In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xhci: fix lost bounce buffers on TDs spanning several ring segments<\/p>\n
When a TD reaches a link TRB with data that is not aligned to the
\nendpoint’s wMaxPacketSize, xhci_align_td() stages the unalignable tail
\nthrough the bounce buffer of the ring segment holding that link TRB.
\nxhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers,
\ncopies the data back into the URB’s buffer.<\/p>\n
The enqueue path records the segment that was bounced in td->bounce_seg,
\nunder the assumption that a TD never spans more than two ring segments.
\nThat assumption does not hold: a TD large enough to span three or more
\nsegments crosses several link TRBs and can be bounced at each of them.
\nOnly the last one survives in td->bounce_seg, so every earlier bounce
\nbuffer is neither copied back nor DMA unmapped.<\/p>\n
The URB still completes with actual_length equal to the requested length
\nand no error, so the transfer looks successful while a wMaxPacketSize
\nsized hole in the destination buffer silently keeps its previous
\ncontents. It also leaks a DMA mapping per dropped bounce.<\/p>\n
Any sufficiently large and fragmented bulk transfer can hit this. It was
\nfound with a USB mass storage device behind xHCI backing a dm-verity
\ntarget with 512 byte hash blocks, where the stale data is detected rather
\nthan silently consumed. The device enumerates as SuperSpeed, so
\nwMaxPacketSize is 1024, while dm-bufio issues one 512 byte bio per hash
\nblock. verity_prefetch_io() makes the block layer merge hundreds of them
\ninto a single request of up to 512 scatterlist entries of 512 bytes each.
\nAt 256 TRBs per ring segment such a TD spans three segments, and every
\nsegment boundary falls on an odd multiple of 512, i.e. unaligned to
\nwMaxPacketSize. dm-bufio then caches a hash block holding stale data and
\ndm-verity declares the metadata block corrupted:<\/p>\n
device-mapper: verity: 8:2: metadata block 10850 is corrupted<\/p>\n
A reproducer running this under qemu is available at
\nhttps:\/\/github.com\/baloo\/xhci-verity<\/p>\n
The bounce state (bounce_buf, bounce_dma, bounce_len, bounce_offs)
\nalready lives on the ring segment, so there is nothing extra to track.
\nKeep recording the last bounced segment in td->bounce_seg and, on
\ncompletion, walk the segments from td->start_seg up to it, unmapping
\nevery segment that still has a pending bounce.<\/p>\n
Stopping at td->bounce_seg rather than td->end_seg matters: a bounce
\nimplies the TD continues past that segment’s link TRB, so bounce_seg is
\nalways strictly before end_seg, and a later TD may already have started
\nin end_seg and been bounced there. Walking that far would copy a foreign
\nbounce buffer into this URB and unmap it twice. It also keeps the walk
\ncorrect if a TD ever wraps the whole ring so that end_seg == start_seg.<\/p>\n
[mn: Add ring->num_segs check to prevent unlikely infinite for loop.]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xhci: fix lost bounce buffers on TDs spanning several ring segments<\/p>\n
When a TD reaches a link TRB with data that is not aligned to <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24703","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}