From patchwork Tue Dec 18 12:04:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jia-Ju Bai X-Patchwork-Id: 10735527 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2936E14E5 for ; Tue, 18 Dec 2018 12:04:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1826829FF4 for ; Tue, 18 Dec 2018 12:04:39 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0CBDF2A007; Tue, 18 Dec 2018 12:04:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AC01A2A041 for ; Tue, 18 Dec 2018 12:04:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726544AbeLRMEh (ORCPT ); Tue, 18 Dec 2018 07:04:37 -0500 Received: from mail-pg1-f193.google.com ([209.85.215.193]:43204 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726430AbeLRMEh (ORCPT ); Tue, 18 Dec 2018 07:04:37 -0500 Received: by mail-pg1-f193.google.com with SMTP id v28so7713931pgk.10; Tue, 18 Dec 2018 04:04:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=QTN9L3fTpeWsyJZhvZ1DPbDaK2OWdDpzdc4ujHbndYM=; b=fQ+3FJWjXv8sUaA+gUOmv+KdLKDL6Yq0l+9QpUbnPVDuxp3l5wd1IdSqSeJ59K4blO S3WUWTDQN9/nlvSsChNgNCKjroOwzviLHjS+NyDjpF1ZpNhYQIu/xHdfRtNQFSifDy2v 8NYD7gSS43tWzkjL1VQp5Rvql7RxvVEKVuiFPd2JnTCcnauFBE3xDlWN2Pz8CaV/t9sk 1jyfK0H28nr369RQoazRdEICzfKFp0xJESS/ggqS3+50i3AXAI/Sx8bTc+iccPAN5eMF zC68MHkN3+V07WtzoYzqOuHO1lW2mGeTYkAu0+guga/j+U5Yc1YAmcjyC4owx3Z+rksh 1DJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=QTN9L3fTpeWsyJZhvZ1DPbDaK2OWdDpzdc4ujHbndYM=; b=RVt8MTUF9TzZLiTnu2FCVYTGl+ASOI9u66OPv87V6uvRMblrjEND8q4XEtURsU4wlZ qbG0KRg/ZK4qXv8xX62Tzogsu9pPUW4DiSGSxDIF00RMG4OOosqygl5KqhbaiKoSy8Mo uGAOyabVJFomeDgYGJb8w4KCfnQcvN/vNJKbbPIUKp1HZL3xf5eY4aXAidO2jOHxzJm8 CCqBBFwy0xVNR70E0S1fOlKxeheYmbiz7yvA1NvHhjK0I94I88x6+FPjsix8AZO9Is3A TMeKR5KVvJYu7Cp1HudM53f93U/aULUXyTCa5KhC5bo/I/+f4dMHyjS99/16hD2w84YQ slWw== X-Gm-Message-State: AA+aEWa9YPv1tBt6ICXWP3IK2rwi9vg5sqrPN0fwLpeAdhMmeJWMercz iok6zPM+wugnHK/7e6edvbw= X-Google-Smtp-Source: AFSGD/VG1THwofgVwusUFLGl/A1DcZe54dwyEVQ5X7hGKo+YJ2suO8FiDWmGlRkTOukCu2CrQ+nKJA== X-Received: by 2002:a65:40c5:: with SMTP id u5mr14996139pgp.46.1545134676768; Tue, 18 Dec 2018 04:04:36 -0800 (PST) Received: from localhost.localdomain ([2402:f000:1:4414:3dd3:3693:8487:3f39]) by smtp.gmail.com with ESMTPSA id 4sm30871885pfq.10.2018.12.18.04.04.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Dec 2018 04:04:36 -0800 (PST) From: Jia-Ju Bai To: gregkh@linuxfoundation.org Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH v2] usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() Date: Tue, 18 Dec 2018 20:04:25 +0800 Message-Id: <20181218120425.32223-1-baijiaju1990@gmail.com> X-Mailer: git-send-email 2.17.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may be concurrently executed. The two functions both access a possible shared variable "hep->hcpriv". This shared variable is freed by r8a66597_endpoint_disable() via the call path: r8a66597_endpoint_disable kfree(hep->hcpriv) (line 1995 in Linux-4.19) This variable is read by r8a66597_urb_enqueue() via the call path: r8a66597_urb_enqueue spin_lock_irqsave(&r8a66597->lock) init_pipe_info enable_r8a66597_pipe pipe = hep->hcpriv (line 802 in Linux-4.19) The read operation is protected by a spinlock, but the free operation is not protected by this spinlock, thus a concurrency use-after-free bug may occur. To fix this bug, the spin-lock and spin-unlock function calls in r8a66597_endpoint_disable() are moved to protect the free operation. Signed-off-by: Jia-Ju Bai --- v2: * Add __acquires/__releases markings for r8a66597_endpoint_disable(). Thanks Greg for good advice. --- drivers/usb/host/r8a66597-hcd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c index 984892dd72f5..42668aeca57c 100644 --- a/drivers/usb/host/r8a66597-hcd.c +++ b/drivers/usb/host/r8a66597-hcd.c @@ -1979,6 +1979,8 @@ static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, static void r8a66597_endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep) +__acquires(r8a66597->lock) +__releases(r8a66597->lock) { struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd); struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv; @@ -1991,13 +1993,14 @@ static void r8a66597_endpoint_disable(struct usb_hcd *hcd, return; pipenum = pipe->info.pipenum; + spin_lock_irqsave(&r8a66597->lock, flags); if (pipenum == 0) { kfree(hep->hcpriv); hep->hcpriv = NULL; + spin_unlock_irqrestore(&r8a66597->lock, flags); return; } - spin_lock_irqsave(&r8a66597->lock, flags); pipe_stop(r8a66597, pipe); pipe_irq_disable(r8a66597, pipenum); disable_irq_empty(r8a66597, pipenum);