linux-kernel - Re: [syzbot] KASAN: use-after-free Read in rtl8712_dl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Oct 2021 23:49:32 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     syzbot <syzbot+c55162be492189fb4f51@...kaller.appspotmail.com>,
        Larry.Finger@...inger.net, agamkohli9@...il.com,
        florian.c.schilhabel@...glemail.com, gregkh@...uxfoundation.org,
        linux-kernel@...r.kernel.org, linux-staging@...ts.linux.dev,
        linux-usb@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in rtl8712_dl_fw

On 10/19/21 18:29, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8ef1e58783b9 usb: typec: STUSB160X should select REGMAP_I2C
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1106dcfb300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c27d285bdb7457e2
> dashboard link: https://syzkaller.appspot.com/bug?extid=c55162be492189fb4f51
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12725770b00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1168c158b00000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c55162be492189fb4f51@...kaller.appspotmail.com
> 

Ok, this driver can't be fixed.... Let's try unregister netdev before 
doing clean up stuff to not race with ->ndo_open()

#syz test: 
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing





With regards,
Pavel Skripkin
View attachment "ph" of type "text/plain" (847 bytes)