From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Sean Young <sean@mess.org>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Subject: [PATCH 4.14 06/59] media: tm6000: double free if usb disconnect while streaming
Date: Fri, 20 Sep 2019 00:03:21 +0200 [thread overview]
Message-ID: <20190919214757.686584149@linuxfoundation.org> (raw)
In-Reply-To: <20190919214755.852282682@linuxfoundation.org>
From: Sean Young <sean@mess.org>
commit 699bf94114151aae4dceb2d9dbf1a6312839dcae upstream.
The usb_bulk_urb will kfree'd on disconnect, so ensure the pointer is set
to NULL after each free.
stop stream
urb killing
urb buffer free
tm6000: got start feed request tm6000_start_feed
tm6000: got start stream request tm6000_start_stream
tm6000: pipe reset
tm6000: got start feed request tm6000_start_feed
tm6000: got start feed request tm6000_start_feed
tm6000: got start feed request tm6000_start_feed
tm6000: got start feed request tm6000_start_feed
tm6000: IR URB failure: status: -71, length 0
xhci_hcd 0000:00:14.0: ERROR unknown event type 37
xhci_hcd 0000:00:14.0: ERROR unknown event type 37
tm6000: error tm6000_urb_received
usb 1-2: USB disconnect, device number 5
tm6000: disconnecting tm6000 #0
==================================================================
BUG: KASAN: use-after-free in dvb_fini+0x75/0x140 [tm6000_dvb]
Read of size 8 at addr ffff888241044060 by task kworker/2:0/22
CPU: 2 PID: 22 Comm: kworker/2:0 Tainted: G W 5.3.0-rc4+ #1
Hardware name: LENOVO 20KHCTO1WW/20KHCTO1WW, BIOS N23ET65W (1.40 ) 07/02/2019
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack+0x9a/0xf0
print_address_description.cold+0xae/0x34f
__kasan_report.cold+0x75/0x93
? tm6000_fillbuf+0x390/0x3c0 [tm6000_alsa]
? dvb_fini+0x75/0x140 [tm6000_dvb]
kasan_report+0xe/0x12
dvb_fini+0x75/0x140 [tm6000_dvb]
tm6000_close_extension+0x51/0x80 [tm6000]
tm6000_usb_disconnect.cold+0xd4/0x105 [tm6000]
usb_unbind_interface+0xe4/0x390
device_release_driver_internal+0x121/0x250
bus_remove_device+0x197/0x260
device_del+0x268/0x550
? __device_links_no_driver+0xd0/0xd0
? usb_remove_ep_devs+0x30/0x3b
usb_disable_device+0x122/0x400
usb_disconnect+0x153/0x430
hub_event+0x800/0x1e40
? trace_hardirqs_on_thunk+0x1a/0x20
? hub_port_debounce+0x1f0/0x1f0
? retint_kernel+0x10/0x10
? lock_is_held_type+0xf1/0x130
? hub_port_debounce+0x1f0/0x1f0
? process_one_work+0x4ae/0xa00
process_one_work+0x4ba/0xa00
? pwq_dec_nr_in_flight+0x160/0x160
? do_raw_spin_lock+0x10a/0x1d0
worker_thread+0x7a/0x5c0
? process_one_work+0xa00/0xa00
kthread+0x1d5/0x200
? kthread_create_worker_on_cpu+0xd0/0xd0
ret_from_fork+0x3a/0x50
Allocated by task 2682:
save_stack+0x1b/0x80
__kasan_kmalloc.constprop.0+0xc2/0xd0
usb_alloc_urb+0x28/0x60
tm6000_start_feed+0x10a/0x300 [tm6000_dvb]
dmx_ts_feed_start_filtering+0x86/0x120 [dvb_core]
dvb_dmxdev_start_feed+0x121/0x180 [dvb_core]
dvb_dmxdev_filter_start+0xcb/0x540 [dvb_core]
dvb_demux_do_ioctl+0x7ed/0x890 [dvb_core]
dvb_usercopy+0x97/0x1f0 [dvb_core]
dvb_demux_ioctl+0x11/0x20 [dvb_core]
do_vfs_ioctl+0x5d8/0x9d0
ksys_ioctl+0x5e/0x90
__x64_sys_ioctl+0x3d/0x50
do_syscall_64+0x74/0xe0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 22:
save_stack+0x1b/0x80
__kasan_slab_free+0x12c/0x170
kfree+0xfd/0x3a0
xhci_giveback_urb_in_irq+0xfe/0x230
xhci_td_cleanup+0x276/0x340
xhci_irq+0x1129/0x3720
__handle_irq_event_percpu+0x6e/0x420
handle_irq_event_percpu+0x6f/0x100
handle_irq_event+0x55/0x84
handle_edge_irq+0x108/0x3b0
handle_irq+0x2e/0x40
do_IRQ+0x83/0x1a0
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/tm6000/tm6000-dvb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/usb/tm6000/tm6000-dvb.c
+++ b/drivers/media/usb/tm6000/tm6000-dvb.c
@@ -105,6 +105,7 @@ static void tm6000_urb_received(struct u
printk(KERN_ERR "tm6000: error %s\n", __func__);
kfree(urb->transfer_buffer);
usb_free_urb(urb);
+ dev->dvb->bulk_urb = NULL;
}
}
}
@@ -135,6 +136,7 @@ static int tm6000_start_stream(struct tm
dvb->bulk_urb->transfer_buffer = kzalloc(size, GFP_KERNEL);
if (dvb->bulk_urb->transfer_buffer == NULL) {
usb_free_urb(dvb->bulk_urb);
+ dvb->bulk_urb = NULL;
printk(KERN_ERR "tm6000: couldn't allocate transfer buffer!\n");
return -ENOMEM;
}
@@ -162,6 +164,7 @@ static int tm6000_start_stream(struct tm
kfree(dvb->bulk_urb->transfer_buffer);
usb_free_urb(dvb->bulk_urb);
+ dvb->bulk_urb = NULL;
return ret;
}
next prev parent reply other threads:[~2019-09-19 22:16 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-19 22:03 [PATCH 4.14 00/59] 4.14.146-stable review Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 01/59] HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 02/59] Input: elan_i2c - remove Lenovo Legion Y7000 PnpID Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 03/59] powerpc/mm/radix: Use the right page size for vmemmap mapping Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 04/59] USB: usbcore: Fix slab-out-of-bounds bug during device reset Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 05/59] phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current Greg Kroah-Hartman
2019-09-19 22:03 ` Greg Kroah-Hartman [this message]
2019-09-19 22:03 ` [PATCH 4.14 07/59] xen-netfront: do not assume sk_buff_head list is empty in error handling Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 08/59] net_sched: let qdisc_put() accept NULL pointer Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 09/59] KVM: coalesced_mmio: add bounds checking Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 10/59] firmware: google: check if size is valid when decoding VPD data Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 11/59] serial: sprd: correct the wrong sequence of arguments Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 12/59] tty/serial: atmel: reschedule TX after RX was started Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 13/59] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 14/59] nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 15/59] ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 16/59] s390/bpf: fix lcgr instruction encoding Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 17/59] ARM: OMAP2+: Fix omap4 errata warning on other SoCs Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 18/59] ARM: dts: dra74x: Fix iodelay configuration for mmc3 Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 19/59] s390/bpf: use 32-bit index for tail calls Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 20/59] fpga: altera-ps-spi: Fix getting of optional confd gpio Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 21/59] netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 22/59] NFSv4: Fix return values for nfs4_file_open() Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 23/59] NFSv4: Fix return value in nfs_finish_open() Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 24/59] NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 25/59] Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105 Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 26/59] qed: Add cleanup in qed_slowpath_start() Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 27/59] ARM: 8874/1: mm: only adjust sections of valid mm structures Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 28/59] batman-adv: Only read OGM2 tvlv_len after buffer len check Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 29/59] r8152: Set memory to all 0xFFs on failed reg reads Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 30/59] x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 31/59] netfilter: nf_conntrack_ftp: Fix debug output Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 32/59] NFSv2: Fix eof handling Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 33/59] NFSv2: Fix write regression Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 34/59] kallsyms: Dont let kallsyms_lookup_size_offset() fail on retrieving the first symbol Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 35/59] cifs: set domainName when a domain-key is used in multiuser Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 36/59] cifs: Use kzfree() to zero out the password Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 37/59] ARM: 8901/1: add a criteria for pfn_valid of arm Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 38/59] sky2: Disable MSI on yet another ASUS boards (P6Xxxx) Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 39/59] i2c: designware: Synchronize IRQs when unregistering slave client Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 40/59] perf/x86/intel: Restrict period on Nehalem Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 41/59] perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 42/59] amd-xgbe: Fix error path in xgbe_mod_init() Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 43/59] tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2 Greg Kroah-Hartman
2019-09-19 22:03 ` [PATCH 4.14 44/59] tools/power x86_energy_perf_policy: Fix argument parsing Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 45/59] tools/power turbostat: fix buffer overrun Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 46/59] net: seeq: Fix the function used to release some memory in an error handling path Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 47/59] dmaengine: ti: dma-crossbar: Fix a memory leak bug Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 48/59] dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 49/59] x86/uaccess: Dont leak the AC flags into __get_user() argument evaluation Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 50/59] x86/hyper-v: Fix overflow bug in fill_gva_list() Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 51/59] keys: Fix missing null pointer check in request_key_auth_describe() Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 52/59] iommu/amd: Flush old domains in kdump kernel Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 53/59] iommu/amd: Fix race in increase_address_space() Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 54/59] PCI: kirin: Fix section mismatch warning Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 55/59] floppy: fix usercopy direction Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 56/59] binfmt_elf: move brk out of mmap when doing direct loader exec Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 57/59] tcp: Reset send_head when removing skb from write-queue Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 58/59] tcp: Dont dequeue SYN/FIN-segments " Greg Kroah-Hartman
2019-09-19 22:04 ` [PATCH 4.14 59/59] media: technisat-usb2: break out of loop at end of buffer Greg Kroah-Hartman
2019-09-20 3:19 ` [PATCH 4.14 00/59] 4.14.146-stable review kernelci.org bot
2019-09-20 8:47 ` Naresh Kamboju
2019-09-20 13:48 ` Jon Hunter
2019-09-20 13:48 ` Jon Hunter
2019-09-20 18:36 ` Guenter Roeck
2019-09-20 21:22 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190919214757.686584149@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=sean@mess.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.