In the Linux kernel, the following vulnerability has been resolved:
USB: gadgetfs: Fix race between mounting and unmounting
The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfsfillsuper() can race with gadgetfskillsb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part:
BUG: KASAN: use-after-free in instrumentatomicreadwrite include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomicfetchsubrelease include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in _refcountsubandtest include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in _refcountdecandtest include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcountdecandtest include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in putdev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfskillsb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689
CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomicfetchsubrelease include/linux/atomic/atomic-instrumented.h:176 [inline] _refcountsubandtest include/linux/refcount.h:272 [inline] _refcountdecandtest include/linux/refcount.h:315 [inline] refcountdecandtest include/linux/refcount.h:333 [inline] putdev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfskillsb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivatelockedsuper+0xa7/0xf0 fs/super.c:332 vfsgetsuper fs/super.c:1190 [inline] gettreesingle+0xd0/0x160 fs/super.c:1207 vfsgettree+0x88/0x270 fs/super.c:1531 vfsfsconfig_locked fs/fsopen.c:232 [inline]
The simplest solution is to ensure that gadgetfsfillsuper() and gadgetfskillsb() are serialized by making them both acquire a new mutex.
{ "vanir_signatures": [ { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "319016622104717691240260762194714114768", "145624367918057090888772898972911312677", "42934299262577301497999002545631070766", "311115516235869746598768783470185964864", "62612838390161606628331423567325199913", "106965614529793010733827116665208757908", "248067040553938649662272195105991666672", "124641317613074232081616494598772661870", "109029593993900050315827146410361922848", "115979938823365661981246917447210444120", "263409701060727488878928848301676756800", "127167902680938130089704987417323900843", "35798107804289334869739489558767613870", "300296138122451860665871854437912071047", "273066587740121716224663919080742237942", "313172731749546116233024783996271105555", "263302601883714181530250903569338344262", "166959206480619761475872146936996578300", "177184916518962144902503128175611773280", "182667270227829844050451682868124439085", "123915289714757191724724415088604288326", "243996035942590182725284243301620455892", "336141026098492228863727976457026285334", "255882022987547831046651319060942129896", "254151612712819672968962828773991001421", "258336296653745149651613791145659090899", "174323512481366994223866627140747169845", "320430907198054302821861319764766285229", "242606187861288711406510596516110986823" ], "threshold": 0.9 }, "id": "CVE-2022-48869-15ff0b2e", "target": { "file": "drivers/usb/gadget/legacy/inode.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856e4b5e53f21edbd15d275dde62228dd94fb2b4" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 872.0, "function_hash": "129916587359030506176131706548309507989" }, "id": "CVE-2022-48869-1e0e67fa", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_fill_super" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d18dcfe9860e842f394e37ba01ca9440ab2178f4" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 872.0, "function_hash": "129916587359030506176131706548309507989" }, "id": "CVE-2022-48869-606a68dc", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_fill_super" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856e4b5e53f21edbd15d275dde62228dd94fb2b4" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 872.0, "function_hash": "129916587359030506176131706548309507989" }, "id": "CVE-2022-48869-6170eaa0", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_fill_super" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e075f40122d8daf587db126c562a67abd69cf9" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 166.0, "function_hash": "225553665469934127408815302827329441806" }, "id": "CVE-2022-48869-75e37448", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_kill_sb" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a39f4626b361ee7aa10fd990401c37ec3b466ae" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "319016622104717691240260762194714114768", "145624367918057090888772898972911312677", "42934299262577301497999002545631070766", "311115516235869746598768783470185964864", "62612838390161606628331423567325199913", "106965614529793010733827116665208757908", "248067040553938649662272195105991666672", "124641317613074232081616494598772661870", "109029593993900050315827146410361922848", "115979938823365661981246917447210444120", "263409701060727488878928848301676756800", "127167902680938130089704987417323900843", "35798107804289334869739489558767613870", "300296138122451860665871854437912071047", "273066587740121716224663919080742237942", "313172731749546116233024783996271105555", "263302601883714181530250903569338344262", "166959206480619761475872146936996578300", "177184916518962144902503128175611773280", "182667270227829844050451682868124439085", "123915289714757191724724415088604288326", "243996035942590182725284243301620455892", "336141026098492228863727976457026285334", "255882022987547831046651319060942129896", "254151612712819672968962828773991001421", "258336296653745149651613791145659090899", "174323512481366994223866627140747169845", "320430907198054302821861319764766285229", "242606187861288711406510596516110986823" ], "threshold": 0.9 }, "id": "CVE-2022-48869-79336674", "target": { "file": "drivers/usb/gadget/legacy/inode.