From patchwork Tue Nov 22 18:51:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shigeru Yoshida X-Patchwork-Id: 24505 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2386372wrr; Tue, 22 Nov 2022 10:59:03 -0800 (PST) X-Google-Smtp-Source: AA0mqf5Yzg8nBVhIZO2KO3XPHeB9sQkzy0cnIbfS1OnXjmptUxzGXv3V2Z8Ph1B2tJ76VTg/4uEH X-Received: by 2002:aa7:8d01:0:b0:562:83c1:59e0 with SMTP id j1-20020aa78d01000000b0056283c159e0mr26982845pfe.34.1669143543222; Tue, 22 Nov 2022 10:59:03 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669143543; cv=none; d=google.com; s=arc-20160816; b=acQJZHNOqPxAP8d+zlhELZ6wcS3DbQtiNS5AA5ZFAhiGYvsC578B9SSa2F0REkTJJJ lgVflEpmgHQDcisP0rQRRpy1ZkSmJ3ZDIYpazXSP723SRv6Jl+tKHXccqngB1twxoghJ +CZQHNx0eUi24HZVJzXy2uymnzVgXnuTB1Uu4gsQP+GwOf9IxkRgGrP4T9g19gci9hi/ 5DSGVCr50EIv/2t8dSwf8nXYWQc8PZliKcQOziLwYjUu9atJlKUN9SMNOvkbkI923c4z /alUODerpff8gzgWvw983h87pW86DeOw/DYxGbJHNB/J2yEo94Johe/CnlU8nkhZjCoC yZbQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=aep8RFMu1+GiUZaTPB9joRtRtN+HkoJa3LBopYYK188=; b=pvwya8ZzDVfscJY+oPUSLP0qM8QRBb+dSqxz9QzhelaFHBRagIBAsrBf+u9ga5CK8D Y3l6RVE3sd601stzdTGLGE1okGp9TYx3E8klGokW9rvx+mnLAbG7s/juUw83kQbuLXqt hvNsBN3Xv83ZRZLoYe0341FuqTKZod22NAoYiyIOU+iNfWvlQg0OAKLH9Ukucu1f306t 3o3Zwqto646Tj2BlvNUfy6yT0lbdyC+UoPguqfTfjbjuThRikRAVOnWKes5bjmSJOiUB i+US24CR8mTNBWvEMnx33yE5mqkC1SuZym4vKVQ0ZOwn6f8wWyHOM5BaRqVjKm71+YTP SBOw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=VUwGJdex; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i186-20020a6387c3000000b004772ea50c14si421929pge.171.2022.11.22.10.58.49; Tue, 22 Nov 2022 10:59:03 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=VUwGJdex; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232419AbiKVSxK (ORCPT + 99 others); Tue, 22 Nov 2022 13:53:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230365AbiKVSxH (ORCPT ); Tue, 22 Nov 2022 13:53:07 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B4CD98C088 for ; Tue, 22 Nov 2022 10:52:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1669143129; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=aep8RFMu1+GiUZaTPB9joRtRtN+HkoJa3LBopYYK188=; b=VUwGJdexXBQH0NdexVRtOoXO9aRjo7QqwpysrOHu/h2NqX9u92cEJ13qm3CHk0/Q2BHpiF Ql6C2l8dQbqI3CneZMAEgfSfj+CZMZFwzfNBWlKzHfX88Px8Dl03rDUGgv3el8eYg0rzUQ LA8ZVSGbF5xeGTH8n3GPkwdW368AaFQ= Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-35--K2UBD72OwWH5vlJbE9XAQ-1; Tue, 22 Nov 2022 13:52:08 -0500 X-MC-Unique: -K2UBD72OwWH5vlJbE9XAQ-1 Received: by mail-pl1-f200.google.com with SMTP id o7-20020a170902d4c700b001868cdac9adso12256682plg.13 for ; Tue, 22 Nov 2022 10:52:07 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=aep8RFMu1+GiUZaTPB9joRtRtN+HkoJa3LBopYYK188=; b=7QLOxFVkPA52ek3+efdTUm9U2yylTcoSzuXuVVjf49RQpZeOIH4MQMWBmgxJbHcIWJ EBj+3je7rmmIj+0lEV9s1HtS8fSF4cBSTwHz2pza81HkaucGR0YIOm2pfVa49GJbOZVl +Fm94hRZGfGv3DGaNwcb8/fiBck6mZaJteoJmlyjE+kdUW17Vmv6Q2IIzxYVTjCP8L/n KoMjs7OMMPYoj1olgJBHGrjwREmaA2y1pBTDi2k/7lLYV43V4hcxMfb+800qScoyZto+ sTIpg9tC5haHuLlm1xNV2HnRMOGCoe8kLD8v5X7cC9L6u+x9qm120iL09cLjCc2lY+ic annQ== X-Gm-Message-State: ANoB5pnpx+HTMmPYkHw3V9s4OfuHff0g9BdjQHIYHc6WBaQKvSokMubS AaXTGvLvv6jREYgJiALVluva6orFReSp3Wt9PG4S8Xkus/Qr4HP5ehG9JJLy4yDff3K6LZoZMlC rLdWk3aB7MP9EdEmAKyJZ/KSK X-Received: by 2002:a63:f354:0:b0:476:db6f:e79d with SMTP id t20-20020a63f354000000b00476db6fe79dmr4471104pgj.399.1669143126988; Tue, 22 Nov 2022 10:52:06 -0800 (PST) X-Received: by 2002:a63:f354:0:b0:476:db6f:e79d with SMTP id t20-20020a63f354000000b00476db6fe79dmr4471079pgj.399.1669143126697; Tue, 22 Nov 2022 10:52:06 -0800 (PST) Received: from ryzen.. ([240d:1a:c0d:9f00:fc9c:8ee9:e32c:2d9]) by smtp.gmail.com with ESMTPSA id y63-20020a623242000000b0056be1d7d4a3sm10950745pfy.73.2022.11.22.10.52.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Nov 2022 10:52:06 -0800 (PST) From: Shigeru Yoshida To: hverkuil@xs4all.nl, mchehab@kernel.org Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Shigeru Yoshida , syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com Subject: [PATCH] media: si470x: Fix use-after-free in si470x_int_in_callback() Date: Wed, 23 Nov 2022 03:51:59 +0900 Message-Id: <20221122185159.1184593-1-syoshida@redhat.com> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750223859686855909?= X-GMAIL-MSGID: =?utf-8?q?1750223859686855909?= syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object. Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1] Signed-off-by: Shigeru Yoshida --- drivers/media/radio/si470x/radio-si470x-usb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c index 6b2768623c88..aa7a580dbecc 100644 --- a/drivers/media/radio/si470x/radio-si470x-usb.c +++ b/drivers/media/radio/si470x/radio-si470x-usb.c @@ -727,8 +727,10 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, /* start radio */ retval = si470x_start_usb(radio); - if (retval < 0) + if (retval < 0 && !radio->int_in_running) goto err_buf; + else if (retval < 0) /* in case of radio->int_in_running == 1 */ + goto err_all; /* set initial frequency */ si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */