In the Linux kernel, the following vulnerability has been resolved:
USB: gadgetfs: Fix race between mounting and unmounting
The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfsfillsuper() can race with gadgetfskillsb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part:
BUG: KASAN: use-after-free in instrumentatomicreadwrite include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomicfetchsubrelease include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in _refcountsubandtest include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in _refcountdecandtest include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcountdecandtest include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in putdev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfskillsb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689
CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomicfetchsubrelease include/linux/atomic/atomic-instrumented.h:176 [inline] _refcountsubandtest include/linux/refcount.h:272 [inline] _refcountdecandtest include/linux/refcount.h:315 [inline] refcountdecandtest include/linux/refcount.h:333 [inline] putdev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfskillsb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivatelockedsuper+0xa7/0xf0 fs/super.c:332 vfsgetsuper fs/super.c:1190 [inline] gettreesingle+0xd0/0x160 fs/super.c:1207 vfsgettree+0x88/0x270 fs/super.c:1531 vfsfsconfig_locked fs/fsopen.c:232 [inline]
The simplest solution is to ensure that gadgetfsfillsuper() and gadgetfskillsb() are serialized by making them both acquire a new mutex.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856e4b5e53f21edbd15d275dde62228dd94fb2b4",
"deprecated": false,
"id": "CVE-2022-48869-15ff0b2e",
"target": {
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"319016622104717691240260762194714114768",
"145624367918057090888772898972911312677",
"42934299262577301497999002545631070766",
"311115516235869746598768783470185964864",
"62612838390161606628331423567325199913",
"106965614529793010733827116665208757908",
"248067040553938649662272195105991666672",
"124641317613074232081616494598772661870",
"109029593993900050315827146410361922848",
"115979938823365661981246917447210444120",
"263409701060727488878928848301676756800",
"127167902680938130089704987417323900843",
"35798107804289334869739489558767613870",
"300296138122451860665871854437912071047",
"273066587740121716224663919080742237942",
"313172731749546116233024783996271105555",
"263302601883714181530250903569338344262",
"166959206480619761475872146936996578300",
"177184916518962144902503128175611773280",
"182667270227829844050451682868124439085",
"123915289714757191724724415088604288326",
"243996035942590182725284243301620455892",
"336141026098492228863727976457026285334",
"255882022987547831046651319060942129896",
"254151612712819672968962828773991001421",
"258336296653745149651613791145659090899",
"174323512481366994223866627140747169845",
"320430907198054302821861319764766285229",
"242606187861288711406510596516110986823"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d18dcfe9860e842f394e37ba01ca9440ab2178f4",
"deprecated": false,
"id": "CVE-2022-48869-1e0e67fa",
"target": {
"function": "gadgetfs_fill_super",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "129916587359030506176131706548309507989",
"length": 872.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856e4b5e53f21edbd15d275dde62228dd94fb2b4",
"deprecated": false,
"id": "CVE-2022-48869-606a68dc",
"target": {
"function": "gadgetfs_fill_super",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "129916587359030506176131706548309507989",
"length": 872.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e075f40122d8daf587db126c562a67abd69cf9",
"deprecated": false,
"id": "CVE-2022-48869-6170eaa0",
"target": {
"function": "gadgetfs_fill_super",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "129916587359030506176131706548309507989",
"length": 872.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a39f4626b361ee7aa10fd990401c37ec3b466ae",
"deprecated": false,
"id": "CVE-2022-48869-75e37448",
"target": {
"function": "gadgetfs_kill_sb",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "225553665469934127408815302827329441806",
"length": 166.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d18dcfe9860e842f394e37ba01ca9440ab2178f4",
"deprecated": false,
"id": "CVE-2022-48869-79336674",
"target": {
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"319016622104717691240260762194714114768",
"145624367918057090888772898972911312677",
"42934299262577301497999002545631070766",
"311115516235869746598768783470185964864",
"62612838390161606628331423567325199913",
"106965614529793010733827116665208757908",
"248067040553938649662272195105991666672",
"124641317613074232081616494598772661870",
"109029593993900050315827146410361922848",
"115979938823365661981246917447210444120",
"263409701060727488878928848301676756800",
"127167902680938130089704987417323900843",
"35798107804289334869739489558767613870",
"300296138122451860665871854437912071047",
"273066587740121716224663919080742237942",
"313172731749546116233024783996271105555",
"263302601883714181530250903569338344262",
"166959206480619761475872146936996578300",
"177184916518962144902503128175611773280",
"182667270227829844050451682868124439085",
"123915289714757191724724415088604288326",
"243996035942590182725284243301620455892",
"336141026098492228863727976457026285334",
"255882022987547831046651319060942129896",
"254151612712819672968962828773991001421",
"258336296653745149651613791145659090899",
"174323512481366994223866627140747169845",
"320430907198054302821861319764766285229",
"242606187861288711406510596516110986823"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616fd34d017000ecf9097368b13d8a266f4920b3",
"deprecated": false,
"id": "CVE-2022-48869-83742ad8",
"target": {
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"319016622104717691240260762194714114768",
"145624367918057090888772898972911312677",
"42934299262577301497999002545631070766",
"311115516235869746598768783470185964864",
"62612838390161606628331423567325199913",
"106965614529793010733827116665208757908",
"248067040553938649662272195105991666672",
"124641317613074232081616494598772661870",
"109029593993900050315827146410361922848",
"115979938823365661981246917447210444120",
"263409701060727488878928848301676756800",
"127167902680938130089704987417323900843",
"35798107804289334869739489558767613870",
"300296138122451860665871854437912071047",
"273066587740121716224663919080742237942",
"313172731749546116233024783996271105555",
"263302601883714181530250903569338344262",
"166959206480619761475872146936996578300",
"177184916518962144902503128175611773280",
"182667270227829844050451682868124439085",
"123915289714757191724724415088604288326",
"243996035942590182725284243301620455892",
"336141026098492228863727976457026285334",
"255882022987547831046651319060942129896",
"254151612712819672968962828773991001421",
"258336296653745149651613791145659090899",
"174323512481366994223866627140747169845",
"320430907198054302821861319764766285229",
"242606187861288711406510596516110986823"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616fd34d017000ecf9097368b13d8a266f4920b3",
"deprecated": false,
"id": "CVE-2022-48869-87d4c13f",
"target": {
"function": "gadgetfs_kill_sb",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "225553665469934127408815302827329441806",
"length": 166.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e075f40122d8daf587db126c562a67abd69cf9",
"deprecated": false,
"id": "CVE-2022-48869-8995a5fb",
"target": {
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"319016622104717691240260762194714114768",
"145624367918057090888772898972911312677",
"42934299262577301497999002545631070766",
"311115516235869746598768783470185964864",
"62612838390161606628331423567325199913",
"106965614529793010733827116665208757908",
"248067040553938649662272195105991666672",
"124641317613074232081616494598772661870",
"109029593993900050315827146410361922848",
"115979938823365661981246917447210444120",
"263409701060727488878928848301676756800",
"127167902680938130089704987417323900843",
"35798107804289334869739489558767613870",
"300296138122451860665871854437912071047",
"273066587740121716224663919080742237942",
"313172731749546116233024783996271105555",
"263302601883714181530250903569338344262",
"166959206480619761475872146936996578300",
"177184916518962144902503128175611773280",
"182667270227829844050451682868124439085",
"123915289714757191724724415088604288326",
"243996035942590182725284243301620455892",
"336141026098492228863727976457026285334",
"255882022987547831046651319060942129896",
"254151612712819672968962828773991001421",
"258336296653745149651613791145659090899",
"174323512481366994223866627140747169845",
"320430907198054302821861319764766285229",
"242606187861288711406510596516110986823"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e075f40122d8daf587db126c562a67abd69cf9",
"deprecated": false,
"id": "CVE-2022-48869-8e5affb7",
"target": {
"function": "gadgetfs_kill_sb",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "225553665469934127408815302827329441806",
"length": 166.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856e4b5e53f21edbd15d275dde62228dd94fb2b4",
"deprecated": false,
"id": "CVE-2022-48869-927ab377",
"target": {
"function": "gadgetfs_kill_sb",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "225553665469934127408815302827329441806",
"length": 166.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a39f4626b361ee7aa10fd990401c37ec3b466ae",
"deprecated": false,
"id": "CVE-2022-48869-bcd9e79f",
"target": {
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"319016622104717691240260762194714114768",
"145624367918057090888772898972911312677",
"42934299262577301497999002545631070766",
"311115516235869746598768783470185964864",
"62612838390161606628331423567325199913",
"106965614529793010733827116665208757908",
"248067040553938649662272195105991666672",
"124641317613074232081616494598772661870",
"109029593993900050315827146410361922848",
"115979938823365661981246917447210444120",
"263409701060727488878928848301676756800",
"127167902680938130089704987417323900843",
"35798107804289334869739489558767613870",
"300296138122451860665871854437912071047",
"273066587740121716224663919080742237942",
"313172731749546116233024783996271105555",
"263302601883714181530250903569338344262",
"166959206480619761475872146936996578300",
"177184916518962144902503128175611773280",
"182667270227829844050451682868124439085",
"123915289714757191724724415088604288326",
"243996035942590182725284243301620455892",
"336141026098492228863727976457026285334",
"255882022987547831046651319060942129896",
"254151612712819672968962828773991001421",
"258336296653745149651613791145659090899",
"174323512481366994223866627140747169845",
"320430907198054302821861319764766285229",
"242606187861288711406510596516110986823"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d18dcfe9860e842f394e37ba01ca9440ab2178f4",
"deprecated": false,
"id": "CVE-2022-48869-dd23bbee",
"target": {
"function": "gadgetfs_kill_sb",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "225553665469934127408815302827329441806",
"length": 166.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a39f4626b361ee7aa10fd990401c37ec3b466ae",
"deprecated": false,
"id": "CVE-2022-48869-dd757c29",
"target": {
"function": "gadgetfs_fill_super",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "129916587359030506176131706548309507989",
"length": 872.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616fd34d017000ecf9097368b13d8a266f4920b3",
"deprecated": false,
"id": "CVE-2022-48869-f6a475dd",
"target": {
"function": "gadgetfs_fill_super",
"file": "drivers/usb/gadget/legacy/inode.c"
},
"digest": {
"function_hash": "129916587359030506176131706548309507989",
"length": 872.0
},
"signature_type": "Function"
}
]