From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4224DC433FE for ; Sun, 8 May 2022 14:35:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233835AbiEHOit (ORCPT ); Sun, 8 May 2022 10:38:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51860 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230012AbiEHOis (ORCPT ); Sun, 8 May 2022 10:38:48 -0400 Received: from netrider.rowland.org (netrider.rowland.org [192.131.102.5]) by lindbergh.monkeyblade.net (Postfix) with SMTP id 027C8DFFD for ; Sun, 8 May 2022 07:34:57 -0700 (PDT) Received: (qmail 98159 invoked by uid 1000); 8 May 2022 10:34:57 -0400 Date: Sun, 8 May 2022 10:34:57 -0400 From: Alan Stern To: Schspa Shi Cc: Julia.Lawall@inria.fr, andreyknvl@gmail.com, balbi@kernel.org, gregkh@linuxfoundation.org, jannh@google.com, jj251510319013@gmail.com, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, syzbot+dc7c3ca638e773db07f6@syzkaller.appspotmail.com Subject: Re: [PATCH v2] usb: gadget: fix race when gadget driver register via ioctl Message-ID: References: <20220507160243.35304-1-schspa@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org On Sun, May 08, 2022 at 12:08:35PM +0800, Schspa Shi wrote: > Alan Stern writes: > > > > Are you sure that this patch will fix the problem found by syzbot? That > > is, are you sure that the problem really was caused by two threads > > registering the same driver concurrently? > > > > Yes, from the console log from syzbot. > T8324 alloced driver_private was released by T8326. That is a smoking gun. > > The fact that the error was "use after free" suggests that the problem > > might be something else. It looks like one of the threads was trying to > > access the driver structure after the other thread had done something > > that caused it to be deallocated, which suggests an error in reference > > counting. > > > > The direct cause of this place is because of the refcount error, but the > root cause is still caused by multiple registrations > > Please refer to the following scenarios. > > T1 T2 > ------------------------------------------------------------------ > usb_gadget_register_driver_owner > driver_register driver_register > driver_find driver_find > bus_add_driver bus_add_driver > priv alloced > drv->p = priv; > > kobject_init_and_add // refcount = 1; > //couldn't find an available UDC or it's busy > > priv alloced > drv->priv = priv; > kobject_init_and_add > ---> refcount = 1 <------ > // register success > > ===================== another ioctl/process ====================== > driver_register > driver_find > k = kset_find_obj() > ---> refcount = 2 <------ > > driver_unregister > // drv->p become T2's priv > ---> refcount = 1 <------ > > kobject_put(k) > ---> refcount = 0 <------ > return priv->driver; > --------UAF here---------- It looks like you've got T2 calling driver_register and driver_find twice, but the overall idea is pretty clear. > There will be UAF in this scenario. > And all the logs reported by syzbot can be matched to this scenario. And in any case it is obvious that the patch is necessary. (Although I would have put the new state before the RUNNING state, to reflect the actual order in which the states occur.) Acked-by: Alan Stern Alan Stern