From: Oliver Neukum <oneukum@suse.de>
To: Mathy Vanhoef <vanhoefm@gmail.com>
Cc: brudley@broadcom.com, Arend van Spriel <arend@broadcom.com>,
Franky Lin <frankyl@broadcom.com>,
meuleman@broadcom.com, John Linville <linville@tuxdriver.com>,
pieterpg@broadcom.com, linux-wireless@vger.kernel.org,
brcm80211-dev-list@broadcom.com, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] brcmfmac: unlink URB when request timed out
Date: Wed, 12 Nov 2014 08:00:44 +0100 [thread overview]
Message-ID: <1415775644.1761.1.camel@linux-0dmf.site> (raw)
In-Reply-To: <5462B1A3.9020401@gmail.com>
On Tue, 2014-11-11 at 20:02 -0500, Mathy Vanhoef wrote:
> On 11/10/2014 04:08 AM, Oliver Neukum wrote:
> > Which means that you are freeing memory that may still be used by DMA
> > at this time.
> > In addition you have no guarantee that the unlink is indeed finished
> > by the time the URB is reused.
> > If you wish to take this approach you better forget about this URB
> > and allocate a new one and free the buffer from the callback.
>
> Hi Oliver,
>
> Good catch. I think the DMA issue is also present in the current driver: it
> frees the buffer without unlinking/killing the URB at all. Can a malicious USB
Yes, it is present.
> device force a timeout to occur (i.e. delay the call to the completion
> handler)? If so this might be a use-after-free vulnerability.
>
> It seems using usb_kill_urb instead of usb_unlink_urb in the patch prevents any
> possible use-after-free. Can someone double check?
usb_kill_urb() will do the job.
Regards
Oliver
WARNING: multiple messages have this Message-ID (diff)
From: Oliver Neukum <oneukum-l3A5Bk7waGM@public.gmane.org>
To: Mathy Vanhoef <vanhoefm-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Cc: brudley-dY08KVG/lbpWk0Htik3J/w@public.gmane.org,
Arend van Spriel <arend-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>,
Franky Lin <frankyl-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>,
meuleman-dY08KVG/lbpWk0Htik3J/w@public.gmane.org,
John Linville <linville-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org>,
pieterpg-dY08KVG/lbpWk0Htik3J/w@public.gmane.org,
linux-wireless-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
brcm80211-dev-list-dY08KVG/lbpWk0Htik3J/w@public.gmane.org,
netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH] brcmfmac: unlink URB when request timed out
Date: Wed, 12 Nov 2014 08:00:44 +0100 [thread overview]
Message-ID: <1415775644.1761.1.camel@linux-0dmf.site> (raw)
In-Reply-To: <5462B1A3.9020401-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
On Tue, 2014-11-11 at 20:02 -0500, Mathy Vanhoef wrote:
> On 11/10/2014 04:08 AM, Oliver Neukum wrote:
> > Which means that you are freeing memory that may still be used by DMA
> > at this time.
> > In addition you have no guarantee that the unlink is indeed finished
> > by the time the URB is reused.
> > If you wish to take this approach you better forget about this URB
> > and allocate a new one and free the buffer from the callback.
>
> Hi Oliver,
>
> Good catch. I think the DMA issue is also present in the current driver: it
> frees the buffer without unlinking/killing the URB at all. Can a malicious USB
Yes, it is present.
> device force a timeout to occur (i.e. delay the call to the completion
> handler)? If so this might be a use-after-free vulnerability.
>
> It seems using usb_kill_urb instead of usb_unlink_urb in the patch prevents any
> possible use-after-free. Can someone double check?
usb_kill_urb() will do the job.
Regards
Oliver
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2014-11-12 7:00 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-09 18:10 [PATCH] brcmfmac: unlink URB when request timed out Mathy Vanhoef
2014-11-09 18:10 ` Mathy Vanhoef
2014-11-10 9:08 ` Oliver Neukum
2014-11-12 1:02 ` Mathy Vanhoef
2014-11-12 7:00 ` Oliver Neukum [this message]
2014-11-12 7:00 ` Oliver Neukum
2014-11-10 11:18 ` Arend van Spriel
2014-11-10 16:08 ` Mathy Vanhoef
2014-11-10 18:03 ` Arend van Spriel
2014-11-11 11:05 ` Arend van Spriel
2014-11-11 17:35 ` Mathy Vanhoef
2014-11-11 18:00 ` Arend van Spriel
2014-11-11 18:00 ` Arend van Spriel
2014-11-12 0:40 ` Mathy Vanhoef
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1415775644.1761.1.camel@linux-0dmf.site \
--to=oneukum@suse.de \
--cc=arend@broadcom.com \
--cc=brcm80211-dev-list@broadcom.com \
--cc=brudley@broadcom.com \
--cc=frankyl@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=meuleman@broadcom.com \
--cc=netdev@vger.kernel.org \
--cc=pieterpg@broadcom.com \
--cc=vanhoefm@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.