kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb
History
Alan Stern ff33299ec8 USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() 
Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors():

BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011

CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
 print_report mm/kasan/report.c:462 [inline]
 kasan_report+0x11c/0x130 mm/kasan/report.c:572
 read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
...
Allocated by task 758:
...
 __do_kmalloc_node mm/slab_common.c:966 [inline]
 __kmalloc+0x5e/0x190 mm/slab_common.c:979
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:680 [inline]
 usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887
 usb_enumerate_device drivers/usb/core/hub.c:2407 [inline]
 usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545

As analyzed by Khazhy Kumykov, the cause of this bug is a race between
read_descriptors() and hub_port_init(): The first routine uses a field
in udev->descriptor, not expecting it to change, while the second
overwrites it.

Prior to commit 45bf39f8df ("USB: core: Don't hold device lock while
reading the "descriptors" sysfs file") this race couldn't occur,
because the routines were mutually exclusive thanks to the device
locking.  Removing that locking from read_descriptors() exposed it to
the race.

The best way to fix the bug is to keep hub_port_init() from changing
udev->descriptor once udev has been initialized and registered.
Drivers expect the descriptors stored in the kernel to be immutable;
we should not undermine this expectation.  In fact, this change should
have been made long ago.

So now hub_port_init() will take an additional argument, specifying a
buffer in which to store the device descriptor it reads.  (If udev has
not yet been initialized, the buffer pointer will be NULL and then
hub_port_init() will store the device descriptor in udev as before.)
This eliminates the data race responsible for the out-of-bounds read.

The changes to hub_port_init() appear more extensive than they really
are, because of indentation changes resulting from an attempt to avoid
writing to other parts of the usb_device structure after it has been
initialized.  Similar changes should be made to the code that reads
the BOS descriptor, but that can be handled in a separate patch later
on.  This patch is sufficient to fix the bug found by syzbot.

Reported-and-tested-by: syzbot+18996170f8096c6174d0@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/000000000000c0ffe505fe86c9ca@google.com/#r
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Khazhy Kumykov <khazhy@google.com>
Fixes: 45bf39f8df ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/b958b47a-9a46-4c22-a9f9-e42e42c31251@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2023-08-08 10:45:32 +02:00
..
atm usb: move from strlcpy with unused retval to strscpy 2022-08-19 11:08:54 +02:00
c67x00 usb: c67x00-drv: Convert to platform remove callback returning void 2023-05-28 12:36:14 +01:00
cdns3 Merge 6.5-rc4 into usb-next 2023-07-31 09:36:55 +02:00
chipidea usb: chipidea: udc: Remove an unnecessary NULL value 2023-08-04 14:48:55 +02:00
class usb: cdc-acm: add PPS support 2023-08-08 10:36:05 +02:00
common usb: Explicitly include correct DT includes 2023-07-25 18:20:02 +02:00
core USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() 2023-08-08 10:45:32 +02:00
dwc2 usb: Explicitly include correct DT includes 2023-07-25 18:20:02 +02:00
dwc3 usb: dwc3: dwc3-octeon: Add SPDX header and copyright 2023-08-04 14:52:15 +02:00
early usb: early: xhci-dbc: Use memcpy_and_pad() 2023-01-31 10:40:54 +01:00
fotg210 usb: fotg210: Convert to platform remove callback returning void 2023-05-28 12:36:25 +01:00
gadget usb: gadget: udc: Remove unnecessary NULL values 2023-08-04 14:48:24 +02:00
host usb: host: Do not check for 0 return after calling platform_get_irq() 2023-08-04 14:46:53 +02:00
image scsi: usb: uas: Declare two host templates and host template pointers const 2023-03-24 19:20:00 -04:00
isp1760 usb: isp1760: Convert to platform remove callback returning void 2023-05-28 12:38:01 +01:00
misc USB: misc: Remove unused include file usb_u132.h 2023-08-08 10:36:46 +02:00
mon USB: mon: make mon_bin_class a static const structure 2023-06-20 16:20:45 +02:00
mtu3 usb: Explicitly include correct DT includes 2023-07-25 18:20:02 +02:00
musb usb: musb: Remove unused function declarations 2023-08-08 10:36:43 +02:00
phy usb: phy: mxs: disconnect line when USB charger is attached 2023-07-25 18:24:17 +02:00
renesas_usbhs usb: Explicitly include correct DT includes 2023-07-25 18:20:02 +02:00
roles USB: roles: make role_class a static const structure 2023-06-20 16:20:40 +02:00
serial USB: serial: simple: sort driver entries 2023-07-20 15:59:25 +02:00
storage usb-storage: fix deadlock when a scsi command timeouts more than once 2023-05-13 18:53:03 +09:00
typec usb: typec: ucsi: Add debugfs for ucsi commands 2023-08-08 10:36:18 +02:00
usbip USB: usbip: Remove an unnecessary goto 2023-08-08 10:36:51 +02:00
Kconfig usb: move config USB_USS720 to usb's misc Kconfig 2023-03-29 10:34:08 +02:00
Makefile usb: host: u132-hcd: Delete driver 2023-03-21 14:06:11 +01:00
usb-skeleton.c usb: add usb_set_intfdata() documentation 2022-11-29 08:56:09 +01:00