[PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

[PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

[Andrew Gabbasov]

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...

This is observed after "ffs-test" is run and interrupted. If after that
functionfs is unmounted and g_ffs module is unloaded, that use-after-free
occurs during g_ffs module removal.

Although the report indicates ffs_free_inst() function, the actual
use-after-free condition occurs in _ffs_free_dev() function, which
is probably inlined into ffs_free_inst().

This happens due to keeping the ffs_data reference in device structure
during functionfs unmounting, while ffs_data itself is freed as no longer
needed. The fix is to clear that reference in ffs_closed() function,
which is a counterpart of ffs_ready(), where the reference is stored.

Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
---
 drivers/usb/gadget/function/f_fs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 8b34258..ef8f7d6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3677,6 +3677,7 @@ static void ffs_closed(struct ffs_data *ffs)
 		goto done;
 
 	ffs_obj->desc_ready = false;
+	ffs_obj->ffs_data = NULL;
 
 	if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
 	    ffs_obj->ffs_closed_callback)
-- 
2.1.0

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

[Greg KH]

On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote:
> KASAN enabled configuration reports an error
> 
> BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
> Write of size 8 by task ...
> 
> This is observed after "ffs-test" is run and interrupted. If after that
> functionfs is unmounted and g_ffs module is unloaded, that use-after-free
> occurs during g_ffs module removal.
> 
> Although the report indicates ffs_free_inst() function, the actual
> use-after-free condition occurs in _ffs_free_dev() function, which
> is probably inlined into ffs_free_inst().
> 
> This happens due to keeping the ffs_data reference in device structure
> during functionfs unmounting, while ffs_data itself is freed as no longer
> needed. The fix is to clear that reference in ffs_closed() function,
> which is a counterpart of ffs_ready(), where the reference is stored.
> 
> Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
> ---
>  drivers/usb/gadget/function/f_fs.c | 1 +
>  1 file changed, 1 insertion(+)

Felipe, want me to take this directly?

thanks,

greg k-h

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 1426 bytes --]

Greg KH <greg@kroah.com> writes:

> On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote:
>> KASAN enabled configuration reports an error
>> 
>> BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
>> Write of size 8 by task ...
>> 
>> This is observed after "ffs-test" is run and interrupted. If after that
>> functionfs is unmounted and g_ffs module is unloaded, that use-after-free
>> occurs during g_ffs module removal.
>> 
>> Although the report indicates ffs_free_inst() function, the actual
>> use-after-free condition occurs in _ffs_free_dev() function, which
>> is probably inlined into ffs_free_inst().
>> 
>> This happens due to keeping the ffs_data reference in device structure
>> during functionfs unmounting, while ffs_data itself is freed as no longer
>> needed. The fix is to clear that reference in ffs_closed() function,
>> which is a counterpart of ffs_ready(), where the reference is stored.
>> 
>> Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
>> ---
>>  drivers/usb/gadget/function/f_fs.c | 1 +
>>  1 file changed, 1 insertion(+)
>
> Felipe, want me to take this directly?

If you can still squeeze it into the merge window, sure:

Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>

Thanks

-- 
balbi

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]