Received: by 2002:a25:c593:0:0:0:0:0 with SMTP id v141csp999884ybe; Mon, 2 Sep 2019 12:33:55 -0700 (PDT) X-Google-Smtp-Source: APXvYqwMwWZRMjS7EDeuonpk3uC+ajWsAMI0WixXZgFJbEKmnjhNWgbymuo9Y1Q0sjcpMx987ek9 X-Received: by 2002:a17:90a:ba06:: with SMTP id s6mr14088515pjr.69.1567452835594; Mon, 02 Sep 2019 12:33:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1567452835; cv=none; d=google.com; s=arc-20160816; b=bqjA392J0yv2e4VtegxA7PJxkSsI/ctmIVEIXaBeFBCxz1u3gAVdcP0RetuMVxJNPW HL1aEcPFj0qy293PfUKJ5+leIgoltj1kco6LLs2syNBflauXQkywfsuZyh3Kos2ALqtY 09O5+06QOZCGSRNP5tnk7an399ppWQu28cK5NxmDEOylBGt1yUEfK3irMfxGR07GqU84 SERJp2MsszebwuSIGzP25vwcdf4NfcBaoNraw8DFwt+yV8NiQVrdfA5tQAfb6p6ud4yb iSX83ymMp4uL0jrcjGOfUIJJ/rGeC+GMJP+qURmIzF5+Agf40fhkiiqbSU05gD6FVC+d UhLw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject:dkim-signature; bh=8uh9/XY6ueQfpSKxv8VJgELq8LY9QmNiFoOeViVR+c4=; b=rTkO44PYSvm1LAJYhTu/ra4M8P3r9LPyTZb01egqKaCtottCF03OgjKoLURKfq3ByZ qK8GP1jGwuTRs4hvtd/ZAt7gqBf6Ym120l9OeyybdsNL/zQNc7T4nMRhPuoTuKESwS1K 2ghZ8y+QgW1caBZAJFL9QTay+KB/OlQjChwxU8LG9NjjT8+7HUx9rG3VhnZe10l24yLg O8WNoNsWc60LUwHzd349P4s0r8Sda/lBE3YGES6eF9FoPN9dCWIJoz7HUhG5l7vSZaTa FrnS09Esoao52KbXQeLgVbuJC+XGj7XsHJimomTwNHHwg2+lRTRHs3I2YMSd42qh+KlW b5LA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b=pxQviwEB; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z190si12235702pgb.182.2019.09.02.12.33.37; Mon, 02 Sep 2019 12:33:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b=pxQviwEB; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727146AbfIBTcm (ORCPT + 99 others); Mon, 2 Sep 2019 15:32:42 -0400 Received: from mail-pg1-f196.google.com ([209.85.215.196]:42995 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726997AbfIBTcm (ORCPT ); Mon, 2 Sep 2019 15:32:42 -0400 Received: by mail-pg1-f196.google.com with SMTP id p3so7846606pgb.9; Mon, 02 Sep 2019 12:32:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=8uh9/XY6ueQfpSKxv8VJgELq8LY9QmNiFoOeViVR+c4=; b=pxQviwEBr0hEsNe1eCykn9M13dqO4mBqfwj1m4MWuDTkWkG1B1LZzsTNWegeoiL1lP 00DtTplx0zqiFxhT56al/XqE3yasqKgdVyNUuz7aygxtgDMHjgorrndMHCKqN0yhK2uD 7/3G5Fj4npqW6VrT+9aQwJEPwcY5kM7sWlv27K1NpbLPzf75Y82nJL0tk5W9sTEeZrOs Nsq68NrEn+S1AvwCZvc3CyoHDWFBwjU1HPjkM4rdBq/SdrSg7owZi9APYacuzdGcejmc kypgTMmRWfZK/iQDjbZhYK0NkB9o7AKYlkFx327UltxETd2zlnCmbTx3VFUa018uAh1F c/DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:subject:to:cc:references:from:message-id :date:user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=8uh9/XY6ueQfpSKxv8VJgELq8LY9QmNiFoOeViVR+c4=; b=ScIUzUF3gOtpeYbiqRbrznDchQqQwWQ6nNSaFgVe0Fy0f0PvVKmUv0v3INb6oQ0VqY O/WgNbb33k4RaCWEfgJgTxjmp2bp3zAAoH7Yv9/0W2HIrkL8acL0gOui98ylkSjGsTjh /7m2jImicvB3gj4qcq+otfFQRh/D/8KmpRWOc0xGNQFyEZdL8qyzathor+4XLDUGXutj 0BG0Cdk/psXGzr/Rn8+DZlH1kysojniN0doFoJACt/OIbVYD0EJxMKszPZlZG1WW0/qc 0HFz9hahhXglNM5fdzK43tcxLd+dcWtrltSHMzmGPJKwPI0qPRpTl6crwUGHx9LibxJQ 8hCw== X-Gm-Message-State: APjAAAVR3i43N0M+qwaodXvoMeWBtPlo7cRoPNjbwyXQd0zkX91WUxm2 pUoQgmPI7ZP+BdmLNCHpc49WJRdR X-Received: by 2002:aa7:809a:: with SMTP id v26mr36157719pff.82.1567452760864; Mon, 02 Sep 2019 12:32:40 -0700 (PDT) Received: from server.roeck-us.net ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id i6sm10739350pfq.20.2019.09.02.12.32.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Sep 2019 12:32:39 -0700 (PDT) Subject: Re: [PATCH] Fix a double free bug in rsi_91x_deinit To: Greg KH Cc: Kalle Valo , Hui Peng , security@kernel.org, Mathias Payer , "David S. Miller" , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20190819220230.10597-1-benquike@gmail.com> <20190831181852.GA22160@roeck-us.net> <87k1asqw87.fsf@kamboji.qca.qualcomm.com> <385361d3-048e-9b3f-c749-aa5861e397e7@roeck-us.net> <20190902184722.GC5697@kroah.com> From: Guenter Roeck Message-ID: <804fb4dc-23e5-3442-c64e-9857d61d6b6c@roeck-us.net> Date: Mon, 2 Sep 2019 12:32:37 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <20190902184722.GC5697@kroah.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 9/2/19 11:47 AM, Greg KH wrote: > On Sun, Sep 01, 2019 at 07:08:29AM -0700, Guenter Roeck wrote: >> On 9/1/19 1:03 AM, Kalle Valo wrote: >>> Guenter Roeck writes: >>> >>>> On Mon, Aug 19, 2019 at 06:02:29PM -0400, Hui Peng wrote: >>>>> `dev` (struct rsi_91x_usbdev *) field of adapter >>>>> (struct rsi_91x_usbdev *) is allocated and initialized in >>>>> `rsi_init_usb_interface`. If any error is detected in information >>>>> read from the device side, `rsi_init_usb_interface` will be >>>>> freed. However, in the higher level error handling code in >>>>> `rsi_probe`, if error is detected, `rsi_91x_deinit` is called >>>>> again, in which `dev` will be freed again, resulting double free. >>>>> >>>>> This patch fixes the double free by removing the free operation on >>>>> `dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also >>>>> used in `rsi_disconnect`, in that code path, the `dev` field is not >>>>> (and thus needs to be) freed. >>>>> >>>>> This bug was found in v4.19, but is also present in the latest version >>>>> of kernel. >>>>> >>>>> Reported-by: Hui Peng >>>>> Reported-by: Mathias Payer >>>>> Signed-off-by: Hui Peng >>>> >>>> FWIW: >>>> >>>> Reviewed-by: Guenter Roeck >>>> >>>> This patch is listed as fix for CVE-2019-15504, which has a CVSS 2.0 score >>>> of 10.0 (high) and CVSS 3.0 score of 9.8 (critical). >>> >>> A double free in error path is considered as a critical CVE issue? I'm >>> very curious, why is that? >>> >> >> You'd have to ask the people assigning CVSS scores. However, if the memory >> was reallocated, that reallocated memory (which is still in use) is freed. >> Then all kinds of bad things can happen. > > Yes, but moving from "bad things _can_ happen" to "bad things happen" in > an instance like this will be a tough task. It also requires physical > access to the machine. > Is this correct even with usbip enabled ? > Anyway, that doesn't mean we shouldn't fix it, it's just that CVSS can > be crazy when it comes to kernel patches (i.e. almost all fixes should > be "critical"...) > Not all of them, but probably too many. That is why I asked if the problem is real. I _used_ to trust CVSS scores, but by now I am at least somewhat suspicious - especially if a patch wasn't applied for a period of time, like this series of usb patches. Having said that, I am even more wary of double-free problems - those tend to be notoriously difficult to debug. I'd rather have them out of my way, even if they are unlikely to be seen in the real world (plus, Murphy says that anything unlikely is going to happen almost immediately). Guenter