linux-kernel - Re: KASAN: use-after-free Read in evdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200524112244.GA1919625@kroah.com>
Date:   Sun, 24 May 2020 13:22:44 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     syzbot <syzbot+20458a5eab138777efc9@...kaller.appspotmail.com>
Cc:     brendanhiggins@...gle.com, dmitry.torokhov@...il.com,
        heikki.krogerus@...ux.intel.com, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org, rafael.j.wysocki@...el.com,
        rdunlap@...radead.org, rydberg@...math.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: use-after-free Read in evdev_cleanup

On Sun, May 24, 2020 at 03:24:12AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    c11d28ab Add linux-next specific files for 20200522
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=14f54441100000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3f6dbdea4159fb66
> dashboard link: https://syzkaller.appspot.com/bug?extid=20458a5eab138777efc9
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=133e254a100000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15dbf016100000
> 
> The bug was bisected to:
> 
> commit 4ef12f7198023c09ad6d25b652bd8748c965c7fa
> Author: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
> Date:   Wed May 13 15:18:40 2020 +0000
> 
>     kobject: Make sure the parent does not get released before its children

All issues that point to this commit can be now marked invalid as it has
been reverted in Linus's tree.

thanks,

greg k-h