From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Nick Desaulniers <nick.desaulniers@gmail.com>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Subject: [PATCH 4.14 51/89] Input: synaptics-rmi4 - prevent UAF reported by KASAN
Date: Mon, 22 Jan 2018 09:45:31 +0100 [thread overview]
Message-ID: <20180122083959.816827071@linuxfoundation.org> (raw)
In-Reply-To: <20180122083954.683903493@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Desaulniers <nick.desaulniers@gmail.com>
commit 55edde9fff1ae4114c893c572e641620c76c9c21 upstream.
KASAN found a UAF due to dangling pointer. As the report below says,
rmi_f11_attention() accesses drvdata->attn_data.data, which was freed in
rmi_irq_fn.
[ 311.424062] BUG: KASAN: use-after-free in rmi_f11_attention+0x526/0x5e0 [rmi_core]
[ 311.424067] Read of size 27 at addr ffff88041fd610db by task irq/131-i2c_hid/1162
[ 311.424075] CPU: 0 PID: 1162 Comm: irq/131-i2c_hid Not tainted 4.15.0-rc8+ #2
[ 311.424076] Hardware name: Razer Blade Stealth/Razer, BIOS 6.05 01/26/2017
[ 311.424078] Call Trace:
[ 311.424086] dump_stack+0xae/0x12d
[ 311.424090] ? _atomic_dec_and_lock+0x103/0x103
[ 311.424094] ? show_regs_print_info+0xa/0xa
[ 311.424099] ? input_handle_event+0x10b/0x810
[ 311.424104] print_address_description+0x65/0x229
[ 311.424108] kasan_report.cold.5+0xa7/0x281
[ 311.424117] rmi_f11_attention+0x526/0x5e0 [rmi_core]
[ 311.424123] ? memcpy+0x1f/0x50
[ 311.424132] ? rmi_f11_attention+0x526/0x5e0 [rmi_core]
[ 311.424143] ? rmi_f11_probe+0x1e20/0x1e20 [rmi_core]
[ 311.424153] ? rmi_process_interrupt_requests+0x220/0x2a0 [rmi_core]
[ 311.424163] ? rmi_irq_fn+0x22c/0x270 [rmi_core]
[ 311.424173] ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
[ 311.424177] ? free_irq+0xa0/0xa0
[ 311.424180] ? irq_finalize_oneshot.part.39+0xeb/0x180
[ 311.424190] ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
[ 311.424193] ? irq_thread_fn+0x3d/0x80
[ 311.424197] ? irq_finalize_oneshot.part.39+0x180/0x180
[ 311.424200] ? irq_thread+0x21d/0x290
[ 311.424203] ? irq_thread_check_affinity+0x170/0x170
[ 311.424207] ? remove_wait_queue+0x150/0x150
[ 311.424212] ? kasan_unpoison_shadow+0x30/0x40
[ 311.424214] ? __init_waitqueue_head+0xa0/0xd0
[ 311.424218] ? task_non_contending.cold.55+0x18/0x18
[ 311.424221] ? irq_forced_thread_fn+0xa0/0xa0
[ 311.424226] ? irq_thread_check_affinity+0x170/0x170
[ 311.424230] ? kthread+0x19e/0x1c0
[ 311.424233] ? kthread_create_worker_on_cpu+0xc0/0xc0
[ 311.424237] ? ret_from_fork+0x32/0x40
[ 311.424244] Allocated by task 899:
[ 311.424249] kasan_kmalloc+0xbf/0xe0
[ 311.424252] __kmalloc_track_caller+0xd9/0x1f0
[ 311.424255] kmemdup+0x17/0x40
[ 311.424264] rmi_set_attn_data+0xa4/0x1b0 [rmi_core]
[ 311.424269] rmi_raw_event+0x10b/0x1f0 [hid_rmi]
[ 311.424278] hid_input_report+0x1a8/0x2c0 [hid]
[ 311.424283] i2c_hid_irq+0x146/0x1d0 [i2c_hid]
[ 311.424286] irq_thread_fn+0x3d/0x80
[ 311.424288] irq_thread+0x21d/0x290
[ 311.424291] kthread+0x19e/0x1c0
[ 311.424293] ret_from_fork+0x32/0x40
[ 311.424296] Freed by task 1162:
[ 311.424300] kasan_slab_free+0x71/0xc0
[ 311.424303] kfree+0x90/0x190
[ 311.424311] rmi_irq_fn+0x1b2/0x270 [rmi_core]
[ 311.424319] rmi_irq_fn+0x257/0x270 [rmi_core]
[ 311.424322] irq_thread_fn+0x3d/0x80
[ 311.424324] irq_thread+0x21d/0x290
[ 311.424327] kthread+0x19e/0x1c0
[ 311.424330] ret_from_fork+0x32/0x40
[ 311.424334] The buggy address belongs to the object at ffff88041fd610c0 which belongs to the cache kmalloc-64 of size 64
[ 311.424340] The buggy address is located 27 bytes inside of 64-byte region [ffff88041fd610c0, ffff88041fd61100)
[ 311.424344] The buggy address belongs to the page:
[ 311.424348] page:ffffea00107f5840 count:1 mapcount:0 mapping: (null) index:0x0
[ 311.424353] flags: 0x17ffffc0000100(slab)
[ 311.424358] raw: 0017ffffc0000100 0000000000000000 0000000000000000 00000001802a002a
[ 311.424363] raw: dead000000000100 dead000000000200 ffff8804228036c0 0000000000000000
[ 311.424366] page dumped because: kasan: bad access detected
[ 311.424369] Memory state around the buggy address:
[ 311.424373] ffff88041fd60f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 311.424377] ffff88041fd61000: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
[ 311.424381] >ffff88041fd61080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
[ 311.424384] ^
[ 311.424387] ffff88041fd61100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
[ 311.424391] ffff88041fd61180: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
Signed-off-by: Nick Desaulniers <nick.desaulniers@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_driver.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -230,8 +230,10 @@ static irqreturn_t rmi_irq_fn(int irq, v
rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
"Failed to process interrupt request: %d\n", ret);
- if (count)
+ if (count) {
kfree(attn_data.data);
+ attn_data.data = NULL;
+ }
if (!kfifo_is_empty(&drvdata->attn_fifo))
return rmi_irq_fn(irq, dev_id);
next prev parent reply other threads:[~2018-01-22 8:53 UTC|newest]
