The USB device descriptor may get changed between two consecutive enumerations on the same device for some reason, such as DFU or malicius device. In that case, we may access the changing descriptor if we don't take the device lock here.
The issue is reported: https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be...
Cc: stable stable@vger.kernel.org Cc: Alan Stern stern@rowland.harvard.edu Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute") Signed-off-by: Zeng Tao prime.zeng@hisilicon.com --- drivers/usb/core/sysfs.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c index a2ca38e..8d13419 100644 --- a/drivers/usb/core/sysfs.c +++ b/drivers/usb/core/sysfs.c @@ -889,7 +889,11 @@ read_descriptors(struct file *filp, struct kobject *kobj, size_t srclen, n; int cfgno; void *src; + int retval;
+ retval = usb_lock_device_interruptible(udev); + if (retval < 0) + return -EINTR; /* The binary attribute begins with the device descriptor. * Following that are the raw descriptor entries for all the * configurations (config plus subsidiary descriptors). @@ -914,6 +918,7 @@ read_descriptors(struct file *filp, struct kobject *kobj, off -= srclen; } } + usb_unlock_device(udev); return count - nleft; }
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag fixing commit: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute").
The bot has tested the following trees: v5.8.6, v5.4.62, v4.19.143, v4.14.196, v4.9.235, v4.4.235.
v5.8.6: Build OK! v5.4.62: Build OK! v4.19.143: Build OK! v4.14.196: Build OK! v4.9.235: Build OK! v4.4.235: Build failed! Errors: drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
-----Original Message----- From: Sasha Levin [mailto:sashal@kernel.org] Sent: Sunday, September 06, 2020 11:16 AM To: Sasha Levin; Zengtao (B); gregkh@linuxfoundation.org Cc: Zengtao (B); stable; Alan Stern; stable@vger.kernel.org Subject: Re: [PATCH] usb: core: fix slab-out-of-bounds Read in read_descriptors
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag fixing commit: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute").
The bot has tested the following trees: v5.8.6, v5.4.62, v4.19.143, v4.14.196, v4.9.235, v4.4.235.
v5.8.6: Build OK! v5.4.62: Build OK! v4.19.143: Build OK! v4.14.196: Build OK! v4.9.235: Build OK! v4.4.235: Build failed! Errors: drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function 'usb_lock_device_interruptible'; did you mean 'usb_lock_device_for_reset'? [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration] drivers/usb/core/sysfs.c:825:11: error: implicit declaration of function ‘usb_lock_device_interruptible’ [-Werror=implicit-function-declaration]
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
Need 7dd9cba5bb90 ("usb: sysfs: make locking interruptible")?
-- Thanks Sasha
linux-stable-mirror@lists.linaro.org
-
Sasha Levin -
Zeng Tao -
Zengtao (B)