Re: [PATCH v2 3/9] ALSA: caiaq: Add a sanity check for invalid EPs
On Wed, Oct 11, 2017 at 12:36:40PM +0200, Takashi Iwai wrote: > As syzkaller spotted, currently caiaq driver submits a URB with the > fixed EP without checking whether it's actually available, which may > result in a kernel warning like: > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > [ cut here ] > WARNING: CPU: 1 PID: 1150 at drivers/usb/core/urb.c:449 > usb_submit_urb+0xf8a/0x11d0 > Modules linked in: > CPU: 1 PID: 1150 Comm: kworker/1:1 Not tainted > 4.14.0-rc2-42660-g24b7bd59eec0 #277 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Workqueue: usb_hub_wq hub_event > Call Trace: >init_card sound/usb/caiaq/device.c:467 >snd_probe+0x81c/0x1150 sound/usb/caiaq/device.c:525 >usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 > > > This patch adds a sanity check of validity of EPs at the device > initialization phase for avoiding the call with an invalid EP. > > Reported-by: Andrey Konovalov > Tested-by: Andrey Konovalov > Signed-off-by: Takashi Iwai > --- > sound/usb/caiaq/device.c | 7 +++ > 1 file changed, 7 insertions(+) > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > index 0fb6b1b79261..a29674bf96e5 100644 > --- a/sound/usb/caiaq/device.c > +++ b/sound/usb/caiaq/device.c > @@ -461,6 +461,13 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > cdev->midi_out_buf, EP1_BUFSIZE, > snd_usb_caiaq_midi_output_done, cdev); > > + /* sanity checks of EPs before actually submitting */ > + if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || > + usb_urb_ep_type_check(&cdev->midi_out_urb)) { > + dev_err(dev, "invalid EPs\n"); > + return -EINVAL; > + } > + Unrelated to this patch, but this driver fails to kill the ep1_in_urb (which is submitted in this function) in case of later probe errors. This can lead to use-after-free or crashes in the completion callback. > init_waitqueue_head(&cdev->ep1_wait_queue); > init_waitqueue_head(&cdev->prepare_wait_queue); Johan -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v2 3/9] ALSA: caiaq: Add a sanity check for invalid EPs
On Wed, 11 Oct 2017 16:20:31 +0200, Johan Hovold wrote: > > On Wed, Oct 11, 2017 at 12:36:40PM +0200, Takashi Iwai wrote: > > As syzkaller spotted, currently caiaq driver submits a URB with the > > fixed EP without checking whether it's actually available, which may > > result in a kernel warning like: > > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > > [ cut here ] > > WARNING: CPU: 1 PID: 1150 at drivers/usb/core/urb.c:449 > > usb_submit_urb+0xf8a/0x11d0 > > Modules linked in: > > CPU: 1 PID: 1150 Comm: kworker/1:1 Not tainted > > 4.14.0-rc2-42660-g24b7bd59eec0 #277 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs > > 01/01/2011 > > Workqueue: usb_hub_wq hub_event > > Call Trace: > >init_card sound/usb/caiaq/device.c:467 > >snd_probe+0x81c/0x1150 sound/usb/caiaq/device.c:525 > >usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 > > > > > > This patch adds a sanity check of validity of EPs at the device > > initialization phase for avoiding the call with an invalid EP. > > > > Reported-by: Andrey Konovalov > > Tested-by: Andrey Konovalov > > Signed-off-by: Takashi Iwai > > --- > > sound/usb/caiaq/device.c | 7 +++ > > 1 file changed, 7 insertions(+) > > > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > > index 0fb6b1b79261..a29674bf96e5 100644 > > --- a/sound/usb/caiaq/device.c > > +++ b/sound/usb/caiaq/device.c > > @@ -461,6 +461,13 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > > cdev->midi_out_buf, EP1_BUFSIZE, > > snd_usb_caiaq_midi_output_done, cdev); > > > > + /* sanity checks of EPs before actually submitting */ > > + if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || > > + usb_urb_ep_type_check(&cdev->midi_out_urb)) { > > + dev_err(dev, "invalid EPs\n"); > > + return -EINVAL; > > + } > > + > > Unrelated to this patch, but this driver fails to kill the ep1_in_urb > (which is submitted in this function) in case of later probe errors. > This can lead to use-after-free or crashes in the completion callback. Yes, a good