linux-kernel - Re: BUG: KASAN: i2c dev use after free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 22 Mar 2020 17:18:16 +0100
From:   Wolfram Sang <wsa@...-dreams.de>
To:     Anders Roxell <anders.roxell@...aro.org>
Cc:     erico.nunes@...acom.ind.br, dan.carpenter@...cle.com,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: BUG: KASAN: i2c dev use after free


> I think patch introduced this issue d6760b14d4a1 ("i2c: dev: switch
> from register_chrdev to cdev API")
> and patch e6be18f6d62c ("i2c: dev: use after free in detach") tried to solve it.
> However, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled it delays
> the ->release callback to make sure that anything that is done in release can
> be done later than it happens in normal execution.
> The cdev structure is supposed to be freed in the remove callback or after it,
> but here it has already been freed by the put_i2c_dev().

For the record, Kevin Hao fixed it and it is now in linux-next as:
1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev")

Thanks, Kevin!


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)