure
> during functionfs unmounting, while ffs_data itself is freed as no longer
> needed. The fix is to clear that reference in ffs_closed() function,
> which is a counterpart of ffs_ready(), where the reference is stored.
>
> Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
> ---
> drivers/usb/gadget/function/f_fs.c | 1 +
> 1 file changed, 1 insertion(+)
Felipe, want me to take this directly?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
2017-11-09 12:01 ` Greg KH
@ 2017-11-09 12:03 ` Felipe Balbi
0 siblings, 0 replies; 3+ messages in thread
From: Felipe Balbi @ 2017-11-09 12:03 UTC (permalink / raw)
To: Greg KH, Andrew Gabbasov; +Cc: linux-usb, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1426 bytes --]
Greg KH <greg@kroah.com> writes:
> On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote:
>> KASAN enabled configuration reports an error
>>
>> BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
>> Write of size 8 by task ...
>>
>> This is observed after "ffs-test" is run and interrupted. If after that
>> functionfs is unmounted and g_ffs module is unloaded, that use-after-free
>> occurs during g_ffs module removal.
>>
>> Although the report indicates ffs_free_inst() function, the actual
>> use-after-free condition occurs in _ffs_free_dev() function, which
>> is probably inlined into ffs_free_inst().
>>
>> This happens due to keeping the ffs_data reference in device structure
>> during functionfs unmounting, while ffs_data itself is freed as no longer
>> needed. The fix is to clear that reference in ffs_closed() function,
>> which is a counterpart of ffs_ready(), where the reference is stored.
>>
>> Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
>> ---
>> drivers/usb/gadget/function/f_fs.c | 1 +
>> 1 file changed, 1 insertion(+)
>
> Felipe, want me to take this directly?
If you can still squeeze it into the merge window, sure:
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Thanks
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-11-09 12:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-11-08 17:13 [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst Andrew Gabbasov
2017-11-09 12:01 ` Greg KH
2017-11-09 12:03 ` Felipe Balbi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).