catch. Below is the fix patch. thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: caiaq: Fix stray URB at probe error path caiaq driver doesn't kill the URB properly at its error path during the probe, which may lead to a use-after-free error later. This patch addresses it. Reported-by: Johan Hovold Signed-off-by: Takashi Iwai --- sound/usb/caiaq/device.c | 12 +--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a29674bf96e5..d55ca48de3ea 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -476,10 +476,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev) err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); if (err) - return err; + goto err_kill_urb; - if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) - return -ENODEV; + if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) { + err = -ENODEV; + goto err_kill_urb; + } usb_string(usb_dev, usb_dev->descriptor.iManufacturer, cdev->vendor_name, CAIAQ_USB_STR_LEN); @@ -514,6 +516,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev) setup_card(cdev); return 0; + + err_kill_urb: + usb_kill_urb(&cdev->ep1_in_urb); + return err; } static int snd_probe(struct usb_interface *intf, -- 2.14.2 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v2 3/9] ALSA: caiaq: Add a sanity check for invalid EPs
On Wed, Oct 11, 2017 at 04:40:36PM +0200, Takashi Iwai wrote: > On Wed, 11 Oct 2017 16:20:31 +0200, > Johan Hovold wrote: > > Unrelated to this patch, but this driver fails to kill the ep1_in_urb > > (which is submitted in this function) in case of later probe errors. > > This can lead to use-after-free or crashes in the completion callback. > > Yes, a good catch. Below is the fix patch. > -- 8< -- > From: Takashi Iwai > Subject: [PATCH] ALSA: caiaq: Fix stray URB at probe error path > > caiaq driver doesn't kill the URB properly at its error path during > the probe, which may lead to a use-after-free error later. This patch > addresses it. > > Reported-by: Johan Hovold > Signed-off-by: Takashi Iwai Looks good to me: Reviewed-by: Johan Hovold > --- > sound/usb/caiaq/device.c | 12 +--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c > index a29674bf96e5..d55ca48de3ea 100644 > --- a/sound/usb/caiaq/device.c > +++ b/sound/usb/caiaq/device.c > @@ -476,10 +476,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > > err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, > 0); > if (err) > - return err; > + goto err_kill_urb; > > - if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) > - return -ENODEV; > + if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) > { > + err = -ENODEV; > + goto err_kill_urb; > + } > > usb_string(usb_dev, usb_dev->descriptor.iManufacturer, > cdev->vendor_name, CAIAQ_USB_STR_LEN); > @@ -514,6 +516,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev) > > setup_card(cdev); > return 0; > + > + err_kill_urb: > + usb_kill_urb(&cdev->ep1_in_urb); > + return err; > } > > static int snd_probe(struct usb_interface *intf, -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v2 3/9] ALSA: caiaq: Add a sanity check for invalid EPs
On Wed, 11 Oct 2017 16:49:10 +0200, Johan Hovold wrote: > > On Wed, Oct 11, 2017 at 04:40:36PM +0200, Takashi Iwai wrote: > > On Wed, 11 Oct 2017 16:20:31 +0200, > > Johan Hovold wrote: > > > > Unrelated to this patch, but this driver fails to kill the ep1_in_urb > > > (which is submitted in this function) in case of later probe errors. > > > This can lead to use-after-free or crashes in the completion callback. > > > > Yes, a good catch. Below is the fix patch. > > > -- 8< -- > > From: Takashi Iwai > > Subject: [PATCH] ALSA: caiaq: Fix stray URB at probe error path > > > > caiaq driver doesn't kill the URB properly at its error path during > > the probe, which may lead to a use-after-free error later. This patch > > addresses it. > > > > Reported-by: Johan Hovold > > Signed-off-by: Takashi Iwai > > Looks good to me: > > Reviewed-by: Johan Hovold Thanks. It's rather a material for for-linus with Cc to stable, so marked it and queued. Takashi -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html