lkml.org 
[lkml]   [2021]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] rsi_usb: Fix use-after-free in rsi_rx_done_handler
Date
Zekun Shen <bruceshenzk@gmail.com> writes:

> When freeing rx_cb->rx_skb, the pointer is not set to NULL,
> a later rsi_rx_done_handler call will try to read the freed
> address.
> This bug will very likley lead to double free, although
> detected early as use-after-free bug.
>
> The bug is triggerable with a compromised/malfunctional usb
> device. After applying the patch, the same input no longer
> triggers the use-after-free.
>
> Attached is the kasan report from fuzzing.
>
> BUG: KASAN: use-after-free in rsi_rx_done_handler+0x354/0x430 [rsi_usb]
> Read of size 4 at addr ffff8880188e5930 by task modprobe/231
> Call Trace:
> <IRQ>
> dump_stack+0x76/0xa0
> print_address_description.constprop.0+0x16/0x200
> ? rsi_rx_done_handler+0x354/0x430 [rsi_usb]
> ? rsi_rx_done_handler+0x354/0x430 [rsi_usb]
> __kasan_report.cold+0x37/0x7c
> ? dma_direct_unmap_page+0x90/0x110
> ? rsi_rx_done_handler+0x354/0x430 [rsi_usb]
> kasan_report+0xe/0x20
> rsi_rx_done_handler+0x354/0x430 [rsi_usb]
> __usb_hcd_giveback_urb+0x1e4/0x380
> usb_giveback_urb_bh+0x241/0x4f0
> ? __usb_hcd_giveback_urb+0x380/0x380
> ? apic_timer_interrupt+0xa/0x20
> tasklet_action_common.isra.0+0x135/0x330
> __do_softirq+0x18c/0x634
> ? handle_irq_event+0xcd/0x157
> ? handle_edge_irq+0x1eb/0x7b0
> irq_exit+0x114/0x140
> do_IRQ+0x91/0x1e0
> common_interrupt+0xf/0xf
> </IRQ>
>
> Reported-by: Zekun Shen <bruceshenzk@gmail.com>
> Reported-by: Brendan Dolan-Gavitt <brendandg@nyu.edu>
> Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>

There's no need to have the author in Reported-by tag, so I'll remove
that.

--
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

\
 
 \ /
  Last update: 2021-11-01 15:12    [W:0.041 / U:0.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site