[PATCH] xhci: Fix use-after-free in xhci debugfs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Trying to read from debugfs after the system has resumed from
 hibernate causes a use-after-free and thus a protection fault.

Steps to reproduce:
Hibernate system, resume from hibernate, then run
$ cat /sys/kernel/debug/usb/xhci/*/command-ring/enqueue

dmesg below:

[ 3902.765086] general protection fault: 0000 [#1] PREEMPT SMP
[ 3902.765095] Modules linked in: ipheth nvidia_modeset(PO) iwlmvm mac80211 nvidia(PO) iwlwifi qmi_wwan cfg80211 thinkpad_acpi rfkill
[ 3902.765118] CPU: 4 PID: 3591 Comm: cat Tainted: P           O     4.14.0.1-12769-g1deab8c #1
[ 3902.765121] Hardware name: LENOVO 20ENCTO1WW/20ENCTO1WW, BIOS N1EET62W (1.35 ) 11/10/2016
[ 3902.765125] task: ffff88100263d040 task.stack: ffffc90006e50000
[ 3902.765136] RIP: 0010:xhci_trb_virt_to_dma.part.50+0x5/0x30
[ 3902.765140] RSP: 0018:ffffc90006e53da8 EFLAGS: 00010286
[ 3902.765144] RAX: ffff88100a57e680 RBX: ffff8810032f1900 RCX: ffff881013800900
[ 3902.765147] RDX: 0000000000000000 RSI: ffff881000abf488 RDI: 0d0c0a0bb1637008
[ 3902.765151] RBP: ffffc90006e53f00 R08: 0000000000000000 R09: 0000000000000000
[ 3902.765154] R10: 00007ffcd73165e0 R11: ffff88100263d040 R12: ffff880bd5afcc00
[ 3902.765157] R13: 0000000000020000 R14: 0000000000000001 R15: ffff8810032f1900
[ 3902.765161] FS:  00007f6aa6cec700(0000) GS:ffff881053d00000(0000) knlGS:0000000000000000
[ 3902.765165] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3902.765168] CR2: 00007f6aa6d08008 CR3: 00000010033f9003 CR4: 00000000003606e0
[ 3902.765172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3902.765175] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3902.765178] Call Trace:
[ 3902.765188]  xhci_ring_enqueue_show+0x1e/0x40
[ 3902.765197]  seq_read+0xdb/0x3a0
[ 3902.765204]  ? __handle_mm_fault+0x5fb/0x1210
[ 3902.765211]  full_proxy_read+0x4a/0x70
[ 3902.765219]  __vfs_read+0x23/0x120
[ 3902.765228]  vfs_read+0x8e/0x130
[ 3902.765235]  SyS_read+0x42/0x90
[ 3902.765242]  do_syscall_64+0x6b/0x290
[ 3902.765251]  entry_SYSCALL64_slow_path+0x25/0x25
[ 3902.765256] RIP: 0033:0x7f6aa683cba0
[ 3902.765260] RSP: 002b:00007ffcd7316818 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 3902.765264] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f6aa683cba0
[ 3902.765267] RDX: 0000000000020000 RSI: 00007f6aa6d09000 RDI: 0000000000000003
[ 3902.765270] RBP: 0000000000020000 R08: 00000000ffffffff R09: 0000000000000000
[ 3902.765274] R10: 00007ffcd73165e0 R11: 0000000000000246 R12: 00007f6aa6d09000
[ 3902.765277] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000020000
[ 3902.765282] Code: 0f 44 c0 49 8b 04 24 52 48 c7 c2 30 cd cb 81 48 8d b0 98 00 00 00 31 c0 e8 39 e6 dc ff 58 e9 75 ff ff ff 0f 1f 00 0f 1f 44 00 00 <48> 8b 17 31 c0 48 39 f2 77 13 48 29 d6 48 81 fe ff 0f 00 00 77
[ 3902.765371] RIP: xhci_trb_virt_to_dma.part.50+0x5/0x30 RSP: ffffc90006e53da8
[ 3902.765376] ---[ end trace 9ee53de1dccf7d8e ]---

The issue is caused by the xhci ring structures being reallocated
when the system is resumed, but pointers to the old structures
being retained in the debugfs files "private" field:

(gdb) list *(xhci_ring_enqueue_show+0x1e)
0xffffffff8170403e is in xhci_ring_enqueue_show (drivers/usb/host/xhci-debugfs.c:168).
163	{
164		dma_addr_t		dma;
165		struct xhci_ring	*ring = s->private;
166
167		dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);
168		seq_printf(s, "%pad\n", &dma);
169
170		return 0;
171	}
172

The proposed patch fixes this issue by storing a pointer to the xhci_ring
field in the xhci device structure in debugfs rather than directly
storing a pointer to the xhci_ring.

Signed-off-by: Alexander Kappner <agk@xxxxxxxxxxx>
---
 drivers/usb/host/xhci-debugfs.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index 4f7895d..60aa30a 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -162,7 +162,7 @@ static void xhci_debugfs_extcap_regset(struct xhci_hcd *xhci, int cap_id,
 static int xhci_ring_enqueue_show(struct seq_file *s, void *unused)
 {
 	dma_addr_t		dma;
-	struct xhci_ring	*ring = s->private;
+	struct xhci_ring	*ring = *(struct xhci_ring **)s->private;
 
 	dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);
 	seq_printf(s, "%pad\n", &dma);
@@ -173,7 +173,7 @@ static int xhci_ring_enqueue_show(struct seq_file *s, void *unused)
 static int xhci_ring_dequeue_show(struct seq_file *s, void *unused)
 {
 	dma_addr_t		dma;
-	struct xhci_ring	*ring = s->private;
+	struct xhci_ring	*ring = *(struct xhci_ring **)s->private;
 
 	dma = xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
 	seq_printf(s, "%pad\n", &dma);
@@ -183,7 +183,7 @@ static int xhci_ring_dequeue_show(struct seq_file *s, void *unused)
 
 static int xhci_ring_cycle_show(struct seq_file *s, void *unused)
 {
-	struct xhci_ring	*ring = s->private;
+	struct xhci_ring	*ring = *(struct xhci_ring **)s->private;
 
 	seq_printf(s, "%d\n", ring->cycle_state);
 
@@ -346,7 +346,7 @@ static void xhci_debugfs_create_files(struct xhci_hcd *xhci,
 }
 
 static struct dentry *xhci_debugfs_create_ring_dir(struct xhci_hcd *xhci,
-						   struct xhci_ring *ring,
+						   struct xhci_ring **ring,
 						   const char *name,
 						   struct dentry *parent)
 {
@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
 
 	snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
 	epriv->root = xhci_debugfs_create_ring_dir(xhci,
-						   dev->eps[ep_index].new_ring,
+						   &dev->eps[ep_index].new_ring,
 						   epriv->name,
 						   spriv->root);
 	spriv->eps[ep_index] = epriv;
@@ -423,7 +423,7 @@ void xhci_debugfs_create_slot(struct xhci_hcd *xhci, int slot_id)
 	priv->dev = dev;
 	dev->debugfs_private = priv;
 
-	xhci_debugfs_create_ring_dir(xhci, dev->eps[0].ring,
+	xhci_debugfs_create_ring_dir(xhci, &dev->eps[0].ring,
 				     "ep00", priv->root);
 
 	xhci_debugfs_create_context_files(xhci, priv->root, slot_id);
@@ -488,11 +488,11 @@ void xhci_debugfs_init(struct xhci_hcd *xhci)
 				   ARRAY_SIZE(xhci_extcap_dbc),
 				   "reg-ext-dbc");
 
-	xhci_debugfs_create_ring_dir(xhci, xhci->cmd_ring,
+	xhci_debugfs_create_ring_dir(xhci, &xhci->cmd_ring,
 				     "command-ring",
 				     xhci->debugfs_root);
 
-	xhci_debugfs_create_ring_dir(xhci, xhci->event_ring,
+	xhci_debugfs_create_ring_dir(xhci, &xhci->event_ring,
 				     "event-ring",
 				     xhci->debugfs_root);
 
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux