https://github.com/torvalds/linux
Revision dde634057da71a3505d7a6c0b77bb24ded6728c8 authored by Alexander Kappner on 21 December 2017, 13:06:14 UTC, committed by Greg Kroah-Hartman on 27 December 2017, 14:24:27 UTC
Trying to read from debugfs after the system has resumed from
hibernate causes a use-after-free and thus a protection fault.
Steps to reproduce:
Hibernate system, resume from hibernate, then run
$ cat /sys/kernel/debug/usb/xhci/*/command-ring/enqueue
[ 3902.765086] general protection fault: 0000 [#1] PREEMPT SMP
...
[ 3902.765136] RIP: 0010:xhci_trb_virt_to_dma.part.50+0x5/0x30
...
[ 3902.765178] Call Trace:
[ 3902.765188] xhci_ring_enqueue_show+0x1e/0x40
[ 3902.765197] seq_read+0xdb/0x3a0
[ 3902.765204] ? __handle_mm_fault+0x5fb/0x1210
[ 3902.765211] full_proxy_read+0x4a/0x70
[ 3902.765219] __vfs_read+0x23/0x120
[ 3902.765228] vfs_read+0x8e/0x130
[ 3902.765235] SyS_read+0x42/0x90
[ 3902.765242] do_syscall_64+0x6b/0x290
[ 3902.765251] entry_SYSCALL64_slow_path+0x25/0x25
The issue is caused by the xhci ring structures being reallocated
when the system is resumed, but pointers to the old structures
being retained in the debugfs files "private" field:
The proposed patch fixes this issue by storing a pointer to the xhci_ring
field in the xhci device structure in debugfs rather than directly
storing a pointer to the xhci_ring.
Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver")
Signed-off-by: Alexander Kappner <agk@godking.net>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 052f71e
Tip revision: dde634057da71a3505d7a6c0b77bb24ded6728c8 authored by Alexander Kappner on 21 December 2017, 13:06:14 UTC
xhci: Fix use-after-free in xhci debugfs
xhci: Fix use-after-free in xhci debugfs
Tip revision: dde6340
| File | Mode | Size |
|---|---|---|
| 842 | ||
| fonts | ||
| lz4 | ||
| lzo | ||
| mpi | ||
| raid6 | ||
| reed_solomon | ||
| xz | ||
| zlib_deflate | ||
| zlib_inflate | ||
| zstd | ||
| .gitignore | -rw-r--r-- | 70 bytes |
| Kconfig | -rw-r--r-- | 12.9 KB |
| Kconfig.debug | -rw-r--r-- | 66.3 KB |
| Kconfig.kasan | -rw-r--r-- | 1.8 KB |
| Kconfig.kgdb | -rw-r--r-- | 4.1 KB |
| Kconfig.ubsan | -rw-r--r-- | 1.5 KB |
| Makefile | -rw-r--r-- | 8.3 KB |
| argv_split.c | -rw-r--r-- | 2.1 KB |
| ashldi3.c | -rw-r--r-- | 1.1 KB |
| ashrdi3.c | -rw-r--r-- | 1.2 KB |
| asn1_decoder.c | -rw-r--r-- | 13.4 KB |
| assoc_array.c | -rw-r--r-- | 52.0 KB |
| atomic64.c | -rw-r--r-- | 4.8 KB |
| atomic64_test.c | -rw-r--r-- | 6.6 KB |
| audit.c | -rw-r--r-- | 1.8 KB |
| bcd.c | -rw-r--r-- | 297 bytes |
| bch.c | -rw-r--r-- | 35.6 KB |
| bitmap.c | -rw-r--r-- | 36.4 KB |
| bitrev.c | -rw-r--r-- | 1.9 KB |
| bsearch.c | -rw-r--r-- | 1.5 KB |
| btree.c | -rw-r--r-- | 19.2 KB |
| bug.c | -rw-r--r-- | 5.4 KB |
| build_OID_registry | -rwxr-xr-x | 4.7 KB |
| bust_spinlocks.c | -rw-r--r-- | 696 bytes |
| chacha20.c | -rw-r--r-- | 2.6 KB |
| check_signature.c | -rw-r--r-- | 635 bytes |
| checksum.c | -rw-r--r-- | 5.0 KB |
| clz_ctz.c | -rw-r--r-- | 1.3 KB |
| clz_tab.c | -rw-r--r-- | 891 bytes |
| cmdline.c | -rw-r--r-- | 5.1 KB |
| cmpdi2.c | -rw-r--r-- | 1.1 KB |
| compat_audit.c | -rw-r--r-- | 832 bytes |
| cordic.c | -rw-r--r-- | 2.5 KB |
| cpu_rmap.c | -rw-r--r-- | 7.8 KB |
| cpumask.c | -rw-r--r-- | 5.8 KB |
| crc-ccitt.c | -rw-r--r-- | 3.0 KB |
| crc-itu-t.c | -rw-r--r-- | 2.8 KB |
| crc-t10dif.c | -rw-r--r-- | 1.6 KB |
| crc16.c | -rw-r--r-- | 2.8 KB |
| crc32.c | -rw-r--r-- | 9.1 KB |
| crc32defs.h | -rw-r--r-- | 2.0 KB |
| crc32test.c | -rw-r--r-- | 37.5 KB |
| crc4.c | -rw-r--r-- | 1.1 KB |
| crc7.c | -rw-r--r-- | 2.6 KB |
| crc8.c | -rw-r--r-- | 2.4 KB |
| ctype.c | -rw-r--r-- | 1.4 KB |
| debug_info.c | -rw-r--r-- | 777 bytes |
| debug_locks.c | -rw-r--r-- | 1.2 KB |
| debugobjects.c | -rw-r--r-- | 28.3 KB |
| dec_and_lock.c | -rw-r--r-- | 820 bytes |
| decompress.c | -rw-r--r-- | 1.7 KB |
| decompress_bunzip2.c | -rw-r--r-- | 23.5 KB |
| decompress_inflate.c | -rw-r--r-- | 4.5 KB |
| decompress_unlz4.c | -rw-r--r-- | 4.2 KB |
| decompress_unlzma.c | -rw-r--r-- | 15.8 KB |
| decompress_unlzo.c | -rw-r--r-- | 7.1 KB |
| decompress_unxz.c | -rw-r--r-- | 10.9 KB |
| devres.c | -rw-r--r-- | 9.8 KB |
| digsig.c | -rw-r--r-- | 5.7 KB |
| div64.c | -rw-r--r-- | 4.3 KB |
| dma-debug.c | -rw-r--r-- | 44.5 KB |
| dma-noop.c | -rw-r--r-- | 1.6 KB |
| dma-virt.c | -rw-r--r-- | 1.4 KB |
| dump_stack.c | -rw-r--r-- | 1.2 KB |
| dynamic_debug.c | -rw-r--r-- | 25.5 KB |
| dynamic_queue_limits.c | -rw-r--r-- | 4.3 KB |
| earlycpio.c | -rw-r--r-- | 4.0 KB |
| errseq.c | -rw-r--r-- | 6.5 KB |
| extable.c | -rw-r--r-- | 3.2 KB |
| fault-inject.c | -rw-r--r-- | 6.2 KB |
| fdt.c | -rw-r--r-- | 69 bytes |
| fdt_empty_tree.c | -rw-r--r-- | 80 bytes |
| fdt_ro.c | -rw-r--r-- | 72 bytes |
| fdt_rw.c | -rw-r--r-- | 72 bytes |
| fdt_strerror.c | -rw-r--r-- | 78 bytes |
| fdt_sw.c | -rw-r--r-- | 72 bytes |
| fdt_wip.c | -rw-r--r-- | 73 bytes |
| find_bit.c | -rw-r--r-- | 4.5 KB |
| flex_array.c | -rw-r--r-- | 11.0 KB |
| flex_proportions.c | -rw-r--r-- | 6.9 KB |
| gcd.c | -rw-r--r-- | 1.4 KB |
| gen_crc32table.c | -rw-r--r-- | 3.3 KB |
| genalloc.c | -rw-r--r-- | 21.6 KB |
| glob.c | -rw-r--r-- | 3.5 KB |
| globtest.c | -rw-r--r-- | 4.2 KB |
| hexdump.c | -rw-r--r-- | 8.3 KB |
| hweight.c | -rw-r--r-- | 2.0 KB |
| idr.c | -rw-r--r-- | 14.2 KB |
| inflate.c | -rw-r--r-- | 38.7 KB |
| int_sqrt.c | -rw-r--r-- | 691 bytes |
| interval_tree.c | -rw-r--r-- | 499 bytes |
| interval_tree_test.c | -rw-r--r-- | 3.4 KB |
| iomap.c | -rw-r--r-- | 6.5 KB |
| iomap_copy.c | -rw-r--r-- | 2.8 KB |
| iommu-common.c | -rw-r--r-- | 7.0 KB |
| iommu-helper.c | -rw-r--r-- | 1.0 KB |
| ioremap.c | -rw-r--r-- | 4.1 KB |
| iov_iter.c | -rw-r--r-- | 34.1 KB |
| irq_poll.c | -rw-r--r-- | 5.4 KB |
| irq_regs.c | -rw-r--r-- | 604 bytes |
| is_single_threaded.c | -rw-r--r-- | 1.4 KB |
| jedec_ddr_data.c | -rw-r--r-- | 3.0 KB |
| kasprintf.c | -rw-r--r-- | 1.4 KB |
| kfifo.c | -rw-r--r-- | 12.7 KB |
| klist.c | -rw-r--r-- | 10.3 KB |
| kobject.c | -rw-r--r-- | 26.1 KB |
| kobject_uevent.c | -rw-r--r-- | 15.0 KB |
| kstrtox.c | -rw-r--r-- | 10.7 KB |
| kstrtox.h | -rw-r--r-- | 293 bytes |
| lcm.c | -rw-r--r-- | 441 bytes |
| libcrc32c.c | -rw-r--r-- | 2.1 KB |
| list_debug.c | -rw-r--r-- | 1.8 KB |
| list_sort.c | -rw-r--r-- | 3.6 KB |
| llist.c | -rw-r--r-- | 3.1 KB |
| locking-selftest-hardirq.h | -rw-r--r-- | 246 bytes |
| locking-selftest-mutex.h | -rw-r--r-- | 159 bytes |
| locking-selftest-rlock-hardirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-rlock-softirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-rlock.h | -rw-r--r-- | 197 bytes |
| locking-selftest-rsem.h | -rw-r--r-- | 202 bytes |
| locking-selftest-rtmutex.h | -rw-r--r-- | 162 bytes |
| locking-selftest-softirq.h | -rw-r--r-- | 246 bytes |
| locking-selftest-spin-hardirq.h | -rw-r--r-- | 73 bytes |
| locking-selftest-spin-softirq.h | -rw-r--r-- | 73 bytes |
| locking-selftest-spin.h | -rw-r--r-- | 157 bytes |
| locking-selftest-wlock-hardirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-wlock-softirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-wlock.h | -rw-r--r-- | 197 bytes |
| locking-selftest-wsem.h | -rw-r--r-- | 202 bytes |
| locking-selftest.c | -rw-r--r-- | 43.7 KB |
| lockref.c | -rw-r--r-- | 3.9 KB |
| lru_cache.c | -rw-r--r-- | 19.4 KB |
| lshrdi3.c | -rw-r--r-- | 1.2 KB |
| memory-notifier-error-inject.c | -rw-r--r-- | 1.1 KB |
| memweight.c | -rw-r--r-- | 1.0 KB |
| muldi3.c | -rw-r--r-- | 2.3 KB |
| net_utils.c | -rw-r--r-- | 640 bytes |
| netdev-notifier-error-inject.c | -rw-r--r-- | 1.5 KB |
| nlattr.c | -rw-r--r-- | 17.8 KB |
| nmi_backtrace.c | -rw-r--r-- | 3.1 KB |
| nodemask.c | -rw-r--r-- | 653 bytes |
| notifier-error-inject.c | -rw-r--r-- | 2.7 KB |
| notifier-error-inject.h | -rw-r--r-- | 653 bytes |
| of-reconfig-notifier-error-inject.c | -rw-r--r-- | 1.3 KB |
| oid_registry.c | -rw-r--r-- | 3.9 KB |
| once.c | -rw-r--r-- | 1.4 KB |
| parman.c | -rw-r--r-- | 10.6 KB |
| parser.c | -rw-r--r-- | 8.4 KB |
| pci_iomap.c | -rw-r--r-- | 4.2 KB |
| percpu-refcount.c | -rw-r--r-- | 12.4 KB |
| percpu_counter.c | -rw-r--r-- | 5.9 KB |
| percpu_ida.c | -rw-r--r-- | 9.5 KB |
| percpu_test.c | -rw-r--r-- | 3.2 KB |
| plist.c | -rw-r--r-- | 5.9 KB |
| pm-notifier-error-inject.c | -rw-r--r-- | 1.1 KB |
| prime_numbers.c | -rw-r--r-- | 6.5 KB |
| radix-tree.c | -rw-r--r-- | 62.1 KB |
| random32.c | -rw-r--r-- | 12.8 KB |
| ratelimit.c | -rw-r--r-- | 1.6 KB |
| rational.c | -rw-r--r-- | 1.6 KB |
| rbtree.c | -rw-r--r-- | 18.7 KB |
| rbtree_test.c | -rw-r--r-- | 9.4 KB |
| reciprocal_div.c | -rw-r--r-- | 528 bytes |
| refcount.c | -rw-r--r-- | 10.2 KB |
| rhashtable.c | -rw-r--r-- | 27.1 KB |
| sbitmap.c | -rw-r--r-- | 12.5 KB |
| scatterlist.c | -rw-r--r-- | 21.1 KB |
| seq_buf.c | -rw-r--r-- | 7.9 KB |
| sg_pool.c | -rw-r--r-- | 3.6 KB |
| sg_split.c | -rw-r--r-- | 5.1 KB |
| sha1.c | -rw-r--r-- | 6.1 KB |
| show_mem.c | -rw-r--r-- | 1.3 KB |
| siphash.c | -rw-r--r-- | 11.7 KB |
| smp_processor_id.c | -rw-r--r-- | 1.4 KB |
| sort.c | -rw-r--r-- | 2.5 KB |
| stackdepot.c | -rw-r--r-- | 8.5 KB |
| stmp_device.c | -rw-r--r-- | 2.1 KB |
| string.c | -rw-r--r-- | 22.3 KB |
| string_helpers.c | -rw-r--r-- | 13.5 KB |
| strncpy_from_user.c | -rw-r--r-- | 3.1 KB |
| strnlen_user.c | -rw-r--r-- | 3.4 KB |
| swiotlb.c | -rw-r--r-- | 29.6 KB |
| syscall.c | -rw-r--r-- | 2.7 KB |
| test-kstrtox.c | -rw-r--r-- | 17.3 KB |
| test-string_helpers.c | -rw-r--r-- | 10.3 KB |
| test_bitmap.c | -rw-r--r-- | 12.3 KB |
| test_bpf.c | -rw-r--r-- | 146.9 KB |
| test_debug_virtual.c | -rw-r--r-- | 911 bytes |
| test_find_bit.c | -rw-r--r-- | 3.6 KB |
| test_firmware.c | -rw-r--r-- | 21.8 KB |
| test_hash.c | -rw-r--r-- | 6.3 KB |
| test_hexdump.c | -rw-r--r-- | 5.7 KB |
| test_kasan.c | -rw-r--r-- | 9.9 KB |
| test_kmod.c | -rw-r--r-- | 30.2 KB |
| test_list_sort.c | -rw-r--r-- | 3.3 KB |
| test_module.c | -rw-r--r-- | 753 bytes |
| test_parman.c | -rw-r--r-- | 11.2 KB |
| test_printf.c | -rw-r--r-- | 12.5 KB |
| test_rhashtable.c | -rw-r--r-- | 16.5 KB |
| test_siphash.c | -rw-r--r-- | 7.5 KB |
| test_sort.c | -rw-r--r-- | 754 bytes |
| test_static_key_base.c | -rw-r--r-- | 2.0 KB |
| test_static_keys.c | -rw-r--r-- | 6.0 KB |
| test_string.c | -rw-r--r-- | 2.4 KB |
| test_sysctl.c | -rw-r--r-- | 3.3 KB |
| test_user_copy.c | -rw-r--r-- | 5.6 KB |
| test_uuid.c | -rw-r--r-- | 3.4 KB |
| textsearch.c | -rw-r--r-- | 9.4 KB |
| timerqueue.c | -rw-r--r-- | 3.1 KB |
| ts_bm.c | -rw-r--r-- | 5.3 KB |
| ts_fsm.c | -rw-r--r-- | 10.6 KB |
| ts_kmp.c | -rw-r--r-- | 4.3 KB |
| ubsan.c | -rw-r--r-- | 10.9 KB |
| ubsan.h | -rw-r--r-- | 1.5 KB |
| ucmpdi2.c | -rw-r--r-- | 1.2 KB |
| ucs2_string.c | -rw-r--r-- | 2.4 KB |
| usercopy.c | -rw-r--r-- | 764 bytes |
| uuid.c | -rw-r--r-- | 3.1 KB |
| vsprintf.c | -rw-r--r-- | 72.8 KB |
| win_minmax.c | -rw-r--r-- | 3.4 KB |
| xxhash.c | -rw-r--r-- | 12.7 KB |
Computing file changes ...
