linux-kernel - Re: [syzbot] KASAN: use-after-free Read in em28xx_close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210727153323.GO1931@kadam>
Date:   Tue, 27 Jul 2021 18:33:23 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Dongliang Mu <mudongliangabcd@...il.com>
Cc:     Hillf Danton <hdanton@...a.com>,
        syzbot <syzbot+005037419ebdf14e1d87@...kaller.appspotmail.com>,
        Igor Matheus Andrade Torrente <igormtorrente@...il.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        linux-media@...r.kernel.org,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] KASAN: use-after-free Read in em28xx_close_extension

On Tue, Jul 27, 2021 at 11:13:13PM +0800, Dongliang Mu wrote:
> On Tue, Jul 27, 2021 at 10:15 PM Dan Carpenter <dan.carpenter@...cle.com> wrote:
> >
> > On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote:
> > > Along the probe path,
> > >
> > > em28xx_usb_probe
> > >   dev = kzalloc(sizeof(*dev), GFP_KERNEL);
> > >   retval = em28xx_init_dev(dev, udev, intf, nr);
> > >     em28xx_init_extension(dev);
> > >       em28xx_ir_init(struct em28xx *dev)
> > >         kref_get(&dev->ref);
> > >
> > >   kref_init(&dev->ref);
> >
> 
> Hi Dan,
> 
> I have developed a patch [1] to fix this crash. Would you like to help
> me double-check if it correctly fixes the underlying bug?
> 
> [1] [PATCH v2] [media] em28xx-input: fix refcount bug in
> em28xx_usb_disconnect  https://lkml.org/lkml/2021/7/19/263

No one likes to review patches which aren't sent over email...  :/
LKML.org doesn't give the message-id so I can't use b4 to download the
email.

That patch doesn't make any sense.  We call kref_get() at the start of
the function so we need to call kref_put() at the end.  The fact that
em28xx_ir_fini() calls kref_put() doesn't matter.  We will only call
fini if the init() succeeds (hopefully).  The em28xx_ir_init() error
handling is Ad Hoc Style but I don't see anything outright buggy.

I think Hillf's approach is correct.

regards,
dan carpenter