From: Greg Kroah-Hartman Date: Sun, 20 Mar 2022 10:27:02 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.9.308~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=49b5675a2cfc8b3a252df133ec6627150f17a695;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch --- diff --git a/queue-4.14/series b/queue-4.14/series index 61e5c301fb3..3b932d3b94b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -16,3 +16,5 @@ efi-fix-return-value-of-__setup-handlers.patch net-packet-fix-slab-out-of-bounds-access-in-packet_r.patch atm-eni-add-check-for-dma_map_single.patch net-handle-arphrd_pimreg-in-dev_is_mac_header_xmit.patch +usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch +usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch diff --git a/queue-4.14/usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch b/queue-4.14/usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch new file mode 100644 index 00000000000..2800967fa01 --- /dev/null +++ b/queue-4.14/usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch @@ -0,0 +1,86 @@ +From 16b1941eac2bd499f065a6739a40ce0011a3d740 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Sat, 5 Mar 2022 21:47:22 -0500 +Subject: usb: gadget: Fix use-after-free bug by not setting udc->dev.driver + +From: Alan Stern + +commit 16b1941eac2bd499f065a6739a40ce0011a3d740 upstream. + +The syzbot fuzzer found a use-after-free bug: + +BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:2320 +Read of size 8 at addr ffff88802b934098 by task udevd/3689 + +CPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 + __kasan_report mm/kasan/report.c:442 [inline] + kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 + dev_uevent+0x712/0x780 drivers/base/core.c:2320 + uevent_show+0x1b8/0x380 drivers/base/core.c:2391 + dev_attr_show+0x4b/0x90 drivers/base/core.c:2094 + +Although the bug manifested in the driver core, the real cause was a +race with the gadget core. dev_uevent() does: + + if (dev->driver) + add_uevent_var(env, "DRIVER=%s", dev->driver->name); + +and between the test and the dereference of dev->driver, the gadget +core sets dev->driver to NULL. + +The race wouldn't occur if the gadget core registered its devices on +a real bus, using the standard synchronization techniques of the +driver core. However, it's not necessary to make such a large change +in order to fix this bug; all we need to do is make sure that +udc->dev.driver is always NULL. + +In fact, there is no reason for udc->dev.driver ever to be set to +anything, let alone to the value it currently gets: the address of the +gadget's driver. After all, a gadget driver only knows how to manage +a gadget, not how to manage a UDC. + +This patch simply removes the statements in the gadget core that touch +udc->dev.driver. + +Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class") +CC: +Reported-and-tested-by: syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/YiQgukfFFbBnwJ/9@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/core.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -1284,7 +1284,6 @@ static void usb_gadget_remove_driver(str + usb_gadget_udc_stop(udc); + + udc->driver = NULL; +- udc->dev.driver = NULL; + udc->gadget->dev.driver = NULL; + } + +@@ -1333,7 +1332,6 @@ static int udc_bind_to_driver(struct usb + driver->function); + + udc->driver = driver; +- udc->dev.driver = &driver->driver; + udc->gadget->dev.driver = &driver->driver; + + usb_gadget_udc_set_speed(udc, driver->max_speed); +@@ -1355,7 +1353,6 @@ err1: + dev_err(&udc->dev, "failed to start %s: %d\n", + udc->driver->function, ret); + udc->driver = NULL; +- udc->dev.driver = NULL; + udc->gadget->dev.driver = NULL; + return ret; + } diff --git a/queue-4.14/usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch b/queue-4.14/usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch new file mode 100644 index 00000000000..ddaef2ad45f --- /dev/null +++ b/queue-4.14/usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch @@ -0,0 +1,31 @@ +From 65f3324f4b6fed78b8761c3b74615ecf0ffa81fa Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 1 Mar 2022 11:04:24 +0300 +Subject: usb: gadget: rndis: prevent integer overflow in rndis_set_response() + +From: Dan Carpenter + +commit 65f3324f4b6fed78b8761c3b74615ecf0ffa81fa upstream. + +If "BufOffset" is very large the "BufOffset + 8" operation can have an +integer overflow. + +Cc: stable@kernel.org +Fixes: 38ea1eac7d88 ("usb: gadget: rndis: check size of RNDIS_MSG_SET command") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20220301080424.GA17208@kili +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -643,6 +643,7 @@ static int rndis_set_response(struct rnd + BufLength = le32_to_cpu(buf->InformationBufferLength); + BufOffset = le32_to_cpu(buf->InformationBufferOffset); + if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || ++ (BufOffset > RNDIS_MAX_TOTAL_SIZE) || + (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) + return -EINVAL; +