From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Subject: [PATCH 4.14 47/85] uio: Fix use-after-free in uio_unregister_device()
Date: Tue, 17 Nov 2020 14:05:16 +0100 [thread overview]
Message-ID: <20201117122113.334192774@linuxfoundation.org> (raw)
In-Reply-To: <20201117122111.018425544@linuxfoundation.org>
From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
commit 092561f06702dd4fdd7fb74dd3a838f1818529b7 upstream.
Commit 8fd0e2a6df26 ("uio: free uio id after uio file node is freed")
triggered KASAN use-after-free failure at deletion of TCM-user
backstores [1].
In uio_unregister_device(), struct uio_device *idev is passed to
uio_free_minor() to refer idev->minor. However, before uio_free_minor()
call, idev is already freed by uio_device_release() during call to
device_unregister().
To avoid reference to idev->minor after idev free, keep idev->minor
value in a local variable. Also modify uio_free_minor() argument to
receive the value.
[1]
BUG: KASAN: use-after-free in uio_unregister_device+0x166/0x190
Read of size 4 at addr ffff888105196508 by task targetcli/49158
CPU: 3 PID: 49158 Comm: targetcli Not tainted 5.10.0-rc1 #1
Hardware name: Supermicro Super Server/X10SRL-F, BIOS 2.0 12/17/2015
Call Trace:
dump_stack+0xae/0xe5
? uio_unregister_device+0x166/0x190
print_address_description.constprop.0+0x1c/0x210
? uio_unregister_device+0x166/0x190
? uio_unregister_device+0x166/0x190
kasan_report.cold+0x37/0x7c
? kobject_put+0x80/0x410
? uio_unregister_device+0x166/0x190
uio_unregister_device+0x166/0x190
tcmu_destroy_device+0x1c4/0x280 [target_core_user]
? tcmu_release+0x90/0x90 [target_core_user]
? __mutex_unlock_slowpath+0xd6/0x5d0
target_free_device+0xf3/0x2e0 [target_core_mod]
config_item_cleanup+0xea/0x210
configfs_rmdir+0x651/0x860
? detach_groups.isra.0+0x380/0x380
vfs_rmdir.part.0+0xec/0x3a0
? __lookup_hash+0x20/0x150
do_rmdir+0x252/0x320
? do_file_open_root+0x420/0x420
? strncpy_from_user+0xbc/0x2f0
? getname_flags.part.0+0x8e/0x450
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f9e2bfc91fb
Code: 73 01 c3 48 8b 0d 9d ec 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 6d ec 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdd2baafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f9e2beb44a0 RCX: 00007f9e2bfc91fb
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f9e1c20be90
RBP: 00007ffdd2bab000 R08: 0000000000000000 R09: 00007f9e2bdf2440
R10: 00007ffdd2baaf37 R11: 0000000000000246 R12: 00000000ffffff9c
R13: 000055f9abb7e390 R14: 000055f9abcf9558 R15: 00007f9e2be7a780
Allocated by task 34735:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc.constprop.0+0xc2/0xd0
__uio_register_device+0xeb/0xd40
tcmu_configure_device+0x5a0/0xbc0 [target_core_user]
target_configure_device+0x12f/0x760 [target_core_mod]
target_dev_enable_store+0x32/0x50 [target_core_mod]
configfs_write_file+0x2bb/0x450
vfs_write+0x1ce/0x610
ksys_write+0xe9/0x1b0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 49158:
kasan_save_stack+0x1b/0x40
kasan_set_track+0x1c/0x30
kasan_set_free_info+0x1b/0x30
__kasan_slab_free+0x110/0x150
slab_free_freelist_hook+0x5a/0x170
kfree+0xc6/0x560
device_release+0x9b/0x210
kobject_put+0x13e/0x410
uio_unregister_device+0xf9/0x190
tcmu_destroy_device+0x1c4/0x280 [target_core_user]
target_free_device+0xf3/0x2e0 [target_core_mod]
config_item_cleanup+0xea/0x210
configfs_rmdir+0x651/0x860
vfs_rmdir.part.0+0xec/0x3a0
do_rmdir+0x252/0x320
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff888105196000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1288 bytes inside of
2048-byte region [ffff888105196000, ffff888105196800)
The buggy address belongs to the page:
page:0000000098e6ca81 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105190
head:0000000098e6ca81 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x17ffffc0010200(slab|head)
raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100043040
raw: 0000000000000000 0000000000080008 00000001ffffffff ffff88810eb55c01
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff88810eb55c01
Memory state around the buggy address:
ffff888105196400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105196480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888105196500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105196580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105196600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Fixes: 8fd0e2a6df26 ("uio: free uio id after uio file node is freed")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Link: https://lore.kernel.org/r/20201102122819.2346270-1-shinichiro.kawasaki@wdc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -414,10 +414,10 @@ static int uio_get_minor(struct uio_devi
return retval;
}
-static void uio_free_minor(struct uio_device *idev)
+static void uio_free_minor(unsigned long minor)
{
mutex_lock(&minor_lock);
- idr_remove(&uio_idr, idev->minor);
+ idr_remove(&uio_idr, minor);
mutex_unlock(&minor_lock);
}
@@ -989,7 +989,7 @@ err_request_irq:
err_uio_dev_add_attributes:
device_del(&idev->dev);
err_device_create:
- uio_free_minor(idev);
+ uio_free_minor(idev->minor);
put_device(&idev->dev);
return ret;
}
@@ -1003,11 +1003,13 @@ EXPORT_SYMBOL_GPL(__uio_register_device)
void uio_unregister_device(struct uio_info *info)
{
struct uio_device *idev;
+ unsigned long minor;
if (!info || !info->uio_dev)
return;
idev = info->uio_dev;
+ minor = idev->minor;
mutex_lock(&idev->info_lock);
uio_dev_del_attributes(idev);
@@ -1020,7 +1022,7 @@ void uio_unregister_device(struct uio_in
device_unregister(&idev->dev);
- uio_free_minor(idev);
+ uio_free_minor(minor);
return;
}
next prev parent reply other threads:[~2020-11-17 13:15 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-17 13:04 [PATCH 4.14 00/85] 4.14.207-rc1 review Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 01/85] regulator: defer probe when trying to get voltage from unresolved supply Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 02/85] ring-buffer: Fix recursion protection transitions between interrupt context Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 03/85] mm: mempolicy: fix potential pte_unmap_unlock pte error Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 04/85] time: Prevent undefined behaviour in timespec64_to_ns() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 05/85] nbd: dont update block size after device is started Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 06/85] btrfs: sysfs: init devices outside of the chunk_mutex Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 07/85] btrfs: reschedule when cloning lots of extents Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 08/85] genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 09/85] hv_balloon: disable warning when floor reached Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 10/85] net: xfrm: fix a race condition during allocing spi Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 11/85] perf tools: Add missing swap for ino_generation Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 12/85] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 13/85] can: rx-offload: dont call kfree_skb() from IRQ context Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 14/85] can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard " Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 15/85] can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 16/85] can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 17/85] can: peak_usb: add range checking in decode operations Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 18/85] can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 19/85] can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 20/85] xfs: flush new eof page on truncate to avoid post-eof corruption Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 21/85] Btrfs: fix missing error return if writeback for extent buffer never started Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 22/85] ath9k_htc: Use appropriate rs_datalen type Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 23/85] usb: gadget: goku_udc: fix potential crashes in probe Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 24/85] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 25/85] gfs2: Add missing truncate_inode_pages_final for sd_aspace Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 26/85] gfs2: check for live vs. read-only file system in gfs2_fitrim Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 27/85] scsi: hpsa: Fix memory leak in hpsa_init_one() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 28/85] drm/amdgpu: perform srbm soft reset always on SDMA resume Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 29/85] mac80211: fix use of skb payload instead of header Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 30/85] mac80211: always wind down STA state Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 31/85] cfg80211: regulatory: Fix inconsistent format argument Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 32/85] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 33/85] iommu/amd: Increase interrupt remapping table limit to 512 entries Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 34/85] pinctrl: intel: Set default bias in case no particular value given Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 35/85] ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 36/85] pinctrl: aspeed: Fix GPI only function problem Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 37/85] nbd: fix a block_device refcount leak in nbd_release Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 38/85] xfs: fix flags argument to rmap lookup when converting shared file rmaps Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 39/85] xfs: fix rmap key and record comparison functions Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 40/85] xfs: fix a missing unlock on error in xfs_fs_map_blocks Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 41/85] of/address: Fix of_node memory leak in of_dma_is_coherent Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 42/85] cosa: Add missing kfree in error path of cosa_write Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 43/85] perf: Fix get_recursion_context() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 44/85] ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 45/85] ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 46/85] thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() Greg Kroah-Hartman
2020-11-17 13:05 ` Greg Kroah-Hartman [this message]
2020-11-17 13:05 ` [PATCH 4.14 48/85] usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 49/85] mei: protect mei_cl_mtu from null dereference Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 50/85] futex: Dont enable IRQs unconditionally in put_pi_state() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 51/85] ocfs2: initialize ip_next_orphan Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 52/85] selinux: Fix error return code in sel_ib_pkey_sid_slow() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 53/85] dont dump the threads that had been already exiting when zapped Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 54/85] drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 55/85] pinctrl: amd: use higher precision for 512 RtcClk Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 56/85] pinctrl: amd: fix incorrect way to disable debounce filter Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 57/85] swiotlb: fix "x86: Dont panic if can not alloc buffer for swiotlb" Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 58/85] IPv6: Set SIT tunnel hard_header_len to zero Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 59/85] net/af_iucv: fix null pointer dereference on shutdown Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 60/85] net/x25: Fix null-ptr-deref in x25_connect Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 61/85] vrf: Fix fast path output packet handling with async Netfilter rules Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 62/85] r8169: fix potential skb double free in an error path Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 63/85] net: Update window_clamp if SOCK_RCVBUF is set Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 64/85] random32: make prandom_u32() output unpredictable Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 65/85] x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 66/85] perf/core: Fix bad use of igrab() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 67/85] perf/core: Fix crash when using HW tracing kernel filters Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 68/85] perf/core: Fix a memory leak in perf_event_parse_addr_filter() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 69/85] xen/events: avoid removing an event channel while handling it Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 70/85] xen/events: add a proper barrier to 2-level uevent unmasking Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 71/85] xen/events: fix race in evtchn_fifo_unmask() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 72/85] xen/events: add a new "late EOI" evtchn framework Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 73/85] xen/blkback: use lateeoi irq binding Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 74/85] xen/netback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 75/85] xen/scsiback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 76/85] xen/pvcallsback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 77/85] xen/pciback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 78/85] xen/events: switch user event channels to lateeoi model Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 79/85] xen/events: use a common cpu hotplug hook for event channels Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 80/85] xen/events: defer eoi in case of excessive number of events Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 81/85] xen/events: block rogue events for some time Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 82/85] perf/core: Fix race in the perf_mmap_close() function Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 83/85] Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 84/85] reboot: fix overflow parsing reboot cpu number Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 85/85] Convert trailing spaces and periods in path components Greg Kroah-Hartman
2020-11-18 8:34 ` [PATCH 4.14 00/85] 4.14.207-rc1 review Naresh Kamboju
2020-11-18 15:22 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201117122113.334192774@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=shinichiro.kawasaki@wdc.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox