Hi!
I've got the following error report while running the syzkaller fuzzer.
ep0_write() doesn't check the length, so a user can cause an
out-of-bounds with both size and data controlled.
There's a comment which says "IN DATA+STATUS caller makes len <=
wLength". While I'm not exactly sure what that means, the length seems
to be passed unmodified directly from dev_config().
This doesn't seem to be a critical security issue since gadgetfs can't
be mounted from a user namespace.
On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2).
==================================================================
BUG: KASAN: slab-out-of-bounds in dev_config+0x86f/0x1190 at addr
ffff88003c47e160
Write of size 65537 by task syz-executor0/6356
CPU: 3 PID: 6356 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88003c107ad8 ffffffff81f96aba ffffffff3dc11ef0 1ffff10007820eee
ffffed0007820ee6 ffff88003dc11f00 0000000041b58ab3 ffffffff8598b4c8
ffffffff81f96828 ffffffff813fb4a0 ffff88003b6eadc0 ffff88003c107738
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff81f96aba>] dump_stack+0x292/0x398 lib/dump_stack.c:51
[<ffffffff817e4dec>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:159
[< inline >] print_address_description mm/kasan/report.c:197
[<ffffffff817e5080>] kasan_report_error+0x1f0/0x4e0 mm/kasan/report.c:286
[<ffffffff817e5705>] kasan_report+0x35/0x40 mm/kasan/report.c:306
[< inline >] check_memory_region_inline mm/kasan/kasan.c:308
[<ffffffff817e3fb9>] check_memory_region+0x139/0x190 mm/kasan/kasan.c:315
[<ffffffff817e4044>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
[< inline >] copy_from_user arch/x86/include/asm/uaccess.h:689
[< inline >] ep0_write drivers/usb/gadget/legacy/inode.c:1135
[<ffffffff83228caf>] dev_config+0x86f/0x1190
drivers/usb/gadget/legacy/inode.c:1759
[<ffffffff817fdd55>] __vfs_write+0x5d5/0x760 fs/read_write.c:510
[<ffffffff817ff650>] vfs_write+0x170/0x4e0 fs/read_write.c:560
[< inline >] SYSC_write fs/read_write.c:607
[<ffffffff81803a5b>] SyS_write+0xfb/0x230 fs/read_write.c:599
[<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003c47e038, in cache kmalloc-1024 size: 1024
Allocated:
PID = 4565
[ 43.417154] [<ffffffff81203526>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
[ 43.417154] [<ffffffff817e40d3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
[ 43.417154] [< inline >] set_track mm/kasan/kasan.c:507
[ 43.417154] [<ffffffff817e435d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
[ 43.417154] [<ffffffff817dfa02>] kmem_cache_alloc_trace+0x82/0x270
mm/slub.c:2735
[ 43.417154] [< inline >] kmalloc include/linux/slab.h:490
[ 43.417154] [< inline >] kzalloc include/linux/slab.h:636
[ 43.417154] [< inline >] dev_new
drivers/usb/gadget/legacy/inode.c:170
[ 43.417154] [<ffffffff832276ca>] gadgetfs_fill_super+0x24a/0x540
drivers/usb/gadget/legacy/inode.c:1987
[ 43.417154] [<ffffffff8180bb61>] mount_single+0xf1/0x160 fs/super.c:1146
[ 43.417154] [<ffffffff8322290c>] gadgetfs_mount+0x2c/0x40
drivers/usb/gadget/legacy/inode.c:2013
[ 43.417154] [<ffffffff8180be87>] mount_fs+0x97/0x2e0 fs/super.c:1177
[ 43.417154] [<ffffffff8187fc47>] vfs_kern_mount.part.24+0x67/0x2f0
fs/namespace.c:954
[ 43.417154] [< inline >] vfs_kern_mount fs/namespace.c:2433
[ 43.417154] [< inline >] do_new_mount fs/namespace.c:2436
[ 43.417154] [<ffffffff81888f58>] do_mount+0x418/0x2da0 fs/namespace.c:2758
[ 43.417154] [< inline >] SYSC_mount fs/namespace.c:2974
[ 43.417154] [<ffffffff8188c2ab>] SyS_mount+0xab/0x120 fs/namespace.c:2951
[ 43.417154] [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 0
(stack is not available)
Memory state around the buggy address:
ffff88003c47e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88003c47e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88003c47e200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
^
ffff88003c47e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88003c47e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
