Re: usb/sound: use-after-free in snd_usb_mixer_interrupt

[Takashi Iwai]

On Mon, 09 Oct 2017 19:50:39 +0200,
Andrey Konovalov wrote:
> 
> Hi!
> 
> I've got the following report while fuzzing the kernel with syzkaller.
> 
> On commit 8a5776a5f49812d29fe4b2d0a2d71675c3facf3f (4.14-rc4).
> 
> gadgetfs: bound to dummy_udc driver
> usb 1-1: new full-speed USB device number 2 using dummy_hcd
> gadgetfs: connected
> gadgetfs: disconnected
> gadgetfs: connected
> usb 1-1: config 1 has an invalid interface number: 1 but max is 0
> usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 1
> usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an
> invalid bInterval 0, changing to 10
> usb 1-1: too many endpoints for config 1 interface 1 altsetting 174:
> 131, using maximum allowed: 30
> usb 1-1: config 1 interface 1 altsetting 174 has 0 endpoint
> descriptors, different from the interface de
> scriptor's value: 131
> usb 1-1: config 1 interface 1 has no altsetting 0
> usb 1-1: New USB device found, idVendor=0dba, idProduct=1000
> usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=252
> usb 1-1: SerialNumber: a
> gadgetfs: configuration #1
> hub 1-1:1.0: USB hub found
> hub 1-1:1.0: config failed, can't read hub descriptor (err -22)
> snd-usb-audio: probe of 1-1:1.0 failed with error -22
> ==================================================================
> BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0
> Read of size 8 at addr ffff8800636f8900 by task swapper/1/0

A bad news for a sleepless night...

It's a stray URB that isn't properly killed when the usb-audio mixer
interface gets the error at probe.  The patch below should fix it.
I'm going to wrap up with a proper description later.


thanks,

Takashi

---
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9732edf77f86..91bc8f18791e 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2234,6 +2234,9 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
 
 static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
 {
+	/* kill pending URBs */
+	snd_usb_mixer_disconnect(mixer);
+
 	kfree(mixer->id_elems);
 	if (mixer->urb) {
 		kfree(mixer->urb->transfer_buffer);
@@ -2584,8 +2587,13 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
 
 void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer)
 {
-	usb_kill_urb(mixer->urb);
-	usb_kill_urb(mixer->rc_urb);
+	if (mixer->disconnected)
+		return;
+	if (mixer->urb)
+		usb_kill_urb(mixer->urb);
+	if (mixer->rc_urb)
+		usb_kill_urb(mixer->rc_urb);
+	mixer->disconnected = true;
 }
 
 #ifdef CONFIG_PM
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 2b4b067646ab..545d99b09706 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -22,6 +22,8 @@ struct usb_mixer_interface {
 	struct urb *rc_urb;
 	struct usb_ctrlrequest *rc_setup_packet;
 	u8 rc_buffer[6];
+
+	bool disconnected;
 };
 
 #define MAX_CHANNELS	16	/* max logical channels */