* [PATCH 1/1] usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
@ 2018-03-02 11:20 Xinyong
2018-03-06 7:39 ` 方新勇
0 siblings, 1 reply; 2+ messages in thread
From: Xinyong @ 2018-03-02 11:20 UTC (permalink / raw)
To: balbi, gregkh, linux-usb
Cc: zhangjerry, mina86, plr.vincent, shuang.liu, xulun, linux-kernel, stable
When I debug a kernel crash issue in funcitonfs, found ffs_data.ref
overflowed, While functionfs is unmounting, ffs_data is put twice.
Commit 43938613c6fd ("drivers, usb: convert ffs_data.ref from atomic_t to
refcount_t") can avoid refcount overflow, but that is risk some situations.
So no need put ffs data in ffs_fs_kill_sb, already put in ffs_data_closed.
The issue can be reproduced in Mediatek mt6763 SoC, ffs for ADB device.
KASAN enabled configuration reports use-after-free errro.
BUG: KASAN: use-after-free in refcount_dec_and_test+0x14/0xe0 at addr ffffffc0579386a0
Read of size 4 by task umount/4650
====================================================
BUG kmalloc-512 (Tainted: P W O ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in ffs_fs_mount+0x194/0x844 age=22856 cpu=2 pid=566
alloc_debug_processing+0x1ac/0x1e8
___slab_alloc.constprop.63+0x640/0x648
__slab_alloc.isra.57.constprop.62+0x24/0x34
kmem_cache_alloc_trace+0x1a8/0x2bc
ffs_fs_mount+0x194/0x844
mount_fs+0x6c/0x1d0
vfs_kern_mount+0x50/0x1b4
do_mount+0x258/0x1034
INFO: Freed in ffs_data_put+0x25c/0x320 age=0 cpu=3 pid=4650
free_debug_processing+0x22c/0x434
__slab_free+0x2d8/0x3a0
kfree+0x254/0x264
ffs_data_put+0x25c/0x320
ffs_data_closed+0x124/0x15c
ffs_fs_kill_sb+0xb8/0x110
deactivate_locked_super+0x6c/0x98
deactivate_super+0xb0/0xbc
INFO: Object 0xffffffc057938600 @offset=1536 fp=0x (null)
......
Call trace:
[<ffffff900808cf5c>] dump_backtrace+0x0/0x250
[<ffffff900808d3a0>] show_stack+0x14/0x1c
[<ffffff90084a8c04>] dump_stack+0xa0/0xc8
[<ffffff900826c2b4>] print_trailer+0x158/0x260
[<ffffff900826d9d8>] object_err+0x3c/0x40
[<ffffff90082745f0>] kasan_report_error+0x2a8/0x754
[<ffffff9008274f84>] kasan_report+0x5c/0x60
[<ffffff9008273208>] __asan_load4+0x70/0x88
[<ffffff90084cd81c>] refcount_dec_and_test+0x14/0xe0
[<ffffff9008d98f9c>] ffs_data_put+0x80/0x320
[<ffffff9008d9d904>] ffs_fs_kill_sb+0xc8/0x110
[<ffffff90082852a0>] deactivate_locked_super+0x6c/0x98
[<ffffff900828537c>] deactivate_super+0xb0/0xbc
[<ffffff90082af0c0>] cleanup_mnt+0x64/0xec
[<ffffff90082af1b0>] __cleanup_mnt+0x10/0x18
[<ffffff90080d9e68>] task_work_run+0xcc/0x124
[<ffffff900808c8c0>] do_notify_resume+0x60/0x70
[<ffffff90080866e4>] work_pending+0x10/0x14
Cc: stable@vger.kernel.org
Signed-off-by: Xinyong <xinyong.fang@linux.alibaba.com>
---
drivers/usb/gadget/function/f_fs.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index c2592d8..d2428a9 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1538,7 +1538,6 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
if (sb->s_fs_info) {
ffs_release_dev(sb->s_fs_info);
ffs_data_closed(sb->s_fs_info);
- ffs_data_put(sb->s_fs_info);
}
}
--
1.7.9.5
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 1/1] usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
2018-03-02 11:20 [PATCH 1/1] usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() Xinyong
@ 2018-03-06 7:39 ` 方新勇
0 siblings, 0 replies; 2+ messages in thread
From: 方新勇 @ 2018-03-06 7:39 UTC (permalink / raw)
To: Xinyong
Cc: balbi, gregkh, linux-usb, zhangjerry, mina86, plr.vincent,
shuang.liu, xulun, linux-kernel, stable
[-- Attachment #1: Type: text/plain, Size: 3564 bytes --]
hi, balbi and folks,
could you help review or comment for the change. thanks
-
xinyong
2018-03-02 19:20 GMT+08:00 Xinyong <xinyong.fang@linux.alibaba.com>:
> When I debug a kernel crash issue in funcitonfs, found ffs_data.ref
> overflowed, While functionfs is unmounting, ffs_data is put twice.
>
> Commit 43938613c6fd ("drivers, usb: convert ffs_data.ref from atomic_t to
> refcount_t") can avoid refcount overflow, but that is risk some situations.
> So no need put ffs data in ffs_fs_kill_sb, already put in ffs_data_closed.
>
> The issue can be reproduced in Mediatek mt6763 SoC, ffs for ADB device.
> KASAN enabled configuration reports use-after-free errro.
>
> BUG: KASAN: use-after-free in refcount_dec_and_test+0x14/0xe0 at addr
> ffffffc0579386a0
> Read of size 4 by task umount/4650
> ====================================================
> BUG kmalloc-512 (Tainted: P W O ): kasan: bad access detected
> ------------------------------------------------------------
> -----------------
>
> INFO: Allocated in ffs_fs_mount+0x194/0x844 age=22856 cpu=2 pid=566
> alloc_debug_processing+0x1ac/0x1e8
> ___slab_alloc.constprop.63+0x640/0x648
> __slab_alloc.isra.57.constprop.62+0x24/0x34
> kmem_cache_alloc_trace+0x1a8/0x2bc
> ffs_fs_mount+0x194/0x844
> mount_fs+0x6c/0x1d0
> vfs_kern_mount+0x50/0x1b4
> do_mount+0x258/0x1034
> INFO: Freed in ffs_data_put+0x25c/0x320 age=0 cpu=3 pid=4650
> free_debug_processing+0x22c/0x434
> __slab_free+0x2d8/0x3a0
> kfree+0x254/0x264
> ffs_data_put+0x25c/0x320
> ffs_data_closed+0x124/0x15c
> ffs_fs_kill_sb+0xb8/0x110
> deactivate_locked_super+0x6c/0x98
> deactivate_super+0xb0/0xbc
> INFO: Object 0xffffffc057938600 @offset=1536 fp=0x (null)
> ......
> Call trace:
> [<ffffff900808cf5c>] dump_backtrace+0x0/0x250
> [<ffffff900808d3a0>] show_stack+0x14/0x1c
> [<ffffff90084a8c04>] dump_stack+0xa0/0xc8
> [<ffffff900826c2b4>] print_trailer+0x158/0x260
> [<ffffff900826d9d8>] object_err+0x3c/0x40
> [<ffffff90082745f0>] kasan_report_error+0x2a8/0x754
> [<ffffff9008274f84>] kasan_report+0x5c/0x60
> [<ffffff9008273208>] __asan_load4+0x70/0x88
> [<ffffff90084cd81c>] refcount_dec_and_test+0x14/0xe0
> [<ffffff9008d98f9c>] ffs_data_put+0x80/0x320
> [<ffffff9008d9d904>] ffs_fs_kill_sb+0xc8/0x110
> [<ffffff90082852a0>] deactivate_locked_super+0x6c/0x98
> [<ffffff900828537c>] deactivate_super+0xb0/0xbc
> [<ffffff90082af0c0>] cleanup_mnt+0x64/0xec
> [<ffffff90082af1b0>] __cleanup_mnt+0x10/0x18
> [<ffffff90080d9e68>] task_work_run+0xcc/0x124
> [<ffffff900808c8c0>] do_notify_resume+0x60/0x70
> [<ffffff90080866e4>] work_pending+0x10/0x14
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Xinyong <xinyong.fang@linux.alibaba.com>
> ---
> drivers/usb/gadget/function/f_fs.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/usb/gadget/function/f_fs.c
> b/drivers/usb/gadget/function/f_fs.c
> index c2592d8..d2428a9 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1538,7 +1538,6 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data
> *data, char *opts)
> if (sb->s_fs_info) {
> ffs_release_dev(sb->s_fs_info);
> ffs_data_closed(sb->s_fs_info);
> - ffs_data_put(sb->s_fs_info);
> }
> }
>
> --
> 1.7.9.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-usb" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
[-- Attachment #2: Type: text/html, Size: 7394 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-03-06 7:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-02 11:20 [PATCH 1/1] usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() Xinyong
2018-03-06 7:39 ` 方新勇
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®