From: Greg KH <gregkh@linuxfoundation.org>
To: Kyungtae Kim <kt0755@gmail.com>
Cc: Felipe Balbi <balbi@kernel.org>,
USB list <linux-usb@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>,
Dave Tian <dave.jing.tian@gmail.com>
Subject: Re: KASAN: use-after-free Read in f_hidg_poll
Date: Sun, 17 May 2020 08:26:51 +0200 [thread overview]
Message-ID: <20200517062651.GA3024451@kroah.com> (raw)
In-Reply-To: <20200517010233.GA35431@pizza01>
On Sun, May 17, 2020 at 01:02:40AM +0000, Kyungtae Kim wrote:
> We report a bug (in linux-5.6.11) found by FuzzUSB (a modified version
> of syzkaller)
>
> kernel config: https://kt0755.github.io/etc/config_v5.6.11
>
> This bug happened when accessing a f_hidg instance deallocated.
> Specifically, f_hidg_poll() tries to access hidg (at line 424),
> but memory error occurs because hidg has been freed
> by configfs_unlink() in another thread (PID: 3190).
>
> To fix, we check if either hidg is still in use when deallocating
> or it is still vaild after poll_wait() in f_hidg_poll().
Great, can you send a patch for this to resolve the issue?
thanks,
gre gk-h
parent reply other threads:[~2020-05-17 6:26 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <20200517010233.GA35431@pizza01>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200517062651.GA3024451@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=balbi@kernel.org \
--cc=dave.jing.tian@gmail.com \
--cc=kt0755@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome