linux-kernel - Re: [syzbot] [usb?] [fs?] KASAN: slab-use-after-free Read in comedi_release_hardware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed,  7 Feb 2024 19:34:05 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+cf1afeda4043ffecf03e@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] [fs?] KASAN: slab-use-after-free Read in comedi_release_hardware_device

On Wed, 07 Feb 2024 00:44:22 -0800
> HEAD commit:    ed5551279c91 Merge 6.8-rc3 into usb-next
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d42d8fe80000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git  usb-testing

--- x/drivers/comedi/drivers.c
+++ y/drivers/comedi/drivers.c
@@ -1034,6 +1034,7 @@ int comedi_auto_config(struct device *ha
 {
 	struct comedi_device *dev;
 	int ret;
+	static DEFINE_MUTEX(ac_mutex);
 
 	if (!hardware_device) {
 		pr_warn("BUG! %s called with NULL hardware_device\n", __func__);
@@ -1051,12 +1052,14 @@ int comedi_auto_config(struct device *ha
 			 driver->driver_name);
 		return -EINVAL;
 	}
+	mutex_lock(&ac_mutex);
 
 	dev = comedi_alloc_board_minor(hardware_device);
 	if (IS_ERR(dev)) {
 		dev_warn(hardware_device,
 			 "driver '%s' could not create device.\n",
 			 driver->driver_name);
+		mutex_unlock(&ac_mutex);
 		return PTR_ERR(dev);
 	}
 	/* Note: comedi_alloc_board_minor() locked dev->mutex. */
@@ -1084,6 +1087,7 @@ int comedi_auto_config(struct device *ha
 			 driver->driver_name, dev->board_name);
 		mutex_unlock(&dev->mutex);
 	}
+	mutex_unlock(&ac_mutex);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(comedi_auto_config);
--