net/gadget: slab-out-of-bounds write in dev_config

[Andrey Konovalov]

Hi!

I've got the following error report while running the syzkaller fuzzer.

ep0_write() doesn't check the length, so a user can cause an
out-of-bounds with both size and data controlled.
There's a comment which says "IN DATA+STATUS caller makes len <=
wLength". While I'm not exactly sure what that means, the length seems
to be passed unmodified directly from dev_config().

This doesn't seem to be a critical security issue since gadgetfs can't
be mounted from a user namespace.

On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2).

==================================================================
BUG: KASAN: slab-out-of-bounds in dev_config+0x86f/0x1190 at addr
ffff88003c47e160
Write of size 65537 by task syz-executor0/6356
CPU: 3 PID: 6356 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff88003c107ad8 ffffffff81f96aba ffffffff3dc11ef0 1ffff10007820eee
 ffffed0007820ee6 ffff88003dc11f00 0000000041b58ab3 ffffffff8598b4c8
 ffffffff81f96828 ffffffff813fb4a0 ffff88003b6eadc0 ffff88003c107738
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff81f96aba>] dump_stack+0x292/0x398 lib/dump_stack.c:51
 [<ffffffff817e4dec>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:159
 [<     inline     >] print_address_description mm/kasan/report.c:197
 [<ffffffff817e5080>] kasan_report_error+0x1f0/0x4e0 mm/kasan/report.c:286
 [<ffffffff817e5705>] kasan_report+0x35/0x40 mm/kasan/report.c:306
 [<     inline     >] check_memory_region_inline mm/kasan/kasan.c:308
 [<ffffffff817e3fb9>] check_memory_region+0x139/0x190 mm/kasan/kasan.c:315
 [<ffffffff817e4044>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
 [<     inline     >] copy_from_user arch/x86/include/asm/uaccess.h:689
 [<     inline     >] ep0_write drivers/usb/gadget/legacy/inode.c:1135
 [<ffffffff83228caf>] dev_config+0x86f/0x1190
drivers/usb/gadget/legacy/inode.c:1759
 [<ffffffff817fdd55>] __vfs_write+0x5d5/0x760 fs/read_write.c:510
 [<ffffffff817ff650>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<     inline     >] SYSC_write fs/read_write.c:607
 [<ffffffff81803a5b>] SyS_write+0xfb/0x230 fs/read_write.c:599
 [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003c47e038, in cache kmalloc-1024 size: 1024
Allocated:
PID = 4565
 [   43.417154] [<ffffffff81203526>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
 [   43.417154] [<ffffffff817e40d3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 [   43.417154] [<     inline     >] set_track mm/kasan/kasan.c:507
 [   43.417154] [<ffffffff817e435d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
 [   43.417154] [<ffffffff817dfa02>] kmem_cache_alloc_trace+0x82/0x270
mm/slub.c:2735
 [   43.417154] [<     inline     >] kmalloc include/linux/slab.h:490
 [   43.417154] [<     inline     >] kzalloc include/linux/slab.h:636
 [   43.417154] [<     inline     >] dev_new
drivers/usb/gadget/legacy/inode.c:170
 [   43.417154] [<ffffffff832276ca>] gadgetfs_fill_super+0x24a/0x540
drivers/usb/gadget/legacy/inode.c:1987
 [   43.417154] [<ffffffff8180bb61>] mount_single+0xf1/0x160 fs/super.c:1146
 [   43.417154] [<ffffffff8322290c>] gadgetfs_mount+0x2c/0x40
drivers/usb/gadget/legacy/inode.c:2013
 [   43.417154] [<ffffffff8180be87>] mount_fs+0x97/0x2e0 fs/super.c:1177
 [   43.417154] [<ffffffff8187fc47>] vfs_kern_mount.part.24+0x67/0x2f0
fs/namespace.c:954
 [   43.417154] [<     inline     >] vfs_kern_mount fs/namespace.c:2433
 [   43.417154] [<     inline     >] do_new_mount fs/namespace.c:2436
 [   43.417154] [<ffffffff81888f58>] do_mount+0x418/0x2da0 fs/namespace.c:2758
 [   43.417154] [<     inline     >] SYSC_mount fs/namespace.c:2974
 [   43.417154] [<ffffffff8188c2ab>] SyS_mount+0xab/0x120 fs/namespace.c:2951
 [   43.417154] [<ffffffff84f47ec1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 0
(stack is not available)
Memory state around the buggy address:
 ffff88003c47e100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88003c47e180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88003c47e200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
                                                       ^
 ffff88003c47e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88003c47e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================