From d18dcfe9860e842f394e37ba01ca9440ab2178f4 Mon Sep 17 00:00:00 2001

From: Alan Stern <stern@rowland.harvard.edu>

Date: Fri, 23 Dec 2022 09:59:09 -0500

Subject: [PATCH] USB: gadgetfs: Fix race between mounting and unmounting

References: CVE-2022-4382 bsc#1206258

Patch-mainline: v6.2-rc5

Git-commit: d18dcfe9860e842f394e37ba01ca9440ab2178f4

The syzbot fuzzer and Gerald Lee have identified a use-after-free bug

in the gadgetfs driver, involving processes concurrently mounting and

unmounting the gadgetfs filesystem.  In particular, gadgetfs_fill_super()

can race with gadgetfs_kill_sb(), causing the latter to deallocate

the_device while the former is using it.  The output from KASAN says,

in part:

BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]

BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]

BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline]

BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline]

BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline]

BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]

BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086

Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689

CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Call Trace:

 <TASK>

...

 atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]

 __refcount_sub_and_test include/linux/refcount.h:272 [inline]

 __refcount_dec_and_test include/linux/refcount.h:315 [inline]

 refcount_dec_and_test include/linux/refcount.h:333 [inline]

 put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]

 gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086

 deactivate_locked_super+0xa7/0xf0 fs/super.c:332

 vfs_get_super fs/super.c:1190 [inline]

 get_tree_single+0xd0/0x160 fs/super.c:1207

 vfs_get_tree+0x88/0x270 fs/super.c:1531

 vfs_fsconfig_locked fs/fsopen.c:232 [inline]

The simplest solution is to ensure that gadgetfs_fill_super() and

gadgetfs_kill_sb() are serialized by making them both acquire a new

mutex.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>

Reported-and-tested-by: syzbot+33d7ad66d65044b93f16@syzkaller.appspotmail.com

Reported-and-tested-by: Gerald Lee <sundaywind2004@gmail.com>

Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04DjzA9ffa5x1g@mail.gmail.com/

Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API")

CC: <stable@vger.kernel.org>

Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Acked-by: David Disseldorp <ddiss@suse.de>

---

 drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++-------

 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c

index 01c3ead7d1b4..d605bc2e7e8f 100644

--- a/drivers/usb/gadget/legacy/inode.c

+++ b/drivers/usb/gadget/legacy/inode.c

@@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data)

  */

 static const char *CHIP;

+static DEFINE_MUTEX(sb_mutex);		/* Serialize superblock operations */

 /*----------------------------------------------------------------------*/

@@ -2010,13 +2011,20 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)

 {

 	struct inode	*inode;

 	struct dev_data	*dev;

+	int		rc;

-	if (the_device)

-		return -ESRCH;

+	mutex_lock(&sb_mutex);

+

+	if (the_device) {

+		rc = -ESRCH;

+		goto Done;

+	}

 	CHIP = usb_get_gadget_udc_name();

-	if (!CHIP)

-		return -ENODEV;

+	if (!CHIP) {

+		rc = -ENODEV;

+		goto Done;

+	}

 	/* superblock */

 	sb->s_blocksize = PAGE_SIZE;

@@ -2053,13 +2061,17 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)

 	 * from binding to a controller.

 	 */

 	the_device = dev;

-	return 0;

+	rc = 0;

+	goto Done;

-Enomem:

+ Enomem:

 	kfree(CHIP);

 	CHIP = NULL;

+	rc = -ENOMEM;

-	return -ENOMEM;

+ Done:

+	mutex_unlock(&sb_mutex);

+	return rc;

 }

 /* "mount -t gadgetfs path /dev/gadget" ends up here */

@@ -2081,6 +2093,7 @@ static int gadgetfs_init_fs_context(struct fs_context *fc)

 static void

 gadgetfs_kill_sb (struct super_block *sb)

 {

+	mutex_lock(&sb_mutex);

 	kill_litter_super (sb);

 	if (the_device) {

 		put_dev (the_device);

@@ -2088,6 +2101,7 @@ gadgetfs_kill_sb (struct super_block *sb)

 	}

 	kfree(CHIP);

 	CHIP = NULL;

+	mutex_unlock(&sb_mutex);

 }

 /*----------------------------------------------------------------------*/

-- 

2.39.0