From patchwork Wed Oct 11 14:40:36 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Takashi Iwai X-Patchwork-Id: 9999795 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 547C4602BF for ; Wed, 11 Oct 2017 14:40:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F24FB28A60 for ; Wed, 11 Oct 2017 14:40:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E756428A68; Wed, 11 Oct 2017 14:40:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0587228A63 for ; Wed, 11 Oct 2017 14:40:40 +0000 (UTC) Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id 24FCF267591; Wed, 11 Oct 2017 16:40:39 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 9AC76267593; Wed, 11 Oct 2017 16:40:38 +0200 (CEST) Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by alsa0.perex.cz (Postfix) with ESMTP id 0297E267590 for ; Wed, 11 Oct 2017 16:40:36 +0200 (CEST) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 7AD54AC0C; Wed, 11 Oct 2017 14:40:36 +0000 (UTC) Date: Wed, 11 Oct 2017 16:40:36 +0200 Message-ID: From: Takashi Iwai To: Johan Hovold In-Reply-To: <20171011142031.GY4269@localhost> References: <20171011103646.11879-1-tiwai@suse.de> <20171011103646.11879-4-tiwai@suse.de> <20171011142031.GY4269@localhost> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Cc: Andrey Konovalov , alsa-devel@alsa-project.org, linux-usb@vger.kernel.org, Greg KH Subject: Re: [alsa-devel] [PATCH v2 3/9] ALSA: caiaq: Add a sanity check for invalid EPs X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP On Wed, 11 Oct 2017 16:20:31 +0200, Johan Hovold wrote: > > On Wed, Oct 11, 2017 at 12:36:40PM +0200, Takashi Iwai wrote: > > As syzkaller spotted, currently caiaq driver submits a URB with the > > fixed EP without checking whether it's actually available, which may > > result in a kernel warning like: > > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > > ------------[ cut here ]------------ > > WARNING: CPU: 1 PID: 1150 at drivers/usb/core/urb.c:449 > > usb_submit_urb+0xf8a/0x11d0 > > Modules linked in: > > CPU: 1 PID: 1150 Comm: kworker/1:1 Not tainted > > 4.14.0-rc2-42660-g24b7bd59eec0 #277 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > Workqueue: usb_hub_wq hub_event > > Call Trace: > > init_card sound/usb/caiaq/device.c:467 > > snd_probe+0x81c/0x1150 sound/usb/caiaq/device.c:525 > > usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 > > .... > > > > This patch adds a sanity check of validity of EPs at the device > > initialization phase for avoiding the call with an invalid EP. > > > > Reported-by: Andrey Konovalov > > Tested-by: Andrey Konovalov > > Signed-off-by: Takashi Iwai > > --- > > sound/usb/caiaq/device.c | 7 +++++++ > > 1 file changed, 7 insertions(+) > > > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > > index 0fb6b1b79261..a29674bf96e5 100644 > > --- a/sound/usb/caiaq/device.c > > +++ b/sound/usb/caiaq/device.c > > @@ -461,6 +461,13 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > > cdev->midi_out_buf, EP1_BUFSIZE, > > snd_usb_caiaq_midi_output_done, cdev); > > > > + /* sanity checks of EPs before actually submitting */ > > + if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || > > + usb_urb_ep_type_check(&cdev->midi_out_urb)) { > > + dev_err(dev, "invalid EPs\n"); > > + return -EINVAL; > > + } > > + > > Unrelated to this patch, but this driver fails to kill the ep1_in_urb > (which is submitted in this function) in case of later probe errors. > This can lead to use-after-free or crashes in the completion callback. Yes, a good catch. Below is the fix patch. thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: caiaq: Fix stray URB at probe error path caiaq driver doesn't kill the URB properly at its error path during the probe, which may lead to a use-after-free error later. This patch addresses it. Reported-by: Johan Hovold Signed-off-by: Takashi Iwai Reviewed-by: Johan Hovold --- sound/usb/caiaq/device.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a29674bf96e5..d55ca48de3ea 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -476,10 +476,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev) err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); if (err) - return err; + goto err_kill_urb; - if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) - return -ENODEV; + if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) { + err = -ENODEV; + goto err_kill_urb; + } usb_string(usb_dev, usb_dev->descriptor.iManufacturer, cdev->vendor_name, CAIAQ_USB_STR_LEN); @@ -514,6 +516,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev) setup_card(cdev); return 0; + + err_kill_urb: + usb_kill_urb(&cdev->ep1_in_urb); + return err; } static int snd_probe(struct usb_interface *intf,