Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free

Path	csiph.com!news.mixmin.net!news.unit0.net!news.panservice.it!diesel.cu.mi.it!bofh.it!news.nic.it!robomod
From	Macpaul Lin <macpaul@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free
Date	Fri, 10 Feb 2017 07:50:01 +0100
Message-ID	<t9dbP-8le-5@gated-at.bofh.it> (permalink)
References	<t0ySe-5M4-21@gated-at.bofh.it> <t0zlh-5WC-53@gated-at.bofh.it>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9y+P4xePtIp2rf9YlqnM8tYECDbryFxrazEDg9CBfwo=; b=ayeAUy9jPV8RifpmyPXOeTjVt7SyURzdatWtcbSaMUTUBGNOvfzOqI0w+cpDW6y1q6 7t9CelvwE5HM2rAb7ZV/DPfJVRfYxmIv907Fr9NGKDKbSzuN8oD2DlfJs5kqnR/bkuT2 KGuchebQO9UvcuZlsuw+kp+EmOpJXKZl/4WJWzjbyPK6t4iA/Q2jehY2POVDRGR5Jij7 CRinB8z4X61U+qG05A+oG+sBIfpElbvyTZRlUN/ABeH5M3Bj6XUF1FTg76IY888O2oMq YlsszUqf1S/H6AttGnJfDeKojZZ5EdV/xttJ52dOu1EWImSV72bRqDPky+HhpE6GaGFX 4nqQ==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9y+P4xePtIp2rf9YlqnM8tYECDbryFxrazEDg9CBfwo=; b=Fb9X9hN+WMS+3O7LtZaGgcIBgBzyiZcSLNEU/pzIutYRrJhSX54cT6i8D3WptkLJYO oEhGmIydBPK0bhPq2vbIj1CMFUck2U5ScTIVKiKI2V+qco0ulUKPAVMvPdPsX91le/Yr jq7lH604XemHq9lBZPEQMmLRfw8kub2hz3GeBNEuPnAyMp9YVEN3HrFWOrB4TDg0lNEH nsOlMAL3/BFcUjtl6Z0xQqg6a+rZ1YrpGJWPB0ENg6Hgh/HFWOAkbN0cC/9kbD8RFgn0 uSPX4aMLmg2nmaY9Vnfd6rZpuD2wxVDKf12RB42lo7q9LAdLvZ5jtsIKiELSvJa7JQaS DLrg==
X-Gm-Message-State	AMke39mDJNiJnYAN0lVWmsiOK/4asITc3F9azIm60H7HKqdhnTjLDIgIHjI72o7+9jbXQxDZU1Yj3W8jsoxHAA==
X-Received	by 10.28.144.66 with SMTP id s63mr26432889wmd.134.1486709105845; Thu, 09 Feb 2017 22:45:05 -0800 (PST)
MIME-Version	1.0
Content-Type	text/plain; charset=UTF-8
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	53
Organization	linux.* mail to news gateway
X-Original-Cc	Jim Lin <jilin@nvidia.com>, "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>, linux-kernel@vger.kernel.org
X-Original-Date	Fri, 10 Feb 2017 14:44:45 +0800
X-Original-Message-ID	<CACCg+XNMwuYeyVKaVByXGSwrYSMVj9mfaicwKizA7y_kFb+CPA@mail.gmail.com>
X-Original-References	<1484647168-30135-1-git-send-email-jilin@nvidia.com> <878tqakmiy.fsf@linux.intel.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1578199

Show key headers only | View raw

Hi Jim,

> Jim Lin <jilin@nvidia.com> writes:
> > When gadget is disconnected, running sequence is like this.
> > . composite_disconnect
> > . Call trace:
> >   usb_string_copy+0xd0/0x128
> >   gadget_config_name_configuration_store+0x4
> >   gadget_config_name_attr_store+0x40/0x50
> >   configfs_write_file+0x198/0x1f4
> >   vfs_write+0x100/0x220
> >   SyS_write+0x58/0xa8
> > . configfs_composite_unbind
> > . configfs_composite_bind
> >

[deleted]

> > When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
> > memory is accessed, "BUG: KASAN: use-after-free" error occurs.
> >
> > Signed-off-by: Jim Lin <jilin@nvidia.com>
> > ---
> > Changes in v2:
> > Changes in v3:
> >  Change commit description
>
> well, I need to be sure you tested this with Linus' tree. The reason I'm
> asking is because this could be a bug caused by Android changes. From
> your previous patch, the problem started with android_setup().
>
> Please test with v4.10-rc4 and any configfs-based gadget.
>
> --
> balbi

I've got the similar problem on Android, however,
Linux guys require you and other people to test your patch on pure Linux.
Since Linux is exactly a "PC" based OS, only common patches should be
commit to Linux code base.
Except the bug is quite common in 3 OS, in "Linux PC" and in "Android
Linux" or "Chromium OS".

I'm not sure about the difference between Chromium OS and Linux PC.
According to CVE report, it looks like the change is from  Chromium OS?
Dose Nvidia has a pure Linux software team can verify your patch on
your platform?
I think if you can prove the result is okay on Linux PC or on Chromium
OS will help.

-- 
Best regards,
Macpaul Lin

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free Macpaul Lin <macpaul@gmail.com> - 2017-02-10 07:50 +0100

csiph-web