From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, William Wu <william.wu@rock-chips.com>,
Felipe Balbi <felipe.balbi@linux.intel.com>,
Jerry Zhang <zhangjerry@google.com>
Subject: [PATCH 4.4 22/26] usb: gadget: f_fs: avoid out of bounds access on comp_desc
Date: Tue, 27 Jun 2017 14:49:59 +0200 [thread overview]
Message-ID: <20170627124532.031635904@linuxfoundation.org> (raw)
In-Reply-To: <20170627124528.581163327@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
commit b7f73850bb4fac1e2209a4dd5e636d39be92f42c upstream.
Companion descriptor is only used for SuperSpeed endpoints,
if the endpoints are HighSpeed or FullSpeed, the Companion
descriptor will not allocated, so we can only access it if
gadget is SuperSpeed.
I can reproduce this issue on Rockchip platform rk3368 SoC
which supports USB 2.0, and use functionfs for ADB. Kernel
build with CONFIG_KASAN=y and CONFIG_SLUB_DEBUG=y report
the following BUG:
==================================================================
BUG: KASAN: slab-out-of-bounds in ffs_func_set_alt+0x224/0x3a0 at addr ffffffc0601f6509
Read of size 1 by task swapper/0/0
============================================================================
BUG kmalloc-256 (Not tainted): kasan: bad access detected
----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in ffs_func_bind+0x52c/0x99c age=1275 cpu=0 pid=1
alloc_debug_processing+0x128/0x17c
___slab_alloc.constprop.58+0x50c/0x610
__slab_alloc.isra.55.constprop.57+0x24/0x34
__kmalloc+0xe0/0x250
ffs_func_bind+0x52c/0x99c
usb_add_function+0xd8/0x1d4
configfs_composite_bind+0x48c/0x570
udc_bind_to_driver+0x6c/0x170
usb_udc_attach_driver+0xa4/0xd0
gadget_dev_desc_UDC_store+0xcc/0x118
configfs_write_file+0x1a0/0x1f8
__vfs_write+0x64/0x174
vfs_write+0xe4/0x200
SyS_write+0x68/0xc8
el0_svc_naked+0x24/0x28
INFO: Freed in inode_doinit_with_dentry+0x3f0/0x7c4 age=1275 cpu=7 pid=247
...
Call trace:
[<ffffff900808aab4>] dump_backtrace+0x0/0x230
[<ffffff900808acf8>] show_stack+0x14/0x1c
[<ffffff90084ad420>] dump_stack+0xa0/0xc8
[<ffffff90082157cc>] print_trailer+0x188/0x198
[<ffffff9008215948>] object_err+0x3c/0x4c
[<ffffff900821b5ac>] kasan_report+0x324/0x4dc
[<ffffff900821aa38>] __asan_load1+0x24/0x50
[<ffffff90089eb750>] ffs_func_set_alt+0x224/0x3a0
[<ffffff90089d3760>] composite_setup+0xdcc/0x1ac8
[<ffffff90089d7394>] android_setup+0x124/0x1a0
[<ffffff90089acd18>] _setup+0x54/0x74
[<ffffff90089b6b98>] handle_ep0+0x3288/0x4390
[<ffffff90089b9b44>] dwc_otg_pcd_handle_out_ep_intr+0x14dc/0x2ae4
[<ffffff90089be85c>] dwc_otg_pcd_handle_intr+0x1ec/0x298
[<ffffff90089ad680>] dwc_otg_pcd_irq+0x10/0x20
[<ffffff9008116328>] handle_irq_event_percpu+0x124/0x3ac
[<ffffff9008116610>] handle_irq_event+0x60/0xa0
[<ffffff900811af30>] handle_fasteoi_irq+0x10c/0x1d4
[<ffffff9008115568>] generic_handle_irq+0x30/0x40
[<ffffff90081159b4>] __handle_domain_irq+0xac/0xdc
[<ffffff9008080e9c>] gic_handle_irq+0x64/0xa4
...
Memory state around the buggy address:
ffffffc0601f6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffc0601f6480: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc
>ffffffc0601f6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffffffc0601f6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffffc0601f6600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================
Signed-off-by: William Wu <william.wu@rock-chips.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: Jerry Zhang <zhangjerry@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1668,12 +1668,12 @@ static int ffs_func_eps_enable(struct ff
ep->ep->driver_data = ep;
ep->ep->desc = ds;
- comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
- USB_DT_ENDPOINT_SIZE);
- ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-
- if (needs_comp_desc)
+ if (needs_comp_desc) {
+ comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+ USB_DT_ENDPOINT_SIZE);
+ ep->ep->maxburst = comp_desc->bMaxBurst + 1;
ep->ep->comp_desc = comp_desc;
+ }
ret = usb_ep_enable(ep->ep);
if (likely(!ret)) {
next prev parent reply other threads:[~2017-06-27 12:55 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-27 12:49 [PATCH 4.4 00/26] 4.4.75-stable review Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 01/26] fs/exec.c: account for argv/envp pointers Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 02/26] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 03/26] lib/cmdline.c: fix get_options() overflow while parsing ranges Greg Kroah-Hartman
2017-06-29 18:24 ` Ben Hutchings
2017-09-27 10:36 ` Ilya Matveychikov
2017-06-27 12:49 ` [PATCH 4.4 04/26] KVM: PPC: Book3S HV: Preserve userspace HTM state properly Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 05/26] CIFS: Improve readdir verbosity Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 06/26] HID: Add quirk for Dell PIXART OEM mouse Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 07/26] signal: Only reschedule timers on signals timers have sent Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 08/26] powerpc/kprobes: Pause function_graph tracing during jprobes handling Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 09/26] Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 10/26] time: Fix clock->read(clock) race around clocksource changes Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 11/26] target: Fix kref->refcount underflow in transport_cmd_finish_abort Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 12/26] iscsi-target: Reject immediate data underflow larger than SCSI transfer length Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 13/26] drm/radeon: add a PX quirk for another K53TK variant Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 14/26] drm/radeon: add a quirk for Toshiba Satellite L20-183 Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 17/26] USB: usbip: fix nonconforming hub descriptor Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 19/26] of: Add check to of_scan_flat_dt() before accessing initial_boot_params Greg Kroah-Hartman
2017-06-27 12:49 ` [PATCH 4.4 21/26] powerpc/slb: Force a full SLB flush when we insert for a bad EA Greg Kroah-Hartman
2017-06-27 12:49 ` Greg Kroah-Hartman [this message]
2017-06-27 12:50 ` [PATCH 4.4 23/26] net: phy: Initialize mdio clock at probe function Greg Kroah-Hartman
2017-06-27 12:50 ` [PATCH 4.4 24/26] net: phy: fix marvell phy status reading Greg Kroah-Hartman
2017-06-27 12:50 ` [PATCH 4.4 25/26] nvme/quirk: Add a delay before checking for adapter readiness Greg Kroah-Hartman
2017-06-27 12:50 ` [PATCH 4.4 26/26] nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too Greg Kroah-Hartman
2017-06-27 19:02 ` [PATCH 4.4 00/26] 4.4.75-stable review Guenter Roeck
2017-06-28 13:52 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170627124532.031635904@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=felipe.balbi@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=william.wu@rock-chips.com \
--cc=zhangjerry@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox