• Xinyong's avatar
    usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() · 1a087f03
    Xinyong authored
    When I debug a kernel crash issue in funcitonfs, found ffs_data.ref
    overflowed, While functionfs is unmounting, ffs_data is put twice.
    
    Commit 43938613 ("drivers, usb: convert ffs_data.ref from atomic_t to
    refcount_t") can avoid refcount overflow, but that is risk some situations.
    So no need put ffs data in ffs_fs_kill_sb, already put in ffs_data_closed.
    
    The issue can be reproduced in Mediatek mt6763 SoC, ffs for ADB device.
    KASAN enabled configuration reports use-after-free errro.
    
    BUG: KASAN: use-after-free in refcount_dec_and_test+0x14/0xe0 at addr ffffffc0579386a0
    Read of size 4 by task umount/4650
    ====================================================
    BUG kmalloc-512 (Tainted: P        W  O   ): kasan: bad access detected
    -----------------------------------------------------------------------------
    
    INFO: Allocated in ffs_fs_mount+0x194/0x844 age=22856 cpu=2 pid=566
        alloc_debug_processing+0x1ac/0x1e8
        ___slab_alloc.constprop.63+0x640/0x648
        __slab_alloc.isra.57.constprop.62+0x24/0x34
        kmem_cache_alloc_trace+0x1a8/0x2bc
        ffs_fs_mount+0x194/0x844
        mount_fs+0x6c/0x1d0
        vfs_kern_mount+0x50/0x1b4
        do_mount+0x258/0x1034
    INFO: Freed in ffs_data_put+0x25c/0x320 age=0 cpu=3 pid=4650
        free_debug_processing+0x22c/0x434
        __slab_free+0x2d8/0x3a0
        kfree+0x254/0x264
        ffs_data_put+0x25c/0x320
        ffs_data_closed+0x124/0x15c
        ffs_fs_kill_sb+0xb8/0x110
        deactivate_locked_super+0x6c/0x98
        deactivate_super+0xb0/0xbc
    INFO: Object 0xffffffc057938600 @offset=1536 fp=0x          (null)
    ......
    Call trace:
    [<ffffff900808cf5c>] dump_backtrace+0x0/0x250
    [<ffffff900808d3a0>] show_stack+0x14/0x1c
    [<ffffff90084a8c04>] dump_stack+0xa0/0xc8
    [<ffffff900826c2b4>] print_trailer+0x158/0x260
    [<ffffff900826d9d8>] object_err+0x3c/0x40
    [<ffffff90082745f0>] kasan_report_error+0x2a8/0x754
    [<ffffff9008274f84>] kasan_report+0x5c/0x60
    [<ffffff9008273208>] __asan_load4+0x70/0x88
    [<ffffff90084cd81c>] refcount_dec_and_test+0x14/0xe0
    [<ffffff9008d98f9c>] ffs_data_put+0x80/0x320
    [<ffffff9008d9d904>] ffs_fs_kill_sb+0xc8/0x110
    [<ffffff90082852a0>] deactivate_locked_super+0x6c/0x98
    [<ffffff900828537c>] deactivate_super+0xb0/0xbc
    [<ffffff90082af0c0>] cleanup_mnt+0x64/0xec
    [<ffffff90082af1b0>] __cleanup_mnt+0x10/0x18
    [<ffffff90080d9e68>] task_work_run+0xcc/0x124
    [<ffffff900808c8c0>] do_notify_resume+0x60/0x70
    [<ffffff90080866e4>] work_pending+0x10/0x14
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarXinyong <xinyong.fang@linux.alibaba.com>
    Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
    1a087f03
f_fs.c 87.1 KB