Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1675671

[PATCH 3.18 14/16] usb: gadget: f_fs: avoid out of bounds access on comp_desc

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: William Wu <william.wu@rock-chips.com>

commit b7f73850bb4fac1e2209a4dd5e636d39be92f42c upstream.

Companion descriptor is only used for SuperSpeed endpoints,
if the endpoints are HighSpeed or FullSpeed, the Companion
descriptor will not allocated, so we can only access it if
gadget is SuperSpeed.

I can reproduce this issue on Rockchip platform rk3368 SoC
which supports USB 2.0, and use functionfs for ADB. Kernel
build with CONFIG_KASAN=y and CONFIG_SLUB_DEBUG=y report
the following BUG:

==================================================================
BUG: KASAN: slab-out-of-bounds in ffs_func_set_alt+0x224/0x3a0 at addr ffffffc0601f6509
Read of size 1 by task swapper/0/0
============================================================================
BUG kmalloc-256 (Not tainted): kasan: bad access detected
----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in ffs_func_bind+0x52c/0x99c age=1275 cpu=0 pid=1
alloc_debug_processing+0x128/0x17c
___slab_alloc.constprop.58+0x50c/0x610
__slab_alloc.isra.55.constprop.57+0x24/0x34
__kmalloc+0xe0/0x250
ffs_func_bind+0x52c/0x99c
usb_add_function+0xd8/0x1d4
configfs_composite_bind+0x48c/0x570
udc_bind_to_driver+0x6c/0x170
usb_udc_attach_driver+0xa4/0xd0
gadget_dev_desc_UDC_store+0xcc/0x118
configfs_write_file+0x1a0/0x1f8
__vfs_write+0x64/0x174
vfs_write+0xe4/0x200
SyS_write+0x68/0xc8
el0_svc_naked+0x24/0x28
INFO: Freed in inode_doinit_with_dentry+0x3f0/0x7c4 age=1275 cpu=7 pid=247
...
Call trace:
[<ffffff900808aab4>] dump_backtrace+0x0/0x230
[<ffffff900808acf8>] show_stack+0x14/0x1c
[<ffffff90084ad420>] dump_stack+0xa0/0xc8
[<ffffff90082157cc>] print_trailer+0x188/0x198
[<ffffff9008215948>] object_err+0x3c/0x4c
[<ffffff900821b5ac>] kasan_report+0x324/0x4dc
[<ffffff900821aa38>] __asan_load1+0x24/0x50
[<ffffff90089eb750>] ffs_func_set_alt+0x224/0x3a0
[<ffffff90089d3760>] composite_setup+0xdcc/0x1ac8
[<ffffff90089d7394>] android_setup+0x124/0x1a0
[<ffffff90089acd18>] _setup+0x54/0x74
[<ffffff90089b6b98>] handle_ep0+0x3288/0x4390
[<ffffff90089b9b44>] dwc_otg_pcd_handle_out_ep_intr+0x14dc/0x2ae4
[<ffffff90089be85c>] dwc_otg_pcd_handle_intr+0x1ec/0x298
[<ffffff90089ad680>] dwc_otg_pcd_irq+0x10/0x20
[<ffffff9008116328>] handle_irq_event_percpu+0x124/0x3ac
[<ffffff9008116610>] handle_irq_event+0x60/0xa0
[<ffffff900811af30>] handle_fasteoi_irq+0x10c/0x1d4
[<ffffff9008115568>] generic_handle_irq+0x30/0x40
[<ffffff90081159b4>] __handle_domain_irq+0xac/0xdc
[<ffffff9008080e9c>] gic_handle_irq+0x64/0xa4
...
Memory state around the buggy address:
  ffffffc0601f6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffffffc0601f6480: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc
 >ffffffc0601f6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                       ^
  ffffffc0601f6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffffffc0601f6600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================

Signed-off-by: William Wu <william.wu@rock-chips.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: Jerry Zhang <zhangjerry@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_fs.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1674,12 +1674,12 @@ static int ffs_func_eps_enable(struct ff
 		ep->ep->driver_data = ep;
 		ep->ep->desc = ds;
 
-		comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-				USB_DT_ENDPOINT_SIZE);
-		ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-
-		if (needs_comp_desc)
+		if (needs_comp_desc) {
+			comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+					USB_DT_ENDPOINT_SIZE);
+			ep->ep->maxburst = comp_desc->bMaxBurst + 1;
 			ep->ep->comp_desc = comp_desc;
+		}
 
 		ret = usb_ep_enable(ep->ep);
 		if (likely(!ret)) {

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/16] 3.18.59-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:00 +0200
  [PATCH 3.18 02/16] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:00 +0200
  [PATCH 3.18 09/16] target: Fix kref->refcount underflow in transport_cmd_finish_abort Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:00 +0200
  [PATCH 3.18 03/16] lib/cmdline.c: fix get_options() overflow while parsing ranges Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:00 +0200
  [PATCH 3.18 06/16] signal: Only reschedule timers on signals timers have sent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:00 +0200
  [PATCH 3.18 14/16] usb: gadget: f_fs: avoid out of bounds access on comp_desc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:00 +0200
  [PATCH 3.18 13/16] powerpc/slb: Force a full SLB flush when we insert for a bad EA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:10 +0200
  [PATCH 3.18 11/16] of: Add check to of_scan_flat_dt() before accessing initial_boot_params Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:10 +0200
  [PATCH 3.18 04/16] KVM: PPC: Book3S HV: Preserve userspace HTM state properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:10 +0200
  [PATCH 3.18 07/16] powerpc/kprobes: Pause function_graph tracing during jprobes handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:10 +0200
  [PATCH 3.18 15/16] net: phy: fix marvell phy status reading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:10 +0200
  [PATCH 3.18 05/16] CIFS: Improve readdir verbosity Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-27 15:10 +0200
  Re: [PATCH 3.18 00/16] 3.18.59-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-27 21:00 +0200
  Re: [PATCH 3.18 00/16] 3.18.59-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-28 16:00 +0200

csiph-web