lkml.org 
[lkml]   [2019]   [Nov]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: KASAN: use-after-free Read in si470x_int_in_callback (2)
From
Date
Am Mittwoch, den 27.11.2019, 13:07 -0500 schrieb Alan Stern:
> Index: usb-devel/drivers/media/radio/si470x/radio-si470x-usb.c
> ===================================================================
> --- usb-devel.orig/drivers/media/radio/si470x/radio-si470x-usb.c
> +++ usb-devel/drivers/media/radio/si470x/radio-si470x-usb.c
> @@ -370,15 +370,14 @@ static void si470x_int_in_callback(struc
> unsigned char tmpbuf[3];
>
> if (urb->status) {
> - if (urb->status == -ENOENT ||
> + if (!(urb->status == -ENOENT ||
> urb->status == -ECONNRESET ||
> - urb->status == -ESHUTDOWN) {
> - return;
> - } else {
> + urb->status == -ESHUTDOWN))
> dev_warn(&radio->intf->dev,
> - "non-zero urb status (%d)\n", urb->status);
> - goto resubmit; /* Maybe we can recover. */
> - }
> + "unrecognized urb status (%d)\n",
> + urb->status);
> + radio->int_in_running = 0;
> + return;

Hi,

it is a bit awkward to complain here, as your patch tests as correct
while mine didn't, but this is a race condition.
You can't guarantee that urb->status != 0.
The kill may happen while the completion handler is running for
a successful transfer.

I really appreciate your help, but I must understand what is going
wrong here. You are stopping the resubmit, but how could the resubmit
ever have not failed?

Regards
Oliver

\
 
 \ /
  Last update: 2019-11-28 11:52    [W:0.065 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site