linux-kernel - Re: KASAN: use-after-free Write in config_item

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 11 May 2020 08:35:07 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Kyungtae Kim <kt0755@...il.com>
Cc:     Joel Becker <jlbec@...lplan.org>, Christoph Hellwig <hch@....de>,
        syzkaller <syzkaller@...glegroups.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Dave Tian <dave.jing.tian@...il.com>
Subject: Re: KASAN: use-after-free Write in config_item_get

On Mon, May 11, 2020 at 05:52:16AM +0000, Kyungtae Kim wrote:
> We report a bug (in linux-5.6.8) found by FuzzUSB (a modified version
> of syzkaller)
> 
> kernel config: https://kt0755.github.io/etc/config_v5.6.8
> 
> 
> This bug happened when accessing a configfs_item instance right after being
> deallocated.
> Specifically, config_item_get() tries to access ci_kref element in a config_item instance. 
> But this led to memory access violation because that instance (held by a fsg_opts structure) 
> had been freed by fsg_free_inst() in another thread (PID: 2603).
> 
> To fix, it needs to check if the config_item instance is still in use 
> when trying to deallocate it.

Great, can you create a patch to fix this now that you have a solid test
for it?

thanks,

greg k-h