[BUG] usb: gadget: KASAN slab-out-of-bounds in gether_get_ifname

[CJ <firefly0158@163.com>]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts configfs, creates a USB gadget with a phonet function
(config/usb_gadget/g1/functions/phonet.usb0), and then reads the ifname
attribute of that function without ever binding the gadget to a UDC.


Reading ifname reaches f_phonet_ifname_show(), which calls
gether_get_ifname() to format the interface name. KASAN reports a 1-byte
out-of-bounds read in gether_get_ifname(); the reported object was allocated
by alloc_netdev_mqs() from gphonet_setup_default() when the phonet instance
was created. The read is performed by the syzkaller task in the read()
syscall, through configfs_read_iter().


This looks like the interface name being read before it has been
established. The net_device exists from instance creation, but its name is
only settled once the gadget is bound and the netdev is registered, and the
attribute is readable in between. Guarding the attribute on the function
being bound, or making gether_get_ifname() tolerate an unset name, would
cover it. I could not confirm from the report alone which byte of the name
buffer is the one read past the allocation.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=07886e96db1f4cfc196d, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:
The reproducer is the program below, which requires no large encoded image:


mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x777)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x777)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0/ifname\x00', 0x0, 0x0)
read(r0, 0x0, 0x0)


console output:  https://pastebin.com/raw/vszZhUpg

kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=872c04466179833f


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu