lkml.org 
[lkml]   [2021]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 004/188] net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    commit ab4a0b8fcb9a95c02909b62049811bd2e586aaa4 upstream.

    In ems_usb_disconnect() dev pointer, which is netdev private data, is
    used after free_candev() call:
    | if (dev) {
    | unregister_netdev(dev->netdev);
    | free_candev(dev->netdev);
    |
    | unlink_all_urbs(dev);
    |
    | usb_free_urb(dev->intr_urb);
    |
    | kfree(dev->intr_in_buffer);
    | kfree(dev->tx_msg_buffer);
    | }

    Fix it by simply moving free_candev() at the end of the block.

    Fail log:
    | BUG: KASAN: use-after-free in ems_usb_disconnect
    | Read of size 8 at addr ffff88804e041008 by task kworker/1:2/2895
    |
    | CPU: 1 PID: 2895 Comm: kworker/1:2 Not tainted 5.13.0-rc5+ #164
    | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.4
    | Workqueue: usb_hub_wq hub_event
    | Call Trace:
    | dump_stack (lib/dump_stack.c:122)
    | print_address_description.constprop.0.cold (mm/kasan/report.c:234)
    | kasan_report.cold (mm/kasan/report.c:420 mm/kasan/report.c:436)
    | ems_usb_disconnect (drivers/net/can/usb/ems_usb.c:683 drivers/net/can/usb/ems_usb.c:1058)

    Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
    Link: https://lore.kernel.org/r/20210617185130.5834-1-paskripkin@gmail.com
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/can/usb/ems_usb.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/net/can/usb/ems_usb.c
    +++ b/drivers/net/can/usb/ems_usb.c
    @@ -1071,7 +1071,6 @@ static void ems_usb_disconnect(struct us

    if (dev) {
    unregister_netdev(dev->netdev);
    - free_candev(dev->netdev);

    unlink_all_urbs(dev);

    @@ -1079,6 +1078,8 @@ static void ems_usb_disconnect(struct us

    kfree(dev->intr_in_buffer);
    kfree(dev->tx_msg_buffer);
    +
    + free_candev(dev->netdev);
    }
    }


    \
     
     \ /
      Last update: 2021-07-19 16:59    [W:3.534 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site