Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753074AbdLMLAe (ORCPT ); Wed, 13 Dec 2017 06:00:34 -0500 Received: from mga05.intel.com ([192.55.52.43]:1764 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752588AbdLMLA0 (ORCPT ); Wed, 13 Dec 2017 06:00:26 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,397,1508828400"; d="scan'208";a="11480785" Subject: Re: [PATCH] xhci: Fix use-after-free in xhci debugfs To: Alexander Kappner Cc: Mathias Nyman , Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org References: <1512944098-4673-1-git-send-email-agk@godking.net> From: Mathias Nyman Message-ID: Date: Wed, 13 Dec 2017 13:02:58 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <1512944098-4673-1-git-send-email-agk@godking.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4020 Lines: 77 On 11.12.2017 00:14, Alexander Kappner wrote: > Trying to read from debugfs after the system has resumed from > hibernate causes a use-after-free and thus a protection fault. > > Steps to reproduce: > Hibernate system, resume from hibernate, then run > $ cat /sys/kernel/debug/usb/xhci/*/command-ring/enqueue > > dmesg below: > > [ 3902.765086] general protection fault: 0000 [#1] PREEMPT SMP > [ 3902.765095] Modules linked in: ipheth nvidia_modeset(PO) iwlmvm mac80211 nvidia(PO) iwlwifi qmi_wwan cfg80211 thinkpad_acpi rfkill > [ 3902.765118] CPU: 4 PID: 3591 Comm: cat Tainted: P O 4.14.0.1-12769-g1deab8c #1 > [ 3902.765121] Hardware name: LENOVO 20ENCTO1WW/20ENCTO1WW, BIOS N1EET62W (1.35 ) 11/10/2016 > [ 3902.765125] task: ffff88100263d040 task.stack: ffffc90006e50000 > [ 3902.765136] RIP: 0010:xhci_trb_virt_to_dma.part.50+0x5/0x30 > [ 3902.765140] RSP: 0018:ffffc90006e53da8 EFLAGS: 00010286 > [ 3902.765144] RAX: ffff88100a57e680 RBX: ffff8810032f1900 RCX: ffff881013800900 > [ 3902.765147] RDX: 0000000000000000 RSI: ffff881000abf488 RDI: 0d0c0a0bb1637008 > [ 3902.765151] RBP: ffffc90006e53f00 R08: 0000000000000000 R09: 0000000000000000 > [ 3902.765154] R10: 00007ffcd73165e0 R11: ffff88100263d040 R12: ffff880bd5afcc00 > [ 3902.765157] R13: 0000000000020000 R14: 0000000000000001 R15: ffff8810032f1900 > [ 3902.765161] FS: 00007f6aa6cec700(0000) GS:ffff881053d00000(0000) knlGS:0000000000000000 > [ 3902.765165] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 3902.765168] CR2: 00007f6aa6d08008 CR3: 00000010033f9003 CR4: 00000000003606e0 > [ 3902.765172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [ 3902.765175] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > [ 3902.765178] Call Trace: > [ 3902.765188] xhci_ring_enqueue_show+0x1e/0x40 > [ 3902.765197] seq_read+0xdb/0x3a0 > [ 3902.765204] ? __handle_mm_fault+0x5fb/0x1210 > [ 3902.765211] full_proxy_read+0x4a/0x70 > [ 3902.765219] __vfs_read+0x23/0x120 > [ 3902.765228] vfs_read+0x8e/0x130 > [ 3902.765235] SyS_read+0x42/0x90 > [ 3902.765242] do_syscall_64+0x6b/0x290 > [ 3902.765251] entry_SYSCALL64_slow_path+0x25/0x25 > [ 3902.765256] RIP: 0033:0x7f6aa683cba0 > [ 3902.765260] RSP: 002b:00007ffcd7316818 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 > [ 3902.765264] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f6aa683cba0 > [ 3902.765267] RDX: 0000000000020000 RSI: 00007f6aa6d09000 RDI: 0000000000000003 > [ 3902.765270] RBP: 0000000000020000 R08: 00000000ffffffff R09: 0000000000000000 > [ 3902.765274] R10: 00007ffcd73165e0 R11: 0000000000000246 R12: 00007f6aa6d09000 > [ 3902.765277] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000020000 > [ 3902.765282] Code: 0f 44 c0 49 8b 04 24 52 48 c7 c2 30 cd cb 81 48 8d b0 98 00 00 00 31 c0 e8 39 e6 dc ff 58 e9 75 ff ff ff 0f 1f 00 0f 1f 44 00 00 <48> 8b 17 31 c0 48 39 f2 77 13 48 29 d6 48 81 fe ff 0f 00 00 77 > [ 3902.765371] RIP: xhci_trb_virt_to_dma.part.50+0x5/0x30 RSP: ffffc90006e53da8 > [ 3902.765376] ---[ end trace 9ee53de1dccf7d8e ]--- > > The issue is caused by the xhci ring structures being reallocated > when the system is resumed, but pointers to the old structures > being retained in the debugfs files "private" field: > > (gdb) list *(xhci_ring_enqueue_show+0x1e) > 0xffffffff8170403e is in xhci_ring_enqueue_show (drivers/usb/host/xhci-debugfs.c:168). > 163 { > 164 dma_addr_t dma; > 165 struct xhci_ring *ring = s->private; > 166 > 167 dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue); > 168 seq_printf(s, "%pad\n", &dma); > 169 > 170 return 0; > 171 } > 172 > > The proposed patch fixes this issue by storing a pointer to the xhci_ring > field in the xhci device structure in debugfs rather than directly > storing a pointer to the xhci_ring. > > Signed-off-by: Alexander Kappner > --- Thanks, that should work. I'll try it out, and shorten the commit message a bit. If everything works I'll apply it to my for-usb-linus branch -Mathias