From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933287AbcKOUg4 (ORCPT ); Tue, 15 Nov 2016 15:36:56 -0500 Received: from bh-25.webhostbox.net ([208.91.199.152]:41737 "EHLO bh-25.webhostbox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932333AbcKOUgw (ORCPT ); Tue, 15 Nov 2016 15:36:52 -0500 From: Guenter Roeck To: Mathias Nyman Cc: Greg Kroah-Hartman , dianders@chromium.org, briannorris@chromium.org, mka@chromium.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck Subject: [RFC PATCH] xhci: Fix memory use after free in xhci_free_virt_device Date: Tue, 15 Nov 2016 12:36:39 -0800 Message-Id: <1479242199-3241-1-git-send-email-linux@roeck-us.net> X-Mailer: git-send-email 2.5.0 X-Authenticated_sender: guenter@roeck-us.net X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - bh-25.webhostbox.net X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - roeck-us.net X-Get-Message-Sender-Via: bh-25.webhostbox.net: authenticated_id: guenter@roeck-us.net X-Authenticated-Sender: bh-25.webhostbox.net: guenter@roeck-us.net X-Source: X-Source-Args: X-Source-Dir: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following use-after-free reports were seen on resume with a specific USB hub. BUG: KASAN: use-after-free in xhci_free_virt_device+0x8c/0x21c at addr ffffffc0cc1a2eb0 BUG: KASAN: use-after-free in xhci_update_tt_active_eps+0x9c/0xdc at addr ffffffc0cc1a2eb0 Relevant traceback for the first case is: xhci_free_virt_device+0x8c/0x21c xhci_mem_cleanup+0x294/0x81c xhci_resume+0x410/0x618 xhci_plat_resume+0x54/0x74 platform_pm_resume+0x74/0x84 which points to the following code in xhci_free_virt_device(). if (dev->tt_info) old_active_eps = dev->tt_info->active_eps; Problem with this code is that xhci_mem_cleanup() cleans up devices starting with slot 1, and dev->tt_info for a device with higher slot number can point back to the tt_info associated with device 1. In lsusb, this looks as follows. /: Bus 05.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 480M |__ Port 1: Dev 4, If 0, Class=Hub, Driver=hub/4p, 480M |__ Port 3: Dev 7, If 0, Class=Vendor Specific Class, Driver=, 12M When the higher-numbered device is cleared, it tries to access the already released tt_info from slot 1 to get the value of old_active_eps. The problem is not seen with all USB hubs since not all USB hubs require the cleanup handling in xhci_resume(). Signed-off-by: Guenter Roeck --- Marked as RFC because I don't really like this fix at all and would prefer a different solution. It might be possible, for example, to change the code in xhci_mem_cleanup() from for (i = 1; i < MAX_HC_SLOTS; ++i) xhci_free_virt_device(xhci, i); to for (i = MAX_HC_SLOTS - 1; i >= 1; i--) xhci_free_virt_device(xhci, i); if it is guaranteed that tt_info never points to a device with higher slot number. drivers/usb/host/xhci-mem.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 6afe32381209..97a61c57a2ed 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -873,8 +873,14 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci, list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) { /* Multi-TT hubs will have more than one entry */ if (tt_info->slot_id == slot_id) { + int i; + slot_found = true; list_del(&tt_info->tt_list); + for (i = 0; i < MAX_HC_SLOTS; i++) + if (xhci->devs[i] && + xhci->devs[i]->tt_info == tt_info) + xhci->devs[i]->tt_info = NULL; kfree(tt_info); } else if (slot_found) { break; -- 2.5.0