linux-kernel - Re: KASAN: use-after-free Read in adu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Sep 2019 16:31:42 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Johan Hovold <johan@...nel.org>,
        syzbot <syzbot+0243cb250a51eeefb8cc@...kaller.appspotmail.com>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        dmg@...ingmachine.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        USB list <linux-usb@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: KASAN: use-after-free Read in adu_disconnect

On Fri, Sep 20, 2019 at 12:08:30PM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@...nel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot has tested the proposed patch but the reproducer still triggered
> > > crash:
> > > KASAN: use-after-free Read in adu_interrupt_in_callback

> > This looks like a separate issue, which should be fixed by a separate
> > patch. Not sure how to tell syzbot that. Dmitry?
> 
> There is no way, but also no need. There is nothing it can do with that info.
> If you think it's a separate one and you fixed the first one, mail the
> patch with the first fix.
> Optionally, you can fix the second one as well, and then ask it to
> test a patch with 2 fixes (but you will need either to squash them or
> point to a git tree with both commits).
> 
> > There's is indeed another bug in the driver, which could lead to crashes
> > in the completion handler after clearing the struct usb_device pointer,
> > but possibly also to the above use-after-free if a new device is probed
> > immediately after a disconnect.
> >
> > The below patch addresses both bugs, let's see if that helps.
> >
> > #syz test: https://github.com/google/kasan.git e96407b4

Ok, so I was using an old syzbot kernel from when this was first
reported and apparently hit a second issue which had since been fixed by
Alan.

I was starring at usb-next and couldn't see how it was possible to
trigger this, but that code had Alan's fix 303911cfc5b9 ("USB: core: Fix
races in character device registration and deregistraion").

Guess I had to bitten by this to learn the syzbot interface. ;)

Johan