linux-kernel - Re: BUG: KASAN: use-after-free in xhci_trb_virt_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Jul 2018 11:54:10 +0200
From:   Greg KH <greg@...ah.com>
To:     Paul Menzel <pmenzel+linux-usb@...gen.mpg.de>
Cc:     Mathias Nyman <mathias.nyman@...el.com>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: BUG: KASAN: use-after-free in
 xhci_trb_virt_to_dma.part.24+0x1c/0x80

On Fri, Jul 20, 2018 at 11:44:49AM +0200, Paul Menzel wrote:
> Dear Linux folks,
> 
> 
> Using Linux 4.18-rc5+ with kmemleak enabled on a MSI B350M MORTAR (MS-7A37)
> with an AMD Ryzen 3 2200G, the memory leak below is suspected.
> 
> ```
> $ sudo less /sys/kernel/debug/kmemleak
> unreferenced object 0xffff894f8874a2b8 (size 8):
>   comm "systemd-udevd", pid 119, jiffies 4294893109 (age 908.348s)
>   hex dump (first 8 bytes):
>     34 01 05 00 00 00 00 00                          4.......
>   backtrace:
>     [<00000000308e4456>] xhci_init+0x81/0x170 [xhci_hcd]
>     [<00000000269aa18f>] xhci_gen_setup+0x2cb/0x510 [xhci_hcd]
>     [<000000007b70d85f>] xhci_pci_setup+0x4d/0x120 [xhci_pci]
>     [<0000000059f49127>] usb_add_hcd+0x2b6/0x800 [usbcore]
>     [<000000009a16d67c>] usb_hcd_pci_probe+0x1f3/0x460 [usbcore]
>     [<0000000001295c2e>] xhci_pci_probe+0x27/0x1d7 [xhci_pci]
>     [<00000000395bd8f9>] local_pci_probe+0x41/0x90
>     [<00000000a344e362>] pci_device_probe+0x189/0x1a0
>     [<00000000318999e5>] driver_probe_device+0x2b9/0x460
>     [<00000000c29d8a55>] __driver_attach+0xdd/0x110
>     [<00000000975b7f46>] bus_for_each_dev+0x76/0xc0
>     [<000000006bc40955>] bus_add_driver+0x152/0x230
>     [<00000000840ed63c>] driver_register+0x6b/0xb0
>     [<00000000123908c4>] do_one_initcall+0x46/0x1c3
>     [<00000000ce69c793>] do_init_module+0x5a/0x210
>     [<0000000091d4aef2>] load_module+0x21c4/0x2410
> […]
> ```

That's really vague.  Any chance for a reproducer or some other types of
hints as to what you feel the problem is here?

thanks,

greg k-h