linux-kernel - Re: KASAN: use-after-free Read in configfs_composite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 4 Sep 2022 21:21:07 +0800
From:   Rondreis <linhaoguo86@...il.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: KASAN: use-after-free Read in configfs_composite_bind

Thanks for your reply! I ran the reproducer again on the master
branch(commit id: 7726d4c3e60bfe206738894267414a5f10510f1a) and it
didn't crash.

The reason for not using the latest version is I can't attach more
than one gadget at a time using `configfs` and `dummy_hcd`. When I
attach the second gadget with a different `udc` it always fails and
the kernel message says:

```
[ 1625.254858] Error: Driver 'configfs-gadget' is already registered,
aborting...
[ 1625.271018] UDC core: g1: driver registration failed: -16
```

I'm not sure if this is a new feature from version v5.19(v5.18, commit
id: 4b0986a3613c92f4ec1bdc7f60ec66fea135991f works very well) or a
potential bug, or my mistake...

The kernel config is: https://pastebin.com/raw/SLmNMMRd
The shell to attach gadgets is: https://pastebin.com/raw/2eDPNip3
The kernel log is: https://pastebin.com/raw/MaDwMQWk

Best wishes!
Rondreis