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d18dcfe9860e842f394e37ba01ca9440ab2178f4" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "319016622104717691240260762194714114768", "145624367918057090888772898972911312677", "42934299262577301497999002545631070766", "311115516235869746598768783470185964864", "62612838390161606628331423567325199913", "106965614529793010733827116665208757908", "248067040553938649662272195105991666672", "124641317613074232081616494598772661870", "109029593993900050315827146410361922848", "115979938823365661981246917447210444120", "263409701060727488878928848301676756800", "127167902680938130089704987417323900843", "35798107804289334869739489558767613870", "300296138122451860665871854437912071047", "273066587740121716224663919080742237942", "313172731749546116233024783996271105555", "263302601883714181530250903569338344262", "166959206480619761475872146936996578300", "177184916518962144902503128175611773280", "182667270227829844050451682868124439085", "123915289714757191724724415088604288326", "243996035942590182725284243301620455892", "336141026098492228863727976457026285334", "255882022987547831046651319060942129896", "254151612712819672968962828773991001421", "258336296653745149651613791145659090899", "174323512481366994223866627140747169845", "320430907198054302821861319764766285229", "242606187861288711406510596516110986823" ], "threshold": 0.9 }, "id": "CVE-2022-48869-83742ad8", "target": { "file": "drivers/usb/gadget/legacy/inode.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616fd34d017000ecf9097368b13d8a266f4920b3" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 166.0, "function_hash": "225553665469934127408815302827329441806" }, "id": "CVE-2022-48869-87d4c13f", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_kill_sb" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616fd34d017000ecf9097368b13d8a266f4920b3" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "319016622104717691240260762194714114768", "145624367918057090888772898972911312677", "42934299262577301497999002545631070766", "311115516235869746598768783470185964864", "62612838390161606628331423567325199913", "106965614529793010733827116665208757908", "248067040553938649662272195105991666672", "124641317613074232081616494598772661870", "109029593993900050315827146410361922848", "115979938823365661981246917447210444120", "263409701060727488878928848301676756800", "127167902680938130089704987417323900843", "35798107804289334869739489558767613870", "300296138122451860665871854437912071047", "273066587740121716224663919080742237942", "313172731749546116233024783996271105555", "263302601883714181530250903569338344262", "166959206480619761475872146936996578300", "177184916518962144902503128175611773280", "182667270227829844050451682868124439085", "123915289714757191724724415088604288326", "243996035942590182725284243301620455892", "336141026098492228863727976457026285334", "255882022987547831046651319060942129896", "254151612712819672968962828773991001421", "258336296653745149651613791145659090899", "174323512481366994223866627140747169845", "320430907198054302821861319764766285229", "242606187861288711406510596516110986823" ], "threshold": 0.9 }, "id": "CVE-2022-48869-8995a5fb", "target": { "file": "drivers/usb/gadget/legacy/inode.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e075f40122d8daf587db126c562a67abd69cf9" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 166.0, "function_hash": "225553665469934127408815302827329441806" }, "id": "CVE-2022-48869-8e5affb7", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_kill_sb" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e075f40122d8daf587db126c562a67abd69cf9" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 166.0, "function_hash": "225553665469934127408815302827329441806" }, "id": "CVE-2022-48869-927ab377", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_kill_sb" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856e4b5e53f21edbd15d275dde62228dd94fb2b4" }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "319016622104717691240260762194714114768", "145624367918057090888772898972911312677", "42934299262577301497999002545631070766", "311115516235869746598768783470185964864", "62612838390161606628331423567325199913", "106965614529793010733827116665208757908", "248067040553938649662272195105991666672", "124641317613074232081616494598772661870", "109029593993900050315827146410361922848", "115979938823365661981246917447210444120", "263409701060727488878928848301676756800", "127167902680938130089704987417323900843", "35798107804289334869739489558767613870", "300296138122451860665871854437912071047", "273066587740121716224663919080742237942", "313172731749546116233024783996271105555", "263302601883714181530250903569338344262", "166959206480619761475872146936996578300", "177184916518962144902503128175611773280", "182667270227829844050451682868124439085", "123915289714757191724724415088604288326", "243996035942590182725284243301620455892", "336141026098492228863727976457026285334", "255882022987547831046651319060942129896", "254151612712819672968962828773991001421", "258336296653745149651613791145659090899", "174323512481366994223866627140747169845", "320430907198054302821861319764766285229", "242606187861288711406510596516110986823" ], "threshold": 0.9 }, "id": "CVE-2022-48869-bcd9e79f", "target": { "file": "drivers/usb/gadget/legacy/inode.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a39f4626b361ee7aa10fd990401c37ec3b466ae" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 166.0, "function_hash": "225553665469934127408815302827329441806" }, "id": "CVE-2022-48869-dd23bbee", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_kill_sb" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d18dcfe9860e842f394e37ba01ca9440ab2178f4" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 872.0, "function_hash": "129916587359030506176131706548309507989" }, "id": "CVE-2022-48869-dd757c29", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_fill_super" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a39f4626b361ee7aa10fd990401c37ec3b466ae" }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "length": 872.0, "function_hash": "129916587359030506176131706548309507989" }, "id": "CVE-2022-48869-f6a475dd", "target": { "file": "drivers/usb/gadget/legacy/inode.c", "function": "gadgetfs_fill_super" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616fd34d017000ecf9097368b13d8a266f4920b3" } ] }