linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Andrey Konovalov <andreyknvl@google.com>
To: Felipe Balbi <balbi@kernel.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Al Viro <viro@zeniv.linux.org.uk>,
	Marek Szyprowski <m.szyprowski@samsung.com>,
	David Sterba <dsterba@suse.com>,
	Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>,
	David Eccher <d.eccher@gmail.com>, Bin Liu <b-liu@ti.com>,
	Mathieu Laurendeau <mat.lau@laposte.net>,
	Binyamin Sharet <s.binyamin@gmail.com>,
	"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
	linux-usb@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Cc: Dmitry Vyukov <dvyukov@google.com>,
	Kostya Serebryany <kcc@google.com>,
	syzkaller <syzkaller@googlegroups.com>
Subject: net/gadget: slab-out-of-bounds write in dev_config
Date: Tue, 6 Dec 2016 15:29:46 +0100	[thread overview]
Message-ID: <CAAeHK+zTOpxGqVudMdXOw15yJTYBATaPCjGSp2OLZ=U7fALUBA@mail.gmail.com> (raw)

Hi!

I've got the following error report while running the syzkaller fuzzer.

ep0_write() doesn't check the length, so a user can cause an
out-of-bounds with both size and data controlled.
There's a comment which says "IN DATA+STATUS caller makes len <=
wLength". While I'm not exactly sure what that means, the length seems
to be passed unmodified directly from dev_config().

This doesn't seem to be a critical security issue since gadgetfs can't
be mounted from a user namespace.

On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2).

==================================================================
BUG: KASAN: slab-out-of-bounds in dev_config+0x86f/0x1190 at addr
ffff88003c47e160
Write of size 65537 by task syz-executor0/6356
CPU: 3 PID: 6356 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff88003c107ad8 ffffffff81f96aba ffffffff3dc11ef0 1ffff10007820eee
 ffffed0007820ee6 ffff88003dc11f00 0000000041b58ab3 ffffffff8598b4c8
 ffffffff81f96828 ffffffff813fb4a0 ffff88003b6eadc0 ffff88003c107738
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff81f96aba>] dump_stack+0x292/0x398 lib/dump_stack.c:51
 [<ffffffff817e4dec>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:159
 [<     inline     >] print_address_description mm/kasan/report.c:197
 [<ffffffff817e5080>] kasan_report_error+0x1f0/0x4e0 mm/kasan/report.c:286
 [<ffffffff817e5705>] kasan_report+0x35/0x40 mm/kasan/report.c:306
 [<     inline     >] check_memory_region_inline mm/kasan/kasan.c:308
 [<ffffffff817e3fb9>] check_memory_region+0x139/0x190 mm/kasan/kasan.c:315
 [<ffffffff817e4044>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
 [<     inline     >] copy_from_user arch/x86/include/asm/uaccess.h:689
 [<     inline     >] ep0_write drivers/usb/gadget/legacy/inode.c:1135
 [<ffffffff83228caf>] dev_config+0x86f/0x1190
drivers/usb/gadget/legacy/inode.c:1759
 [<ffffffff817fdd55>] __vfs_write+0x5d5/0x760 fs/read_write.c:510
 [<ffffffff817ff650>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<     inline     >] SYSC_write fs/read_write.c:607
 [<ffffffff81803a5b>] SyS_write+0xfb/0x230 fs/read_write.c:599
 [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003c47e038, in cache kmalloc-1024 size: 1024
Allocated:
PID = 4565
 [   43.417154] [<ffffffff81203526>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
 [   43.417154] [<ffffffff817e40d3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 [   43.417154] [<     inline     >] set_track mm/kasan/kasan.c:507
 [   43.417154] [<ffffffff817e435d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
 [   43.417154] [<ffffffff817dfa02>] kmem_cache_alloc_trace+0x82/0x270
mm/slub.c:2735
 [   43.417154] [<     inline     >] kmalloc include/linux/slab.h:490
 [   43.417154] [<     inline     >] kzalloc include/linux/slab.h:636
 [   43.417154] [<     inline     >] dev_new
drivers/usb/gadget/legacy/inode.c:170
 [   43.417154] [<ffffffff832276ca>] gadgetfs_fill_super+0x24a/0x540
drivers/usb/gadget/legacy/inode.c:1987
 [   43.417154] [<ffffffff8180bb61>] mount_single+0xf1/0x160 fs/super.c:1146
 [   43.417154] [<ffffffff8322290c>] gadgetfs_mount+0x2c/0x40
drivers/usb/gadget/legacy/inode.c:2013
 [   43.417154] [<ffffffff8180be87>] mount_fs+0x97/0x2e0 fs/super.c:1177
 [   43.417154] [<ffffffff8187fc47>] vfs_kern_mount.part.24+0x67/0x2f0
fs/namespace.c:954
 [   43.417154] [<     inline     >] vfs_kern_mount fs/namespace.c:2433
 [   43.417154] [<     inline     >] do_new_mount fs/namespace.c:2436
 [   43.417154] [<ffffffff81888f58>] do_mount+0x418/0x2da0 fs/namespace.c:2758
 [   43.417154] [<     inline     >] SYSC_mount fs/namespace.c:2974
 [   43.417154] [<ffffffff8188c2ab>] SyS_mount+0xab/0x120 fs/namespace.c:2951
 [   43.417154] [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 0
(stack is not available)
Memory state around the buggy address:
 ffff88003c47e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88003c47e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88003c47e200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
                                                       ^
 ffff88003c47e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88003c47e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

             reply	other threads:[~2016-12-06 14:29 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-12-06 14:29 Andrey Konovalov [this message]
2016-12-06 15:30 ` net/gadget: slab-out-of-bounds write in dev_config Alan Stern
2016-12-06 20:23   ` Andrey Konovalov
2016-12-27 11:21   ` Felipe Balbi
2016-12-27 15:12     ` Alan Stern
2016-12-28 11:51       ` Felipe Balbi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAAeHK+zTOpxGqVudMdXOw15yJTYBATaPCjGSp2OLZ=U7fALUBA@mail.gmail.com' \
    --to=andreyknvl@google.com \
    --cc=b-liu@ti.com \
    --cc=balbi@kernel.org \
    --cc=d.eccher@gmail.com \
    --cc=dsterba@suse.com \
    --cc=dvyukov@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=kcc@google.com \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=konishi.ryusuke@lab.ntt.co.jp \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=m.szyprowski@samsung.com \
    --cc=mat.lau@laposte.net \
    --cc=s.binyamin@gmail.com \
    --cc=syzkaller@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).