linux-kernel - BUG: KASAN: use-after-free in xhci_trb_virt_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Jul 2018 11:44:49 +0200
From:   Paul Menzel <pmenzel+linux-usb@...gen.mpg.de>
To:     Mathias Nyman <mathias.nyman@...el.com>
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: BUG: KASAN: use-after-free in xhci_trb_virt_to_dma.part.24+0x1c/0x80

Dear Linux folks,


Using Linux 4.18-rc5+ with kmemleak enabled on a MSI B350M MORTAR (MS-7A37)
with an AMD Ryzen 3 2200G, the memory leak below is suspected.

```
$ sudo less /sys/kernel/debug/kmemleak
unreferenced object 0xffff894f8874a2b8 (size 8):
  comm "systemd-udevd", pid 119, jiffies 4294893109 (age 908.348s)
  hex dump (first 8 bytes):
    34 01 05 00 00 00 00 00                          4.......
  backtrace:
    [<00000000308e4456>] xhci_init+0x81/0x170 [xhci_hcd]
    [<00000000269aa18f>] xhci_gen_setup+0x2cb/0x510 [xhci_hcd]
    [<000000007b70d85f>] xhci_pci_setup+0x4d/0x120 [xhci_pci]
    [<0000000059f49127>] usb_add_hcd+0x2b6/0x800 [usbcore]
    [<000000009a16d67c>] usb_hcd_pci_probe+0x1f3/0x460 [usbcore]
    [<0000000001295c2e>] xhci_pci_probe+0x27/0x1d7 [xhci_pci]
    [<00000000395bd8f9>] local_pci_probe+0x41/0x90
    [<00000000a344e362>] pci_device_probe+0x189/0x1a0
    [<00000000318999e5>] driver_probe_device+0x2b9/0x460
    [<00000000c29d8a55>] __driver_attach+0xdd/0x110
    [<00000000975b7f46>] bus_for_each_dev+0x76/0xc0
    [<000000006bc40955>] bus_add_driver+0x152/0x230
    [<00000000840ed63c>] driver_register+0x6b/0xb0
    [<00000000123908c4>] do_one_initcall+0x46/0x1c3
    [<00000000ce69c793>] do_init_module+0x5a/0x210
    [<0000000091d4aef2>] load_module+0x21c4/0x2410
[…]
```


Kind regards,

Paul



Download attachment "smime.p7s" of type "application/pkcs7-signature" (5174 bytes)