From patchwork Tue Dec 18 10:00:20 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jia-Ju Bai X-Patchwork-Id: 10735293 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 58F106C5 for ; Tue, 18 Dec 2018 10:00:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 479C929D0E for ; Tue, 18 Dec 2018 10:00:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3BD8C2A311; Tue, 18 Dec 2018 10:00:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2A20D2A2FF for ; Tue, 18 Dec 2018 10:00:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726386AbeLRKAa (ORCPT ); Tue, 18 Dec 2018 05:00:30 -0500 Received: from mail-io1-f68.google.com ([209.85.166.68]:40721 "EHLO mail-io1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726341AbeLRKAa (ORCPT ); Tue, 18 Dec 2018 05:00:30 -0500 Received: by mail-io1-f68.google.com with SMTP id v12so8690517iop.7; Tue, 18 Dec 2018 02:00:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=Bygy8q+B+26MqgPUBkfyodN9+lfiaRKsw0ThW9v2JQM=; b=vPD66ggb0O+2Ymqvhuv9Z096lrbab0CMHY9LJDyQ5f/KO1g2ppMa2CUOcp+TF6RWrT DtwwzeJAplyabkbHTWkZou6FE45zqKMbYq3PBVZCMV1+sAHTfHDOo+/0dxnDK0Bajlnc SOhV9aYreBJik+89y5HQaTudgHdH4HIsm5cGYGac1tIBet2YfWe7FvxAQNYlqapC/NmT DNLL/Oq7VOY2LgtjGEG11Z4etfJ/ppfkPOQoyDApQcy04Xkkq6S4ESJwNl0kyU7NOto/ rAvEd787tVZYVbehdOYgQRptTOWzrpPotUsqcN8lU9pUzAE1EdB/LtfvVSB5OAxB/BGx V8hA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Bygy8q+B+26MqgPUBkfyodN9+lfiaRKsw0ThW9v2JQM=; b=KukHuv0/D7V36d4HjlCLJudKX+0zda2FNkW2NbALRV4cYy34LrVHfeLkFjws+TaxsR rsUBOVqWo7dnVTNhVdqYU0Z2gW9bS6D4HTTT2gdNq/VTR53gy/NKkjm/7EdMafe2A51W 0u5GCVtKbXdAeWkIUtWsSN0b2/CS2dlkQidmSvMx7KlFfWDv7MoNNMURyUYoEh5x/pvQ djOe56INEJR/Igt0JAKsdDiejn7l6eae0TK2ZVFSP3tEZLLcfqO3j0xipilXBJhLICDx 1QPYLaZslbhMqNLRmdB6BJgMaD0qkUZB8rhHZ5I8s0oCzcqLeGBqhydK0O6UvoWVvLLs DKmA== X-Gm-Message-State: AA+aEWYugoPXlzYGCmrh3cMhg249zMaeYrGptMhlssqmLxsH4ViJNh1f 1SEmHQJYrvF+RDna/Tl3fgQ= X-Google-Smtp-Source: AFSGD/Uez3tDYekgZCva0c4AeczDVhtVOChhRykKY91LKfSMNgXzE9FkQO98uoWq4FJxxo2O8X4EgQ== X-Received: by 2002:a6b:1807:: with SMTP id 7mr13251090ioy.167.1545127229343; Tue, 18 Dec 2018 02:00:29 -0800 (PST) Received: from localhost.localdomain ([2402:f000:1:4414:3dd3:3693:8487:3f39]) by smtp.gmail.com with ESMTPSA id p21sm6557538ioh.25.2018.12.18.02.00.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Dec 2018 02:00:28 -0800 (PST) From: Jia-Ju Bai To: gregkh@linuxfoundation.org Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH] r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() Date: Tue, 18 Dec 2018 18:00:20 +0800 Message-Id: <20181218100020.26250-1-baijiaju1990@gmail.com> X-Mailer: git-send-email 2.17.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may be concurrently executed. The two functions both access a possible shared variable "hep->hcpriv". This shared variable is freed by r8a66597_endpoint_disable() via the call path: r8a66597_endpoint_disable kfree(hep->hcpriv) (line 1995 in Linux-4.19) This variable is read by r8a66597_urb_enqueue() via the call path: r8a66597_urb_enqueue spin_lock_irqsave(&r8a66597->lock); init_pipe_info enable_r8a66597_pipe pipe = hep->hcpriv (line 802 in Linux-4.19) The read operation is protected by a spinlock, but the free operation is not protected by this spinlock, thus a concurrency use-after-free bug may occur. To fix this bug, the spin-lock and spin-unlock function calls in r8a66597_endpoint_disable() are moved to protect the free operation. Signed-off-by: Jia-Ju Bai --- drivers/usb/host/r8a66597-hcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c index 984892dd72f5..1495ce14ad22 100644 --- a/drivers/usb/host/r8a66597-hcd.c +++ b/drivers/usb/host/r8a66597-hcd.c @@ -1991,13 +1991,14 @@ static void r8a66597_endpoint_disable(struct usb_hcd *hcd, return; pipenum = pipe->info.pipenum; + spin_lock_irqsave(&r8a66597->lock, flags); if (pipenum == 0) { kfree(hep->hcpriv); hep->hcpriv = NULL; + spin_unlock_irqrestore(&r8a66597->lock, flags); return; } - spin_lock_irqsave(&r8a66597->lock, flags); pipe_stop(r8a66597, pipe); pipe_irq_disable(r8a66597, pipenum); disable_irq_empty(r8a66597, pipenum);