linux/drivers/usb
Xinyong 1a087f0321 usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
When I debug a kernel crash issue in funcitonfs, found ffs_data.ref
overflowed, While functionfs is unmounting, ffs_data is put twice.

Commit 43938613c6 ("drivers, usb: convert ffs_data.ref from atomic_t to
refcount_t") can avoid refcount overflow, but that is risk some situations.
So no need put ffs data in ffs_fs_kill_sb, already put in ffs_data_closed.

The issue can be reproduced in Mediatek mt6763 SoC, ffs for ADB device.
KASAN enabled configuration reports use-after-free errro.

BUG: KASAN: use-after-free in refcount_dec_and_test+0x14/0xe0 at addr ffffffc0579386a0
Read of size 4 by task umount/4650
====================================================
BUG kmalloc-512 (Tainted: P        W  O   ): kasan: bad access detected
-----------------------------------------------------------------------------

INFO: Allocated in ffs_fs_mount+0x194/0x844 age=22856 cpu=2 pid=566
    alloc_debug_processing+0x1ac/0x1e8
    ___slab_alloc.constprop.63+0x640/0x648
    __slab_alloc.isra.57.constprop.62+0x24/0x34
    kmem_cache_alloc_trace+0x1a8/0x2bc
    ffs_fs_mount+0x194/0x844
    mount_fs+0x6c/0x1d0
    vfs_kern_mount+0x50/0x1b4
    do_mount+0x258/0x1034
INFO: Freed in ffs_data_put+0x25c/0x320 age=0 cpu=3 pid=4650
    free_debug_processing+0x22c/0x434
    __slab_free+0x2d8/0x3a0
    kfree+0x254/0x264
    ffs_data_put+0x25c/0x320
    ffs_data_closed+0x124/0x15c
    ffs_fs_kill_sb+0xb8/0x110
    deactivate_locked_super+0x6c/0x98
    deactivate_super+0xb0/0xbc
INFO: Object 0xffffffc057938600 @offset=1536 fp=0x          (null)
......
Call trace:
[<ffffff900808cf5c>] dump_backtrace+0x0/0x250
[<ffffff900808d3a0>] show_stack+0x14/0x1c
[<ffffff90084a8c04>] dump_stack+0xa0/0xc8
[<ffffff900826c2b4>] print_trailer+0x158/0x260
[<ffffff900826d9d8>] object_err+0x3c/0x40
[<ffffff90082745f0>] kasan_report_error+0x2a8/0x754
[<ffffff9008274f84>] kasan_report+0x5c/0x60
[<ffffff9008273208>] __asan_load4+0x70/0x88
[<ffffff90084cd81c>] refcount_dec_and_test+0x14/0xe0
[<ffffff9008d98f9c>] ffs_data_put+0x80/0x320
[<ffffff9008d9d904>] ffs_fs_kill_sb+0xc8/0x110
[<ffffff90082852a0>] deactivate_locked_super+0x6c/0x98
[<ffffff900828537c>] deactivate_super+0xb0/0xbc
[<ffffff90082af0c0>] cleanup_mnt+0x64/0xec
[<ffffff90082af1b0>] __cleanup_mnt+0x10/0x18
[<ffffff90080d9e68>] task_work_run+0xcc/0x124
[<ffffff900808c8c0>] do_notify_resume+0x60/0x70
[<ffffff90080866e4>] work_pending+0x10/0x14

Cc: stable@vger.kernel.org
Signed-off-by: Xinyong <xinyong.fang@linux.alibaba.com>

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-03-05 10:42:53 +02:00
..
atm USB: atm: fix up some remaining DEVICE_ATTR() usage 2018-01-24 08:49:52 +01:00
c67x00 USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
chipidea USB: move many drivers to use DEVICE_ATTR_WO 2018-01-24 08:49:52 +01:00
class usb: cdc_acm: prevent race at write to acm while system resumes 2018-02-16 07:52:55 +01:00
common USB: ulpi: fix bus-node lookup 2017-11-28 15:17:48 +01:00
core Add delay-init quirk for Corsair K70 RGB keyboards 2018-02-15 20:52:56 +01:00
dwc2 usb: dwc2: Fix dwc2_hsotg_core_init_disconnected() 2018-02-12 10:59:31 +02:00
dwc3 usb: dwc3: Fix lock-up on ID change during system suspend/resume 2018-02-28 09:57:04 +02:00
early usb: early: Correct the endpoint type value for bulk in endpoint 2017-12-07 16:03:15 +01:00
gadget usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() 2018-03-05 10:42:53 +02:00
host USB fixes for 4.16-rc3 2018-02-22 12:13:01 -08:00
image USB/PHY patches for 4.15-rc1 2017-11-13 21:14:07 -08:00
isp1760 USB/PHY patches for 4.15-rc1 2017-11-13 21:14:07 -08:00
misc usb: ldusb: add PIDs for new CASSY devices supported by this driver 2018-02-15 18:44:03 +01:00
mon vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
mtu3 usb: mtu3: fix semicolon.cocci warnings 2018-01-16 10:01:01 +01:00
musb Revert "usb: musb: host: don't start next rx urb if current one failed" 2018-02-20 15:02:46 +01:00
phy usb: phy: mxs: Fix NULL pointer dereference on i.MX23/28 2018-02-12 10:51:37 +02:00
renesas_usbhs usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path 2018-02-15 18:43:57 +01:00
serial USB: serial: option: Add support for Quectel EP06 2018-02-15 18:36:19 +01:00
storage USB: move many drivers to use DEVICE_ATTR_RO 2018-01-24 08:49:52 +01:00
typec Merge 4.15-rc4 into usb-next 2017-12-18 09:08:05 +01:00
usbip usbip: keep usbip_device sockfd state in sync with tcp_socket 2018-02-15 18:43:57 +01:00
wusbcore USB/PHY patches for 4.15-rc1 2017-11-13 21:14:07 -08:00
Kconfig sparc,leon: Select USB_UHCI_BIG_ENDIAN_{MMIO,DESC} 2018-02-15 21:45:16 +00:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
README
usb-skeleton.c USB: usb-skeleton: Remove redundant license text 2017-11-04 11:55:39 +01:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.