In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: Fix KASAN reported use-after-free when request is canceled<\/p>\n
Alan reported that when doing stress testing sometimes KASAN notices
\nuse-after-free during control channel operation (stripped down keeping
\nthe relevant parts):<\/p>\n
BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240\/0x250 [thunderbolt]
\n Read of size 24 at addr ffff88811067f290 by task kworker\/u40:2\/1760<\/p>\n
tb_cfg_request_sync+0x240\/0x250 [thunderbolt]
\n tb_cfg_read_raw+0x367\/0x510 [thunderbolt]
\n tb_cfg_read+0xec\/0x240 [thunderbolt]
\n tb_port_get_link_generation+0x258\/0x420 [thunderbolt]
\n tb_usb3_consumed_bandwidth+0x1c1\/0x2c0 [thunderbolt]
\n tb_tunnel_consumed_bandwidth+0xfd\/0x910 [thunderbolt]
\n tb_available_bandwidth+0x5f2\/0xeb0 [thunderbolt]
\n tb_recalc_estimated_bandwidth+0x2a0\/0x1bc0 [thunderbolt]
\n tb_handle_dp_bandwidth_request+0x1897\/0x5e20 [thunderbolt]
\n process_one_work+0x675\/0x1230
\n worker_thread+0x5e6\/0xf70
\n kthread+0x365\/0x470
\n ret_from_fork+0x54d\/0x710
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Allocated by task 1760:
\n __kmalloc_cache_noprof+0x1ee\/0x550
\n tb_cfg_read_raw+0x1d3\/0x510 [thunderbolt]
\n tb_cfg_read+0xec\/0x240 [thunderbolt]
\n tb_port_get_link_generation+0x258\/0x420 [thunderbolt]
\n tb_usb3_consumed_bandwidth+0x1c1\/0x2c0 [thunderbolt]
\n tb_tunnel_consumed_bandwidth+0xfd\/0x910 [thunderbolt]
\n tb_available_bandwidth+0x5f2\/0xeb0 [thunderbolt]
\n tb_recalc_estimated_bandwidth+0x2a0\/0x1bc0 [thunderbolt]
\n tb_handle_dp_bandwidth_request+0x1897\/0x5e20 [thunderbolt]
\n process_one_work+0x675\/0x1230
\n worker_thread+0x5e6\/0xf70
\n kthread+0x365\/0x470
\n ret_from_fork+0x54d\/0x710
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Freed by task 926:
\n kfree+0x18f\/0x4a0
\n tb_cfg_request_put+0xb7\/0xe0 [thunderbolt]
\n tb_cfg_request_work+0x82\/0x120 [thunderbolt]
\n process_one_work+0x675\/0x1230
\n worker_thread+0x5e6\/0xf70
\n kthread+0x365\/0x470
\n ret_from_fork+0x54d\/0x710
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Second to last potentially related work creation:
\n __queue_work+0x575\/0xd00
\n queue_work_on+0x77\/0x80
\n tb_cfg_request_cancel+0xc7\/0x260 [thunderbolt]
\n tb_cfg_request_sync+0x1f6\/0x250 [thunderbolt]
\n tb_cfg_read_raw+0x367\/0x510 [thunderbolt]
\n tb_cfg_read+0xec\/0x240 [thunderbolt]
\n tb_port_get_link_generation+0x258\/0x420 [thunderbolt]
\n tb_usb3_consumed_bandwidth+0x1c1\/0x2c0 [thunderbolt]
\n tb_tunnel_consumed_bandwidth+0xfd\/0x910 [thunderbolt]
\n tb_available_bandwidth+0x5f2\/0xeb0 [thunderbolt]
\n tb_recalc_estimated_bandwidth+0x2a0\/0x1bc0 [thunderbolt]
\n tb_handle_dp_bandwidth_request+0x1897\/0x5e20 [thunderbolt]
\n process_one_work+0x675\/0x1230
\n worker_thread+0x5e6\/0xf70
\n kthread+0x365\/0x470
\n ret_from_fork+0x54d\/0x710
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
The last stack trace is helpful because it shows that we are cancelling
\na request and looking at tb_cfg_request_cancel() what might happen is
\nthat tb_cfg_request_work() completes right before tb_cfg_request_cancel()
\nstarts and because of this it will call schedule_work() queueing the
\nsame work to run again. However, it is already removed from the
\nrequest_queue and reference count is dropped so when
\ntb_cfg_request_work() triggers again it will access memory that is
\nalready released.<\/p>\n
Fix this so that we first make sure a cancelled request is not handed
\naway from tb_cfg_request_find() or scheduled to run. Then instead of
\nrelying on the worker to clean up the request we will do it in
\ntb_cfg_request_cancel() after the work is canceled from running. Make
\ntb_cfg_request_dequeue() release the request only if it was actually
\nremoved from the queue.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: Fix KASAN reported use-after-free when request is canceled<\/p>\n
Alan reported that when doing stress testing sometimes KAS<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41166","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}