linux-stable/drivers/usb/gadget
Schspa Shi 216e7f47d0 usb: gadget: fix race when gadget driver register via ioctl
commit 5f0b5f4d50 upstream.

The usb_gadget_register_driver can be called multi time by to
threads via USB_RAW_IOCTL_RUN ioctl syscall, which will lead
to multiple registrations.

Call trace:
  driver_register+0x220/0x3a0 drivers/base/driver.c:171
  usb_gadget_register_driver_owner+0xfb/0x1e0
    drivers/usb/gadget/udc/core.c:1546
  raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:513 [inline]
  raw_ioctl+0x1883/0x2730 drivers/usb/gadget/legacy/raw_gadget.c:1220
  ioctl USB_RAW_IOCTL_RUN

This routine allows two processes to register the same driver instance
via ioctl syscall. which lead to a race condition.

Please refer to the following scenarios.

           T1                                  T2
------------------------------------------------------------------
usb_gadget_register_driver_owner
  driver_register                    driver_register
    driver_find                       driver_find
    bus_add_driver                    bus_add_driver
      priv alloced                     <context switch>
      drv->p = priv;
      <schedule out>
      kobject_init_and_add // refcount = 1;
   //couldn't find an available UDC or it's busy
   <context switch>
                                       priv alloced
                                       drv->priv = priv;
                                       kobject_init_and_add
                                         ---> refcount = 1 <------
                                       // register success
                                       <context switch>
===================== another ioctl/process ======================
                                      driver_register
                                       driver_find
                                        k = kset_find_obj()
                                         ---> refcount = 2 <------
                                        <context out>
   driver_unregister
   // drv->p become T2's priv
   ---> refcount = 1 <------
   <context switch>
                                        kobject_put(k)
                                         ---> refcount = 0 <------
                                        return priv->driver;
                                        --------UAF here----------

There will be UAF in this scenario.

We can fix it by adding a new STATE_DEV_REGISTERING device state to
avoid double register.

Reported-by: syzbot+dc7c3ca638e773db07f6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000e66c2805de55b15a@google.com/
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Signed-off-by: Schspa Shi <schspa@gmail.com>
Link: https://lore.kernel.org/r/20220508150247.38204-1-schspa@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-25 09:58:56 +02:00
..
function usb: gadget: uvc: allow for application to cleanly shutdown 2022-05-18 10:28:19 +02:00
legacy usb: gadget: fix race when gadget driver register via ioctl 2022-05-25 09:58:56 +02:00
udc usb: gadget: tegra-xudc: Fix control endpoint's definitions 2022-04-13 19:27:09 +02:00
composite.c USB: gadget: validate interface OS descriptor requests 2022-02-11 10:59:12 +01:00
config.c usb: fix various gadget panics on 10gbps cabling 2021-06-09 10:40:08 +02:00
configfs.c usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() 2022-05-09 09:16:13 +02:00
configfs.h
epautoconf.c usb: gadget: fix for a typo that conveys logically-inverted information. 2021-09-14 10:27:54 +02:00
functions.c
Kconfig usb: gadget: uvc: add scatter gather support 2021-07-27 15:59:19 +02:00
Makefile
u_f.c
u_f.h
u_os_desc.h
usbstring.c