From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752835AbcLFO3v (ORCPT <rfc822;w@1wt.eu>);
        Tue, 6 Dec 2016 09:29:51 -0500
Received: from mail-wj0-f169.google.com ([209.85.210.169]:33912 "EHLO
        mail-wj0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751902AbcLFO3t (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 6 Dec 2016 09:29:49 -0500
MIME-Version: 1.0
From: Andrey Konovalov <andreyknvl@google.com>
Date: Tue, 6 Dec 2016 15:29:46 +0100
Message-ID: <CAAeHK+zTOpxGqVudMdXOw15yJTYBATaPCjGSp2OLZ=U7fALUBA@mail.gmail.com>
Subject: net/gadget: slab-out-of-bounds write in dev_config
To: Felipe Balbi <balbi@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Marek Szyprowski <m.szyprowski@samsung.com>,
        David Sterba <dsterba@suse.com>,
        Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>,
        David Eccher <d.eccher@gmail.com>, Bin Liu <b-liu@ti.com>,
        Mathieu Laurendeau <mat.lau@laposte.net>,
        Binyamin Sharet <s.binyamin@gmail.com>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        linux-usb@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Cc: Dmitry Vyukov <dvyukov@google.com>, Kostya Serebryany <kcc@google.com>,
        syzkaller <syzkaller@googlegroups.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi!

I've got the following error report while running the syzkaller fuzzer.

ep0_write() doesn't check the length, so a user can cause an
out-of-bounds with both size and data controlled.
There's a comment which says "IN DATA+STATUS caller makes len <=
wLength". While I'm not exactly sure what that means, the length seems
to be passed unmodified directly from dev_config().

This doesn't seem to be a critical security issue since gadgetfs can't
be mounted from a user namespace.

On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2).

==================================================================
BUG: KASAN: slab-out-of-bounds in dev_config+0x86f/0x1190 at addr
ffff88003c47e160
Write of size 65537 by task syz-executor0/6356
CPU: 3 PID: 6356 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff88003c107ad8 ffffffff81f96aba ffffffff3dc11ef0 1ffff10007820eee
 ffffed0007820ee6 ffff88003dc11f00 0000000041b58ab3 ffffffff8598b4c8
 ffffffff81f96828 ffffffff813fb4a0 ffff88003b6eadc0 ffff88003c107738
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff81f96aba>] dump_stack+0x292/0x398 lib/dump_stack.c:51
 [<ffffffff817e4dec>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:159
 [<     inline     >] print_address_description mm/kasan/report.c:197
 [<ffffffff817e5080>] kasan_report_error+0x1f0/0x4e0 mm/kasan/report.c:286
 [<ffffffff817e5705>] kasan_report+0x35/0x40 mm/kasan/report.c:306
 [<     inline     >] check_memory_region_inline mm/kasan/kasan.c:308
 [<ffffffff817e3fb9>] check_memory_region+0x139/0x190 mm/kasan/kasan.c:315
 [<ffffffff817e4044>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
 [<     inline     >] copy_from_user arch/x86/include/asm/uaccess.h:689
 [<     inline     >] ep0_write drivers/usb/gadget/legacy/inode.c:1135
 [<ffffffff83228caf>] dev_config+0x86f/0x1190
drivers/usb/gadget/legacy/inode.c:1759
 [<ffffffff817fdd55>] __vfs_write+0x5d5/0x760 fs/read_write.c:510
 [<ffffffff817ff650>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<     inline     >] SYSC_write fs/read_write.c:607
 [<ffffffff81803a5b>] SyS_write+0xfb/0x230 fs/read_write.c:599
 [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003c47e038, in cache kmalloc-1024 size: 1024
Allocated:
PID = 4565
 [   43.417154] [<ffffffff81203526>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
 [   43.417154] [<ffffffff817e40d3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 [   43.417154] [<     inline     >] set_track mm/kasan/kasan.c:507
 [   43.417154] [<ffffffff817e435d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
 [   43.417154] [<ffffffff817dfa02>] kmem_cache_alloc_trace+0x82/0x270
mm/slub.c:2735
 [   43.417154] [<     inline     >] kmalloc include/linux/slab.h:490
 [   43.417154] [<     inline     >] kzalloc include/linux/slab.h:636
 [   43.417154] [<     inline     >] dev_new
drivers/usb/gadget/legacy/inode.c:170
 [   43.417154] [<ffffffff832276ca>] gadgetfs_fill_super+0x24a/0x540
drivers/usb/gadget/legacy/inode.c:1987
 [   43.417154] [<ffffffff8180bb61>] mount_single+0xf1/0x160 fs/super.c:1146
 [   43.417154] [<ffffffff8322290c>] gadgetfs_mount+0x2c/0x40
drivers/usb/gadget/legacy/inode.c:2013
 [   43.417154] [<ffffffff8180be87>] mount_fs+0x97/0x2e0 fs/super.c:1177
 [   43.417154] [<ffffffff8187fc47>] vfs_kern_mount.part.24+0x67/0x2f0
fs/namespace.c:954
 [   43.417154] [<     inline     >] vfs_kern_mount fs/namespace.c:2433
 [   43.417154] [<     inline     >] do_new_mount fs/namespace.c:2436
 [   43.417154] [<ffffffff81888f58>] do_mount+0x418/0x2da0 fs/namespace.c:2758
 [   43.417154] [<     inline     >] SYSC_mount fs/namespace.c:2974
 [   43.417154] [<ffffffff8188c2ab>] SyS_mount+0xab/0x120 fs/namespace.c:2951
 [   43.417154] [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 0
(stack is not available)
Memory state around the buggy address:
 ffff88003c47e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88003c47e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88003c47e200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
                                                       ^
 ffff88003c47e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88003c47e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================