Re: usb/gadget: use-after-free in gadgetfs_setup

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 12/12/2016 09:09 PM, Alan Stern wrote:
> On Mon, 12 Dec 2016, Andrey Konovalov wrote:
> 
>> On Mon, Dec 12, 2016 at 7:44 PM, Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> wrote:
>>>
>>> I'm still puzzled.  Can you try running the test with the diagnostic
>>> patch below?  The resulting kernel log ought to help pin down where the
>>> problem comes from.
>>
>> Sure, here's the log:
>>
>> usb 1-1: string descriptor 0 read error: -71
>> usb 1-1: New USB device found, idVendor=0000, idProduct=0002
>> usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=7
>> usb 1-1: can't set config #131, error -71
>> usb 1-1: USB disconnect, device number 45
>> gadgetfs: bound to dummy_udc driver
>> dummy: stop_activity
>> usb 1-1: new full-speed USB device number 46 using dummy_hcd
>> gadgetfs: connected
>> dummy: queue ffff88006addc300 ep ep0
>> dummy: complete ffff88006addc300 ep ep0
>> dummy: stop_activity
>> gadgetfs: disconnected
>> gadgetfs: connected
>> dummy: queue ffff88006addc300 ep ep0
>> dummy: complete ffff88006addc300 ep ep0
>> dummy: queue ffff88006addc300 ep ep0
>> dummy: complete ffff88006addc300 ep ep0
>> dummy: queue ffff88006addc300 ep ep0
>> dummy: complete ffff88006addc300 ep ep0
>> usb 1-1: config 131 has too many interfaces: 158, using maximum allowed: 32
>> usb 1-1: config 131 has 1 interface, different from the descriptor's value: 158
>> dummy: queue ffff88006addc300 ep ep0
>> dummy: stop_activity
>> gadgetfs: disconnected
>> ------------[ cut here ]------------
>> WARNING: CPU: 1 PID: 4892 at drivers/usb/gadget/udc/dummy_hcd.c:675
>> dummy_free_request+0x153/0x170
> 
> Ah, good, that clears it up.  The problem is that stop_activity() nukes 
> all the endpoints except for endpoint 0!
> 
> The patch below should fix the problem.
> 
> Alan Stern
> 
> 
> 
> Index: usb-4.x/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-4.x.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-4.x/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -338,6 +338,7 @@ static void stop_activity(struct dummy *
>  	/* The timer is left running so that outstanding URBs can fail */
>  
>  	/* nuke any pending requests first, so driver i/o is quiesced */
> +	nuke(dum, &dum->ep[0]);
>  	list_for_each_entry(ep, &dum->gadget.ep_list, ep.ep_list)
>  		nuke(dum, ep);

Pretty nasty error. We had the same in vUDC. Maybe it would be a good
idea to iterate over ep[] array which is inside struct dummy instead
adding this special case for ep[0]. In addition it's the only place
where dummy_hcd iterates over this list instead of ep array;)

Best regards,
-- 
Krzysztof Opasiak
Samsung R&D Institute Poland
Samsung Electronics
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux