Skip to content
Snippets Groups Projects
  1. Oct 19, 2021
    • Zheyu Ma's avatar
      memstick: r592: Fix a UAF bug when removing the driver · 738216c1
      Zheyu Ma authored
      
      In r592_remove(), the driver will free dma after freeing the host, which
      may cause a UAF bug.
      
      The following log reveals it:
      
      [   45.361796 ] BUG: KASAN: use-after-free in r592_remove+0x269/0x350 [r592]
      [   45.364286 ] Call Trace:
      [   45.364472 ]  dump_stack_lvl+0xa8/0xd1
      [   45.364751 ]  print_address_description+0x87/0x3b0
      [   45.365137 ]  kasan_report+0x172/0x1c0
      [   45.365415 ]  ? r592_remove+0x269/0x350 [r592]
      [   45.365834 ]  ? r592_remove+0x269/0x350 [r592]
      [   45.366168 ]  __asan_report_load8_noabort+0x14/0x20
      [   45.366531 ]  r592_remove+0x269/0x350 [r592]
      [   45.378785 ]
      [   45.378903 ] Allocated by task 4674:
      [   45.379162 ]  ____kasan_kmalloc+0xb5/0xe0
      [   45.379455 ]  __kasan_kmalloc+0x9/0x10
      [   45.379730 ]  __kmalloc+0x150/0x280
      [   45.379984 ]  memstick_alloc_host+0x2a/0x190
      [   45.380664 ]
      [   45.380781 ] Freed by task 5509:
      [   45.381014 ]  kasan_set_track+0x3d/0x70
      [   45.381293 ]  kasan_set_free_info+0x23/0x40
      [   45.381635 ]  ____kasan_slab_free+0x10b/0x140
      [   45.381950 ]  __kasan_slab_free+0x11/0x20
      [   45.382241 ]  slab_free_freelist_hook+0x81/0x150
      [   45.382575 ]  kfree+0x13e/0x290
      [   45.382805 ]  memstick_free+0x1c/0x20
      [   45.383070 ]  device_release+0x9c/0x1d0
      [   45.383349 ]  kobject_put+0x2ef/0x4c0
      [   45.383616 ]  put_device+0x1f/0x30
      [   45.383865 ]  memstick_free_host+0x24/0x30
      [   45.384162 ]  r592_remove+0x242/0x350 [r592]
      [   45.384473 ]  pci_device_remove+0xa9/0x250
      
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Link: https://lore.kernel.org/r/1634383581-11055-1-git-send-email-zheyuma97@gmail.com
      
      
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      738216c1
  2. Oct 12, 2021
  3. Aug 24, 2021
  4. Jul 21, 2021
    • Uwe Kleine-König's avatar
      bus: Make remove callback return void · fc7a6209
      Uwe Kleine-König authored
      
      The driver core ignores the return value of this callback because there
      is only little it can do when a device disappears.
      
      This is the final bit of a long lasting cleanup quest where several
      buses were converted to also return void from their remove callback.
      Additionally some resource leaks were fixed that were caused by drivers
      returning an error code in the expectation that the driver won't go
      away.
      
      With struct bus_type::remove returning void it's prevented that newly
      implemented buses return an ignored error code and so don't anticipate
      wrong expectations for driver authors.
      
      Reviewed-by: Tom Rix <trix@redhat.com> (For fpga)
      Reviewed-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Reviewed-by: Cornelia Huck <cohuck@redhat.com> (For drivers/s390 and drivers/vfio)
      Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> (For ARM, Amba and related parts)
      Acked-by: default avatarMark Brown <broonie@kernel.org>
      Acked-by: Chen-Yu Tsai <wens@csie.org> (for sunxi-rsb)
      Acked-by: default avatarPali Rohár <pali@kernel.org>
      Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org> (for media)
      Acked-by: Hans de Goede <hdegoede@redhat.com> (For drivers/platform)
      Acked-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Acked-By: default avatarVinod Koul <vkoul@kernel.org>
      Acked-by: Juergen Gross <jgross@suse.com> (For xen)
      Acked-by: Lee Jones <lee.jones@linaro.org> (For mfd)
      Acked-by: Johannes Thumshirn <jth@kernel.org> (For mcb)
      Acked-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> (For slimbus)
      Acked-by: Kirti Wankhede <kwankhede@nvidia.com> (For vfio)
      Acked-by: default avatarMaximilian Luz <luzmaximilian@gmail.com>
      Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> (For ulpi and typec)
      Acked-by: Samuel Iglesias Gonsálvez <siglesias@igalia.com> (For ipack)
      Acked-by: Geoff Levand <geoff@infradead.org> (For ps3)
      Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com> (For thunderbolt)
      Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> (For intel_th)
      Acked-by: Dominik Brodowski <linux@dominikbrodowski.net> (For pcmcia)
      Acked-by: Rafael J. Wysocki <rafael@kernel.org> (For ACPI)
      Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> (rpmsg and apr)
      Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> (For intel-ish-hid)
      Acked-by: Dan Williams <dan.j.williams@intel.com> (For CXL, DAX, and NVDIMM)
      Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com> (For isa)
      Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (For firewire)
      Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> (For hid)
      Acked-by: Thorsten Scherer <t.scherer@eckelmann.de> (For siox)
      Acked-by: Sven Van Asbroeck <TheSven73@gmail.com> (For anybuss)
      Acked-by: Ulf Hansson <ulf.hansson@linaro.org> (For MMC)
      Acked-by: Wolfram Sang <wsa@kernel.org> # for I2C
      Acked-by: default avatarSudeep Holla <sudeep.holla@arm.com>
      Acked-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Acked-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Acked-by: default avatarFinn Thain <fthain@linux-m68k.org>
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Link: https://lore.kernel.org/r/20210713193522.1770306-6-u.kleine-koenig@pengutronix.de
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      fc7a6209
  5. Jun 14, 2021
  6. Jun 11, 2021
  7. Jun 01, 2021
  8. Apr 26, 2021
    • Arnd Bergmann's avatar
      memstick: r592: ignore kfifo_out() return code again · 2f156712
      Arnd Bergmann authored
      
      A minor cleanup to address a clang warning removed an assigned
      but unused local variable, but this now caused a gcc warning as
      kfifo_out() is annotated to require checking its return code:
      
      In file included from drivers/memstick/host/r592.h:13,
                       from drivers/memstick/host/r592.c:21:
      drivers/memstick/host/r592.c: In function 'r592_flush_fifo_write':
      include/linux/kfifo.h:588:1: error: ignoring return value of '__kfifo_uint_must_check_helper' declared with attribute 'warn_unused_result' [-Werror=unused-result]
        588 | __kfifo_uint_must_check_helper( \
            | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        589 | ({ \
            | ~~~~
        590 |         typeof((fifo) + 1) __tmp = (fifo); \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        591 |         typeof(__tmp->ptr) __buf = (buf); \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        592 |         unsigned long __n = (n); \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~
        593 |         const size_t __recsize = sizeof(*__tmp->rectype); \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        594 |         struct __kfifo *__kfifo = &__tmp->kfifo; \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        595 |         (__recsize) ?\
            |         ~~~~~~~~~~~~~~
        596 |         __kfifo_out_r(__kfifo, __buf, __n, __recsize) : \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        597 |         __kfifo_out(__kfifo, __buf, __n); \
            |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        598 | }) \
            | ~~~~
        599 | )
            | ~
      drivers/memstick/host/r592.c:367:9: note: in expansion of macro 'kfifo_out'
        367 |         kfifo_out(&dev->pio_fifo, buffer, 4);
            |         ^~~~~~~~~
      
      The value was never checked here, and the purpose of the function
      is only to flush the contents, so restore the old behavior but
      add a cast to void and a comment, which hopefully warns with neither
      gcc nor clang now.
      
      If anyone has an idea for how to fix it without ignoring the return
      code, that is probably better.
      
      Fixes: 4b00ed3c ("memstick: r592: remove unused variable")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Link: https://lore.kernel.org/r/20210421135215.3414589-1-arnd@kernel.org
      
      
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      2f156712
  9. Apr 15, 2021
  10. Mar 30, 2021
  11. Dec 04, 2020
  12. Nov 24, 2020
  13. Nov 16, 2020
  14. Sep 28, 2020
  15. Sep 07, 2020
  16. Aug 23, 2020
  17. Jul 24, 2020
  18. Jul 16, 2020
  19. Nov 21, 2019
  20. Nov 13, 2019
  21. Oct 14, 2019
  22. Oct 09, 2019
  23. Sep 11, 2019
  24. Jun 19, 2019
  25. Jun 10, 2019
    • Wang Hai's avatar
      memstick: Fix error cleanup path of memstick_init · 65f1a0d3
      Wang Hai authored
      
      If bus_register fails. On its error handling path, it has cleaned up
      what it has done. There is no need to call bus_unregister again.
      Otherwise, if bus_unregister is called, issues such as null-ptr-deref
      will arise.
      
      Syzkaller report this:
      
      kobject_add_internal failed for memstick (error: -12 parent: bus)
      BUG: KASAN: null-ptr-deref in sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
      Read of size 8 at addr 0000000000000078 by task syz-executor.0/4460
      
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0xa9/0x10e lib/dump_stack.c:113
       __kasan_report+0x171/0x18d mm/kasan/report.c:321
       kasan_report+0xe/0x20 mm/kasan/common.c:614
       sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
       sysfs_remove_file include/linux/sysfs.h:519 [inline]
       bus_remove_file+0x6c/0x90 drivers/base/bus.c:145
       remove_probe_files drivers/base/bus.c:599 [inline]
       bus_unregister+0x6e/0x100 drivers/base/bus.c:916 ? 0xffffffffc1590000
       memstick_init+0x7a/0x1000 [memstick]
       do_one_initcall+0xb9/0x3b5 init/main.c:914
       do_init_module+0xe0/0x330 kernel/module.c:3468
       load_module+0x38eb/0x4270 kernel/module.c:3819
       __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
       do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Fixes: baf8532a ("memstick: initial commit for Sony MemoryStick support")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWang Hai <wanghai26@huawei.com>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      65f1a0d3
  26. May 28, 2019
  27. May 21, 2019
Loading