[linux] 01/02: USB: fix invalid memory access in hub_activate() (CVE-2015-8816)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sun Feb 28 23:20:42 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch wheezy-security
in repository linux.
commit 9290a0ce494edcab6e6dce82b80939381144da93
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Sun Feb 28 23:00:08 2016 +0000
USB: fix invalid memory access in hub_activate() (CVE-2015-8816)
---
debian/changelog | 1 +
...fix-invalid-memory-access-in-hub_activate.patch | 89 ++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 91 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index d5f3469..5ee64f9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -22,6 +22,7 @@ linux (3.2.73-2+deb7u3) UNRELEASED; urgency=medium
* ALSA: usb-audio: avoid freeing umidi object twice (CVE-2016-2384)
* unix: correctly track in-flight fds in sending process user_struct
(CVE-2016-2550)
+ * USB: fix invalid memory access in hub_activate() (CVE-2015-8816)
[ Salvatore Bonaccorso ]
* unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
diff --git a/debian/patches/bugfix/all/usb-fix-invalid-memory-access-in-hub_activate.patch b/debian/patches/bugfix/all/usb-fix-invalid-memory-access-in-hub_activate.patch
new file mode 100644
index 0000000..9ad514f
--- /dev/null
+++ b/debian/patches/bugfix/all/usb-fix-invalid-memory-access-in-hub_activate.patch
@@ -0,0 +1,89 @@
+From: Alan Stern <stern at rowland.harvard.edu>
+Date: Wed, 16 Dec 2015 13:32:38 -0500
+Subject: USB: fix invalid memory access in hub_activate()
+Origin: https://git.kernel.org/linus/e50293ef9775c5f1cf3fcc093037dd6a8c5684ea
+
+Commit 8520f38099cc ("USB: change hub initialization sleeps to
+delayed_work") changed the hub_activate() routine to make part of it
+run in a workqueue. However, the commit failed to take a reference to
+the usb_hub structure or to lock the hub interface while doing so. As
+a result, if a hub is plugged in and quickly unplugged before the work
+routine can run, the routine will try to access memory that has been
+deallocated. Or, if the hub is unplugged while the routine is
+running, the memory may be deallocated while it is in active use.
+
+This patch fixes the problem by taking a reference to the usb_hub at
+the start of hub_activate() and releasing it at the end (when the work
+is finished), and by locking the hub interface while the work routine
+is running. It also adds a check at the start of the routine to see
+if the hub has already been disconnected, in which nothing should be
+done.
+
+Signed-off-by: Alan Stern <stern at rowland.harvard.edu>
+Reported-by: Alexandru Cornea <alexandru.cornea at intel.com>
+Tested-by: Alexandru Cornea <alexandru.cornea at intel.com>
+Fixes: 8520f38099cc ("USB: change hub initialization sleeps to delayed_work")
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+[bwh: Backported to 3.2: add prototype for hub_release() before first use]
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+ drivers/usb/core/hub.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 7cfe286e5b8a..dde03309396a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -153,7 +153,7 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
+ #define HUB_DEBOUNCE_STEP 25
+ #define HUB_DEBOUNCE_STABLE 100
+
+-
++static void hub_release(struct kref *kref);
+ static int usb_reset_and_verify_device(struct usb_device *udev);
+
+ static inline char *portspeed(struct usb_hub *hub, int portstatus)
+@@ -792,10 +792,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ unsigned delay;
+
+ /* Continue a partial initialization */
+- if (type == HUB_INIT2)
+- goto init2;
+- if (type == HUB_INIT3)
++ if (type == HUB_INIT2 || type == HUB_INIT3) {
++ device_lock(hub->intfdev);
++
++ /* Was the hub disconnected while we were waiting? */
++ if (hub->disconnected) {
++ device_unlock(hub->intfdev);
++ kref_put(&hub->kref, hub_release);
++ return;
++ }
++ if (type == HUB_INIT2)
++ goto init2;
+ goto init3;
++ }
++ kref_get(&hub->kref);
+
+ /* The superspeed hub except for root hub has to use Hub Depth
+ * value as an offset into the route string to locate the bits
+@@ -984,6 +994,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ PREPARE_DELAYED_WORK(&hub->init_work, hub_init_func3);
+ schedule_delayed_work(&hub->init_work,
+ msecs_to_jiffies(delay));
++ device_unlock(hub->intfdev);
+ return; /* Continues at init3: below */
+ } else {
+ msleep(delay);
+@@ -1004,6 +1015,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ /* Allow autosuspend if it was suppressed */
+ if (type <= HUB_INIT3)
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
++
++ if (type == HUB_INIT2 || type == HUB_INIT3)
++ device_unlock(hub->intfdev);
++
++ kref_put(&hub->kref, hub_release);
+ }
+
+ /* Implement the continuations for the delays above */
diff --git a/debian/patches/series b/debian/patches/series
index 7f5a155..fdff6fe 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1206,3 +1206,4 @@ bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch
bugfix/all/pipe-fix-buffer-offset-after-partially-failed-read.patch
bugfix/all/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
bugfix/all/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch
+bugfix/all/usb-fix-invalid-memory-access-in-hub_activate.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list