leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
9d3863736a
linux/drivers/media/rc
History
YueHaibing 56cd26b618 media: serial_ir: Fix use-after-free in serial_ir_init_module 
Syzkaller report this:

BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249

CPU: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xfa/0x1ce lib/dump_stack.c:113
 print_address_description+0x65/0x270 mm/kasan/report.c:187
 kasan_report+0x149/0x18d mm/kasan/report.c:317
 ? 0xffffffffc1728000
 sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
 sysfs_remove_file include/linux/sysfs.h:519 [inline]
 driver_remove_file+0x40/0x50 drivers/base/driver.c:122
 remove_bind_files drivers/base/bus.c:585 [inline]
 bus_remove_driver+0x186/0x220 drivers/base/bus.c:725
 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
 serial_ir_init_module+0x169/0x1000 [serial_ir]
 do_one_initcall+0xfa/0x5ca init/main.c:887
 do_init_module+0x204/0x5f6 kernel/module.c:3460
 load_module+0x66b2/0x8570 kernel/module.c:3808
 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc
R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004

Allocated by task 6249:
 set_track mm/kasan/common.c:85 [inline]
 __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
 kmalloc include/linux/slab.h:545 [inline]
 kzalloc include/linux/slab.h:740 [inline]
 bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
 driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
 serial_ir_init_module+0xe8/0x1000 [serial_ir]
 do_one_initcall+0xfa/0x5ca init/main.c:887
 do_init_module+0x204/0x5f6 kernel/module.c:3460
 load_module+0x66b2/0x8570 kernel/module.c:3808
 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 6249:
 set_track mm/kasan/common.c:85 [inline]
 __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
 slab_free_hook mm/slub.c:1430 [inline]
 slab_free_freelist_hook mm/slub.c:1457 [inline]
 slab_free mm/slub.c:3005 [inline]
 kfree+0xe1/0x270 mm/slub.c:3957
 kobject_cleanup lib/kobject.c:662 [inline]
 kobject_release lib/kobject.c:691 [inline]
 kref_put include/linux/kref.h:67 [inline]
 kobject_put+0x146/0x240 lib/kobject.c:708
 bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
 serial_ir_init_module+0x14c/0x1000 [serial_ir]
 do_one_initcall+0xfa/0x5ca init/main.c:887
 do_init_module+0x204/0x5f6 kernel/module.c:3460
 load_module+0x66b2/0x8570 kernel/module.c:3808
 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881dc7ae000
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 48 bytes inside of
 256-byte region [ffff8881dc7ae000, ffff8881dc7ae100)
The buggy address belongs to the page:
page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
flags: 0x2fffc0000000200(slab)
raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00

There are already cleanup handlings in serial_ir_init error path,
no need to call serial_ir_exit do it again in serial_ir_init_module,
otherwise will trigger a use-after-free issue.

Fixes: fa5dc29c1f ("[media] lirc_serial: move out of staging and rename to serial_ir")

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-03-19 16:46:20 -04:00
..
img-ir media: img-ir: Drop METAG dependency 2018-03-05 16:34:25 +00:00
keymaps media: rc: fix several typos 2019-03-01 09:39:39 -05:00
ati_remote.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
bpf-lirc.c media: bpf: add bpf function to report mouse movement 2018-12-09 14:37:18 -08:00
ene_ir.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
ene_ir.h media: rc: fix several typos 2019-03-01 09:39:39 -05:00
fintek-cir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
fintek-cir.h media: rc: fix several typos 2019-03-01 09:39:39 -05:00
gpio-ir-recv.c [media] media: rc: fix gpio-ir-receiver build failure 2017-10-05 10:16:21 -03:00
gpio-ir-tx.c media: rc: gpio-ir-tx: use ktime accessor functions 2017-08-31 05:35:54 -04:00
igorplugusb.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
iguanair.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
imon_raw.c media: rc: imon_raw: use fls rather than loop per bit 2018-11-22 13:29:27 -05:00
imon.c media: rc: imon: replace strcpy() by strscpy() 2018-11-22 13:32:47 -05:00
ir-hix5hd2.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
ir-imon-decoder.c media: rc: imon: report mouse events using rc-core's input device 2018-10-05 06:55:08 -04:00
ir-jvc-decoder.c media: rc: set timeout to smallest value required by enabled protocols 2018-04-20 09:14:31 -04:00
ir-mce_kbd-decoder.c media: rc: mce_kbd: input events via rc-core's input device 2018-10-05 06:56:24 -04:00
ir-nec-decoder.c media: rc: set timeout to smallest value required by enabled protocols 2018-04-20 09:14:31 -04:00
ir-rc5-decoder.c media: rc: decoders do not need to check for transitions 2018-05-14 07:16:24 -04:00
ir-rc6-decoder.c media: rc: ir-rc6-decoder: enable toggle bit for Zotac remotes 2019-02-18 15:40:32 -05:00
ir-rcmm-decoder.c media: rc: remove unused including <linux/version.h> 2019-03-19 16:45:25 -04:00
ir-rx51.c ARM: OMAP2+: Drop unused pm-noop 2018-04-16 10:22:40 -07:00
ir-sanyo-decoder.c media: rc: set timeout to smallest value required by enabled protocols 2018-04-20 09:14:31 -04:00
ir-sharp-decoder.c media: rc: set timeout to smallest value required by enabled protocols 2018-04-20 09:14:31 -04:00
ir-sony-decoder.c media: rc: set timeout to smallest value required by enabled protocols 2018-04-20 09:14:31 -04:00
ir-spi.c media: rc: ir-spi: update Andi's e-mail 2018-04-20 09:23:28 -04:00
ir-xmp-decoder.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
ite-cir.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
ite-cir.h media: rc: ite-cir: lower timeout and extend allowed timeout range 2018-05-14 07:17:28 -04:00
Kconfig media: rc: fix several typos 2019-03-01 09:39:39 -05:00
lirc_dev.c media updates for v4.18-rc1 2018-06-07 12:34:37 -07:00
Makefile media: rc: rcmm decoder and encoder 2019-02-18 15:39:49 -05:00
mceusb.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
meson-ir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
mtk-cir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
nuvoton-cir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
nuvoton-cir.h
pwm-ir-tx.c
rc-core-priv.h media: rc: rcmm decoder and encoder 2019-02-18 15:39:49 -05:00
rc-ir-raw.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
rc-loopback.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
rc-main.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
redrat3.c media: rc: fix several typos 2019-03-01 09:39:39 -05:00
serial_ir.c media: serial_ir: Fix use-after-free in serial_ir_init_module 2019-03-19 16:46:20 -04:00
sir_ir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
st_rc.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
streamzap.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
sunxi-cir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
tango-ir.c media: rc: Add driver for tango HW IR decoder 2017-10-11 12:41:08 -04:00
ttusbir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
winbond-cir.c media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros 2018-10-04 14:22:27 -04:00
xbox_remote.c media: rc: XBox DVD Remote uses 12 bits scancodes 2018-11-22 13:28:24 -05:00
zx-irdec.c