* [PATCH] usb: core: fix slab-out-of-bounds Read in read_descriptors
@ 2020-09-04 6:37 Zeng Tao
2020-09-06 3:16 ` Sasha Levin
0 siblings, 1 reply; 3+ messages in thread
From: Zeng Tao @ 2020-09-04 6:37 UTC (permalink / raw)
To: gregkh; +Cc: Zeng Tao, stable, Alan Stern, chenqiwu, linux-usb, linux-kernel
The USB device descriptor may get changed between two consecutive
enumerations on the same device for some reason, such as DFU or
malicius device.
In that case, we may access the changing descriptor if we don't take
the device lock here.
The issue is reported:
https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9
Cc: stable <stable@vger.kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
---
drivers/usb/core/sysfs.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index a2ca38e..8d13419 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -889,7 +889,11 @@ read_descriptors(struct file *filp, struct kobject *kobj,
size_t srclen, n;
int cfgno;
void *src;
+ int retval;
+ retval = usb_lock_device_interruptible(udev);
+ if (retval < 0)
+ return -EINTR;
/* The binary attribute begins with the device descriptor.
* Following that are the raw descriptor entries for all the
* configurations (config plus subsidiary descriptors).
@@ -914,6 +918,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
off -= srclen;
}
}
+ usb_unlock_device(udev);
return count - nleft;
}
--
2.8.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] usb: core: fix slab-out-of-bounds Read in read_descriptors
2020-09-04 6:37 [PATCH] usb: core: fix slab-out-of-bounds Read in read_descriptors Zeng Tao
@ 2020-09-06 3:16 ` Sasha Levin
2020-09-07 1:46 ` Zengtao (B)
0 siblings, 1 reply; 3+ messages in thread
From: Sasha Levin @ 2020-09-06 3:16 UTC (permalink / raw)
To: Sasha Levin, Zeng Tao, gregkh; +Cc: Zeng Tao, stable, Alan Stern, stable
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2698 bytes --]
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag
fixing commit: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute").
The bot has tested the following trees: v5.8.6, v5.4.62, v4.19.143, v4.14.196, v4.9.235, v4.4.235.
v5.8.6: Build OK!
v5.4.62: Build OK!
v4.19.143: Build OK!
v4.14.196: Build OK!
v4.9.235: Build OK!
v4.4.235: Build failed! Errors:
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
^ permalink raw reply [flat|nested] 3+ messages in thread* RE: [PATCH] usb: core: fix slab-out-of-bounds Read in read_descriptors
2020-09-06 3:16 ` Sasha Levin
@ 2020-09-07 1:46 ` Zengtao (B)
0 siblings, 0 replies; 3+ messages in thread
From: Zengtao (B) @ 2020-09-07 1:46 UTC (permalink / raw)
To: Sasha Levin, gregkh@linuxfoundation.org
Cc: stable, Alan Stern, stable@vger.kernel.org
> -----Original Message-----
> From: Sasha Levin [mailto:sashal@kernel.org]
> Sent: Sunday, September 06, 2020 11:16 AM
> To: Sasha Levin; Zengtao (B); gregkh@linuxfoundation.org
> Cc: Zengtao (B); stable; Alan Stern; stable@vger.kernel.org
> Subject: Re: [PATCH] usb: core: fix slab-out-of-bounds Read in
> read_descriptors
>
> Hi
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag
> fixing commit: 217a9081d8e6 ("USB: add all configs to the "descriptors"
> attribute").
>
> The bot has tested the following trees: v5.8.6, v5.4.62, v4.19.143,
> v4.14.196, v4.9.235, v4.4.235.
>
> v5.8.6: Build OK!
> v5.4.62: Build OK!
> v4.19.143: Build OK!
> v4.14.196: Build OK!
> v4.9.235: Build OK!
> v4.4.235: Build failed! Errors:
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'?
> [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
> drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function
> ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
Need 7dd9cba5bb90 ("usb: sysfs: make locking interruptible")?
>
> --
> Thanks
> Sasha
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-09-07 1:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-04 6:37 [PATCH] usb: core: fix slab-out-of-bounds Read in read_descriptors Zeng Tao
2020-09-06 3:16 ` Sasha Levin
2020-09-07 1:46 ` Zengtao (B)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox