From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Brian Norris <briannorris@chromium.org>,
Kalle Valo <kvalo@codeaurora.org>
Subject: [PATCH 3.18 09/59] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
Date: Tue, 23 May 2017 22:09:37 +0200 [thread overview]
Message-ID: <20170523200849.880454161@linuxfoundation.org> (raw)
In-Reply-To: <20170523200849.241966497@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
commit 3c8cb9ad032d737b874e402c59eb51e3c991a144 upstream.
Command buffers (skb's) are allocated by the main driver, and freed upon
the last use. That last use is often in mwifiex_free_cmd_buffer(). In
the meantime, if the command buffer gets used by the PCI driver, we map
it as DMA-able, and store the mapping information in the 'cb' memory.
However, if a command was in-flight when resetting the device (and
therefore was still mapped), we don't get a chance to unmap this memory
until after the core has cleaned up its command handling.
Let's keep a refcount within the PCI driver, so we ensure the memory
only gets freed after we've finished unmapping it.
Noticed by KASAN when forcing a reset via:
echo 1 > /sys/bus/pci/.../reset
The same code path can presumably be exercised in remove() and
shutdown().
[ 205.390377] mwifiex_pcie 0000:01:00.0: info: shutdown mwifiex...
[ 205.400393] ==================================================================
[ 205.407719] BUG: KASAN: use-after-free in mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] at addr ffffffc0ad471b28
[ 205.419040] Read of size 16 by task bash/1913
[ 205.423421] =============================================================================
[ 205.431625] BUG skbuff_head_cache (Tainted: G B ): kasan: bad access detected
[ 205.439815] -----------------------------------------------------------------------------
[ 205.439815]
[ 205.449534] INFO: Allocated in __build_skb+0x48/0x114 age=1311 cpu=4 pid=1913
[ 205.456709] alloc_debug_processing+0x124/0x178
[ 205.461282] ___slab_alloc.constprop.58+0x528/0x608
[ 205.466196] __slab_alloc.isra.54.constprop.57+0x44/0x54
[ 205.471542] kmem_cache_alloc+0xcc/0x278
[ 205.475497] __build_skb+0x48/0x114
[ 205.479019] __netdev_alloc_skb+0xe0/0x170
[ 205.483244] mwifiex_alloc_cmd_buffer+0x68/0xdc [mwifiex]
[ 205.488759] mwifiex_init_fw+0x40/0x6cc [mwifiex]
[ 205.493584] _mwifiex_fw_dpc+0x158/0x520 [mwifiex]
[ 205.498491] mwifiex_reinit_sw+0x2c4/0x398 [mwifiex]
[ 205.503510] mwifiex_pcie_reset_notify+0x114/0x15c [mwifiex_pcie]
[ 205.509643] pci_reset_notify+0x5c/0x6c
[ 205.513519] pci_reset_function+0x6c/0x7c
[ 205.517567] reset_store+0x68/0x98
[ 205.521003] dev_attr_store+0x54/0x60
[ 205.524705] sysfs_kf_write+0x9c/0xb0
[ 205.528413] INFO: Freed in __kfree_skb+0xb0/0xbc age=131 cpu=4 pid=1913
[ 205.535064] free_debug_processing+0x264/0x370
[ 205.539550] __slab_free+0x84/0x40c
[ 205.543075] kmem_cache_free+0x1c8/0x2a0
[ 205.547030] __kfree_skb+0xb0/0xbc
[ 205.550465] consume_skb+0x164/0x178
[ 205.554079] __dev_kfree_skb_any+0x58/0x64
[ 205.558304] mwifiex_free_cmd_buffer+0xa0/0x158 [mwifiex]
[ 205.563817] mwifiex_shutdown_drv+0x578/0x5c4 [mwifiex]
[ 205.569164] mwifiex_shutdown_sw+0x178/0x310 [mwifiex]
[ 205.574353] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie]
[ 205.580398] pci_reset_notify+0x5c/0x6c
[ 205.584274] pci_dev_save_and_disable+0x24/0x6c
[ 205.588837] pci_reset_function+0x30/0x7c
[ 205.592885] reset_store+0x68/0x98
[ 205.596324] dev_attr_store+0x54/0x60
[ 205.600017] sysfs_kf_write+0x9c/0xb0
...
[ 205.800488] Call trace:
[ 205.802980] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190
[ 205.808415] [<ffffffc00020a96c>] show_stack+0x20/0x28
[ 205.813506] [<ffffffc0005d020c>] dump_stack+0xa4/0xcc
[ 205.818598] [<ffffffc0003be44c>] print_trailer+0x158/0x168
[ 205.824120] [<ffffffc0003be5f0>] object_err+0x4c/0x5c
[ 205.829210] [<ffffffc0003c45bc>] kasan_report+0x334/0x500
[ 205.834641] [<ffffffc0003c3994>] check_memory_region+0x20/0x14c
[ 205.840593] [<ffffffc0003c3b14>] __asan_loadN+0x14/0x1c
[ 205.845879] [<ffffffbffc46171c>] mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie]
[ 205.854282] [<ffffffbffc461864>] mwifiex_pcie_delete_cmdrsp_buf+0x94/0xa8 [mwifiex_pcie]
[ 205.862421] [<ffffffbffc462028>] mwifiex_pcie_free_buffers+0x11c/0x158 [mwifiex_pcie]
[ 205.870302] [<ffffffbffc4620d4>] mwifiex_pcie_down_dev+0x70/0x80 [mwifiex_pcie]
[ 205.877736] [<ffffffbffc1397a8>] mwifiex_shutdown_sw+0x190/0x310 [mwifiex]
[ 205.884658] [<ffffffbffc4606b4>] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie]
[ 205.892446] [<ffffffc000635f54>] pci_reset_notify+0x5c/0x6c
[ 205.898048] [<ffffffc00063a044>] pci_dev_save_and_disable+0x24/0x6c
[ 205.904350] [<ffffffc00063cf0c>] pci_reset_function+0x30/0x7c
[ 205.910134] [<ffffffc000641118>] reset_store+0x68/0x98
[ 205.915312] [<ffffffc000771588>] dev_attr_store+0x54/0x60
[ 205.920750] [<ffffffc00046f53c>] sysfs_kf_write+0x9c/0xb0
[ 205.926182] [<ffffffc00046dfb0>] kernfs_fop_write+0x184/0x1f8
[ 205.931963] [<ffffffc0003d64f4>] __vfs_write+0x6c/0x17c
[ 205.937221] [<ffffffc0003d7164>] vfs_write+0xf0/0x1c4
[ 205.942310] [<ffffffc0003d7da0>] SyS_write+0x78/0xd8
[ 205.947312] [<ffffffc000204634>] el0_svc_naked+0x24/0x28
...
[ 205.998268] ==================================================================
This bug has been around in different forms for a while. It was sort of
noticed in commit 955ab095c51a ("mwifiex: Do not kfree cmd buf while
unregistering PCIe"), but it just fixed the double-free, without
acknowledging the potential for use-after-free.
Fixes: fc3314609047 ("mwifiex: use pci_alloc/free_consistent APIs for PCIe")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/pcie.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -930,6 +930,7 @@ static int mwifiex_pcie_delete_cmdrsp_bu
if (card && card->cmd_buf) {
mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
PCI_DMA_TODEVICE);
+ dev_kfree_skb_any(card->cmd_buf);
}
return 0;
}
@@ -1485,6 +1486,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_ada
return -1;
card->cmd_buf = skb;
+ /*
+ * Need to keep a reference, since core driver might free up this
+ * buffer before we've unmapped it.
+ */
+ skb_get(skb);
/* To send a command, the driver will:
1. Write the 64bit physical address of the data buffer to
@@ -1581,6 +1587,7 @@ static int mwifiex_pcie_process_cmd_comp
if (card->cmd_buf) {
mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
PCI_DMA_TODEVICE);
+ dev_kfree_skb_any(card->cmd_buf);
card->cmd_buf = NULL;
}
next prev parent reply other threads:[~2017-05-23 21:01 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-23 20:09 [PATCH 3.18 00/59] 3.18.55-stable review Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 01/59] USB: ene_usb6250: fix DMA to the stack Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 02/59] watchdog: pcwd_usb: fix NULL-deref at probe Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 03/59] char: lp: fix possible integer overflow in lp_setup() Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 04/59] USB: core: replace %p with %pK Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 05/59] dm btree: fix for dm_btree_find_lowest_key() Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 06/59] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 07/59] dm thin metadata: call precommit before saving the roots Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 08/59] dm space map disk: fix some book keeping in the disk space map Greg Kroah-Hartman
2017-05-23 20:09 ` Greg Kroah-Hartman [this message]
2017-05-23 20:09 ` [PATCH 3.18 11/59] regulator: tps65023: Fix inverted core enable logic Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 12/59] ath9k_htc: fix NULL-deref at probe Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 13/59] cdc-acm: fix possible invalid access when processing notification Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 14/59] of: fix sparse warning in of_pci_range_parser_one Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 15/59] of: fdt: add missing allocation-failure check Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 16/59] iio: dac: ad7303: fix channel description Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 17/59] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 18/59] USB: serial: ftdi_sio: fix setting latency for unprivileged users Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 19/59] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 20/59] usb: host: xhci-plat: propagate return value of platform_get_irq() Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 21/59] usb: host: xhci-mem: allocate zeroed Scratchpad Buffer Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 22/59] net: irda: irda-usb: fix firmware name on big-endian hosts Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 23/59] [media] usbvision: fix NULL-deref at probe Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 24/59] [media] mceusb: " Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 25/59] [media] ttusb2: limit messages to buffer size Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 26/59] usb: musb: tusb6010_omap: Do not reset the other directions packet size Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 27/59] USB: iowarrior: fix info ioctl on big-endian hosts Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 28/59] usb: serial: option: add Telit ME910 support Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 30/59] USB: serial: mct_u232: fix big-endian baud-rate handling Greg Kroah-Hartman
2017-05-23 20:09 ` [PATCH 3.18 31/59] USB: serial: io_ti: fix div-by-zero in set_termios Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 32/59] USB: hub: fix SS hub-descriptor handling Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 33/59] USB: hub: fix non-SS " Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman
2017-05-24 13:44 ` Alan Cox
2017-05-24 15:03 ` Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 36/59] iio: proximity: as3935: fix as3935_write Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 37/59] [media] gspca: konica: add missing endpoint sanity check Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 38/59] [media] s5p-mfc: Fix unbalanced call to clock management Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 39/59] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 40/59] [media] zr364xx: enforce minimum size when reading header Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 41/59] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 42/59] [media] cx231xx-audio: " Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 43/59] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 44/59] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 45/59] ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 46/59] arm64: uaccess: ensure extension of access_ok() addr Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 47/59] arm64: documentation: document tagged pointer stack constraints Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 48/59] xc2028: Fix use-after-free bug properly Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 49/59] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 50/59] metag/uaccess: Fix access_ok() Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 51/59] metag/uaccess: Check access_ok in strncpy_from_user Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 52/59] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 53/59] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 54/59] osf_wait4(): fix infoleak Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 55/59] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 56/59] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 58/59] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman
2017-05-23 20:10 ` [PATCH 3.18 59/59] usb: misc: legousbtower: Fix memory leak Greg Kroah-Hartman
2017-05-24 15:45 ` [PATCH 3.18 00/59] 3.18.55-stable review Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170523200849.880454161@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=briannorris@chromium.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).