[PATCH] usb: gadget: f_ncm: Fix use-after-free in ncm_wrap_ntb()

[PATCH] usb: gadget: f_ncm: Fix use-after-free in ncm_wrap_ntb()

[Boyan Liu]

The err: path of ncm_wrap_ntb() frees ncm->skb_tx_data and
ncm->skb_tx_ndp but never clears the pointers. The rest of the
file treats NULL as "no aggregation in progress", and the other
release site, package_for_tx(), clears them after freeing.

When the NTH skb allocation succeeds but the NDP skb allocation
fails -- both GFP_ATOMIC, so this happens under memory pressure
-- the err: path frees both skbs and leaves stale pointers.
The next transmit passes the guard on the freed skb_tx_data,
reads ->len from the freed skb, and package_for_tx() may then
write the NTB header through the freed skb's ->data:

    BUG: KASAN: slab-use-after-free in ncm_wrap_ntb (drivers/usb/gadget/function/f_ncm.c:1044)
    Read of size 4 at addr ffff888108582930 by task kworker/1:2/1623
    Call Trace:
     ncm_wrap_ntb (drivers/usb/gadget/function/f_ncm.c:1044)
     eth_start_xmit (drivers/usb/gadget/function/u_ether.c:543)
     __dev_queue_xmit (net/core/dev.c:4884)
    Freed by task 4999:
     napi_skb_cache_put (net/core/skbuff.c:1471)	/* deferred dev_kfree_skb_any() from err: */
     net_tx_action (net/core/dev.c:5854)
    The buggy address belongs to the object at ffff8881085828c0
     which belongs to the cache skbuff_head_cache of size 240

Clear both pointers after freeing so the next transmit
re-enters the allocation branch on a clean state instead of
dereferencing freed skbs.

Fixes: 6d3865f9d41f ("usb: gadget: NCM: Add transmit multi-frame.")
Cc: stable@vger.kernel.org
Reported-by: co+02480a85e1a0d4f5@bugs.sh
Signed-off-by: Boyan Liu <yymhvert@gmail.com>
---
 drivers/usb/gadget/function/f_ncm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 500c9c19c78b..be1c2fa36350 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1132,10 +1132,14 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port,
 
 	if (skb)
 		dev_kfree_skb_any(skb);
-	if (ncm->skb_tx_data)
+	if (ncm->skb_tx_data) {
 		dev_kfree_skb_any(ncm->skb_tx_data);
-	if (ncm->skb_tx_ndp)
+		ncm->skb_tx_data = NULL;
+	}
+	if (ncm->skb_tx_ndp) {
 		dev_kfree_skb_any(ncm->skb_tx_ndp);
+		ncm->skb_tx_ndp = NULL;
+	}
 
 	return NULL;
 }
-- 
2.43.0