Thread overview: 103+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-22 8:44 [PATCH 4.14 00/89] 4.14.15-stable review Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 02/89] drm/nouveau/disp/gf119: add missing drive vfunc ptr Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 03/89] objtool: Fix seg fault with clang-compiled objects Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 04/89] objtool: Fix Clang enum conversion warning Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 05/89] objtool: Fix seg fault caused by missing parameter Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 06/89] powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 07/89] powerpc/64: Add macros for annotating the destination of rfid/hrfid Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 08/89] powerpc/64s: Simple RFI macro conversions Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 09/89] powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 10/89] powerpc/64: Convert fast_exception_return " Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 11/89] powerpc/64s: Convert slb_miss_common " Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 12/89] powerpc/64s: Add support for RFI flush of L1-D cache Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 13/89] powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 14/89] powerpc/pseries: Query hypervisor for RFI flush settings Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 15/89] powerpc/powernv: Check device-tree " Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 16/89] futex: Avoid violating the 10th rule of futex Greg Kroah-Hartman
2018-01-22 9:48 ` Geert Uytterhoeven
2018-01-22 9:53 ` Greg Kroah-Hartman
2018-01-22 10:04 ` Geert Uytterhoeven
2018-01-22 8:44 ` [PATCH 4.14 17/89] futex: Prevent overflow by strengthen input validation Greg Kroah-Hartman
2018-01-25 13:45 ` Jiri Slaby
2018-01-25 14:03 ` Thomas Gleixner
2018-01-25 14:06 ` Jiri Slaby
2018-01-25 14:30 ` Thomas Gleixner
2018-01-25 14:47 ` Jiri Slaby
2018-01-25 15:12 ` Greg Kroah-Hartman
2018-01-25 15:21 ` Jiri Slaby
2018-01-25 15:30 ` Peter Zijlstra
2018-01-25 21:42 ` Darren Hart
2018-01-22 8:44 ` [PATCH 4.14 18/89] ALSA: seq: Make ioctls race-free Greg Kroah-Hartman
2018-01-22 8:44 ` [PATCH 4.14 19/89] ALSA: pcm: Remove yet superfluous WARN_ON() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 20/89] ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 21/89] ALSA: hda - Apply the existing quirk to iMac 14,1 Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 22/89] IB/hfi1: Prevent a NULL dereference Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 23/89] RDMA/mlx5: Fix out-of-bound access while querying AH Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 24/89] timers: Unconditionally check deferrable base Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 25/89] af_key: fix buffer overread in verify_address_len() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 26/89] af_key: fix buffer overread in parse_exthdrs() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 27/89] iser-target: Fix possible use-after-free in connection establishment error Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 28/89] delayacct: Account blkio completion on the correct task Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 29/89] objtool: Fix seg fault with gold linker Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 31/89] x86/kasan: Panic if there is not enough memory to boot Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 32/89] x86/retpoline: Fill RSB on context switch for affected CPUs Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 33/89] x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 34/89] objtool: Improve error message for bad file argument Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 36/89] module: Add retpoline tag to VERMAGIC Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 37/89] x86/intel_rdt/cqm: Prevent use after free Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 38/89] x86/mm/pkeys: Fix fill_sig_info_pkey Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 39/89] x86/idt: Mark IDT tables __initconst Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 40/89] x86/tsc: Future-proof native_calibrate_tsc() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 41/89] x86/tsc: Fix erroneous TSC rate on Skylake Xeon Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 42/89] pipe: avoid round_pipe_size() nr_pages overflow on 32-bit Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 43/89] x86/apic/vector: Fix off by one in error path Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 44/89] x86/mm: Clean up register saving in the __enc_copy() assembly code Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 45/89] x86/mm: Use a struct to reduce parameters for SME PGD mapping Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 46/89] x86/mm: Centralize PMD flags in sme_encrypt_kernel() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 47/89] x86/mm: Prepare sme_encrypt_kernel() for PAGE aligned encryption Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 48/89] ARM: OMAP3: hwmod_data: add missing module_offs for MMC3 Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 49/89] x86/mm: Encrypt the initrd earlier for BSP microcode update Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 50/89] Input: ALPS - fix multi-touch decoding on SS4 plus touchpads Greg Kroah-Hartman
2018-01-22 8:45 ` Greg Kroah-Hartman [this message]
2018-01-22 8:45 ` [PATCH 4.14 52/89] Input: 88pm860x-ts - fix child-node lookup Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 53/89] Input: twl6040-vibra " Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 54/89] Input: twl4030-vibra - fix sibling-node lookup Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 55/89] tracing: Fix converting enums from the map in trace_event_eval_update() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 56/89] phy: work around phys references to usb-nop-xceiv devices Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 57/89] ARM64: dts: marvell: armada-cp110: Fix clock resources for various node Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 58/89] ARM: sunxi_defconfig: Enable CMA Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 59/89] ARM: dts: kirkwood: fix pin-muxing of MPP7 on OpenBlocks A7 Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 60/89] can: peak: fix potential bug in packet fragmentation Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 61/89] can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 62/89] can: af_can: canfd_rcv(): " Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 63/89] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 64/89] scripts/gdb/linux/tasks.py: fix get_thread_info Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 65/89] proc: fix coredump vs read /proc/*/stat race Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 66/89] libata: apply MAX_SEC_1024 to all LITEON EP1 series devices Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 67/89] scsi: libsas: Disable asynchronous aborts for SATA devices Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 68/89] workqueue: avoid hard lockups in show_workqueue_state() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 69/89] drm/vmwgfx: fix memory corruption with legacy/sou connectors Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 70/89] dm btree: fix serious bug in btree_split_beneath() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 71/89] dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6 Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 72/89] dm integrity: dont store cipher request on the stack Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 73/89] dm crypt: fix crash by adding missing check for auth key size Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 74/89] dm crypt: wipe kernel key copy after IV initialization Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 75/89] dm crypt: fix error return code in crypt_ctr() Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 76/89] x86: Use __nostackprotect for sme_encrypt_kernel Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 77/89] alpha/PCI: Fix noname IRQ level detection Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 78/89] MIPS: CM: Drop WARN_ON(vp != 0) Greg Kroah-Hartman
2018-01-22 8:45 ` [PATCH 4.14 79/89] KVM: arm/arm64: Check pagesize when allocating a hugepage at Stage 2 Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 80/89] arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 81/89] x86/mce: Make machine check speculation protected Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 82/89] retpoline: Introduce start/end markers of indirect thunk Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 83/89] kprobes/x86: Blacklist indirect thunk functions for kprobes Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 84/89] kprobes/x86: Disable optimizing on the function jumps to indirect thunk Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 85/89] x86/pti: Document fix wrong index Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 86/89] x86/retpoline: Optimize inline assembler for vmexit_fill_RSB Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 87/89] x86/mm: Rework wbinvd, hlt operation in stop_this_cpu() Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 88/89] mm, page_vma_mapped: Drop faulty pointer arithmetics in check_pte() Greg Kroah-Hartman
2018-01-22 8:46 ` [PATCH 4.14 89/89] net: mvpp2: do not disable GMAC padding Greg Kroah-Hartman
2018-01-22 19:10 ` [PATCH 4.14 00/89] 4.14.15-stable review Guenter Roeck
2018-01-23 6:36 ` Greg Kroah-Hartman
2018-01-22 20:39 ` Naresh Kamboju
2018-01-22 21:00 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180122083959.816827071@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nick.desaulniers@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).