lkml.org 
[lkml]   [2022]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/3] usb: gadget: f_hid: fix f_hidg lifetime vs cdev
From
W dniu 23.11.2022 o 13:03, John Keeping pisze:
> On Wed, Nov 23, 2022 at 12:52:24PM +0100, Andrzej Pietrasiewicz wrote:
>> Hi John,
>>
>> W dniu 22.11.2022 o 13:35, John Keeping pisze:
>>> The embedded struct cdev does not have its lifetime correctly tied to
>>> the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN
>>> is held open while the gadget is deleted.
>>>
>>> This can readily be replicated with libusbgx's example programs (for
>>> conciseness - operating directly via configfs is equivalent):
>>>
>>> gadget-hid
>>> exec 3<> /dev/hidg0
>>> gadget-vid-pid-remove
>>> exec 3<&-
>>>
>>> Pull the existing device up in to struct f_hidg and make use of the
>>> cdev_device_{add,del}() helpers. This changes the lifetime of the
>>> device object to match struct f_hidg, but note that it is still added
>>> and deleted at the same time.
>>>
>>> Fixes: 71adf1189469 ("USB: gadget: add HID gadget driver")
>>> Signed-off-by: John Keeping <john@metanate.com>
>>> ---
>>> drivers/usb/gadget/function/f_hid.c | 52 ++++++++++++++++-------------
>>> 1 file changed, 28 insertions(+), 24 deletions(-)
>>>
>>> diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
>>> index ca0a7d9eaa34..8b8bbeaa27cb 100644
>>> --- a/drivers/usb/gadget/function/f_hid.c
>>> +++ b/drivers/usb/gadget/function/f_hid.c
>>> @@ -71,7 +71,7 @@ struct f_hidg {
>>> wait_queue_head_t write_queue;
>>> struct usb_request *req;
>>> - int minor;
>>> + struct device dev;
>>> struct cdev cdev;
>>> struct usb_function func;
>>> @@ -84,6 +84,14 @@ static inline struct f_hidg *func_to_hidg(struct usb_function *f)
>>> return container_of(f, struct f_hidg, func);
>>> }
>>> +static void hidg_release(struct device *dev)
>>> +{
>>> + struct f_hidg *hidg = container_of(dev, struct f_hidg, dev);
>>> +
>>> + kfree(hidg->set_report_buf);
>>> + kfree(hidg);
>>> +}
>>> +
>>
>> I assume the above is supposed to free the hidg memory as a result of
>> put_device() and you free two things here ...
>>
>>> /*-------------------------------------------------------------------------*/
>>> /* Static descriptors */
>>> @@ -904,9 +912,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
>>> struct usb_ep *ep;
>>> struct f_hidg *hidg = func_to_hidg(f);
>>> struct usb_string *us;
>>> - struct device *device;
>>> int status;
>>> - dev_t dev;
>>> /* maybe allocate device-global string IDs, and patch descriptors */
>>> us = usb_gstrings_attach(c->cdev, ct_func_strings,
>>> @@ -999,21 +1005,11 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
>>> /* create char device */
>>> cdev_init(&hidg->cdev, &f_hidg_fops);
>>> - dev = MKDEV(major, hidg->minor);
>>> - status = cdev_add(&hidg->cdev, dev, 1);
>>> + status = cdev_device_add(&hidg->cdev, &hidg->dev);
>>> if (status)
>>> goto fail_free_descs;
>>> - device = device_create(hidg_class, NULL, dev, NULL,
>>> - "%s%d", "hidg", hidg->minor);
>>> - if (IS_ERR(device)) {
>>> - status = PTR_ERR(device);
>>> - goto del;
>>> - }
>>> -
>>> return 0;
>>> -del:
>>> - cdev_del(&hidg->cdev);
>>> fail_free_descs:
>>> usb_free_all_descriptors(f);
>>> fail:
>>> @@ -1244,9 +1240,7 @@ static void hidg_free(struct usb_function *f)
>>> hidg = func_to_hidg(f);
>>> opts = container_of(f->fi, struct f_hid_opts, func_inst);
>>> - kfree(hidg->report_desc);
>>> - kfree(hidg->set_report_buf);
>>> - kfree(hidg);
>>
>> ... while here 3 things used to be freed. What happens to hidg->report_desc?
>
> This switched to devm to simplify error handling in hidg_alloc().

Ah, right!

Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>

\
 
 \ /
  Last update: 2022-11-23 13:22    [W:0.089 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site