linux-kernel - Re: [BUG] usb: serial: garmin_gps: A possible concurrency use-after-free bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <794dc03a-527e-0e47-fba2-adf84fa3c7cf@gmail.com>
Date:   Thu, 20 Dec 2018 21:48:27 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     Johan Hovold <johan@...nel.org>
Cc:     Greg KH <gregkh@...uxfoundation.org>, linux-usb@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] usb: serial: garmin_gps: A possible concurrency
 use-after-free bug



On 2018/12/20 21:46, Johan Hovold wrote:
> On Thu, Dec 20, 2018 at 09:41:16PM +0800, Jia-Ju Bai wrote:
>> In drivers/usb/serial/garmin_gps.c,
>> the functions garmin_read_bulk_callback() and garmin_write_bulk_callback()
>> may be concurrently executed.
>>
>> In garmin_write_bulk_callback() on line 969:
>>       kfree(urb->transfer_buffer);
>> In garmin_read_bulk_callback() on line 1165:
>>       unsigned char *data = urb->transfer_buffer;
>> Thus, a concurrency use-after-free bug may occur.
> No, they operate on different struct urb.
>
>> This possible bug is found by a static analysis tool written by myself.
> Seems you need to update your tool. Please also make sure to review its
> output before reporting anything.

Okay, thanks for your reply.
Sorry for my false positive...


Best wishes,
Jia-Ju Bai