linux-kernel - Re: KASAN: use-after-free Read in f_hidg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200517062651.GA3024451@kroah.com>
Date:   Sun, 17 May 2020 08:26:51 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Kyungtae Kim <kt0755@...il.com>
Cc:     Felipe Balbi <balbi@...nel.org>,
        USB list <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        Dave Tian <dave.jing.tian@...il.com>
Subject: Re: KASAN: use-after-free Read in f_hidg_poll

On Sun, May 17, 2020 at 01:02:40AM +0000, Kyungtae Kim wrote:
> We report a bug (in linux-5.6.11) found by FuzzUSB (a modified version
> of syzkaller)
> 
> kernel config: https://kt0755.github.io/etc/config_v5.6.11
> 
> This bug happened when accessing a f_hidg instance deallocated.
> Specifically, f_hidg_poll() tries to access hidg (at line 424), 
> but memory error occurs because hidg has been freed 
> by configfs_unlink() in another thread (PID: 3190).
> 
> To fix, we check if either hidg is still in use when deallocating
> or it is still vaild after poll_wait()  in f_hidg_poll().

Great, can you send a patch for this to resolve the issue?

thanks,

gre gk-h