Messages in this thread | | | Date | Sun, 17 May 2020 08:26:51 +0200 | From | Greg KH <> | Subject | Re: KASAN: use-after-free Read in f_hidg_poll |
| |
On Sun, May 17, 2020 at 01:02:40AM +0000, Kyungtae Kim wrote: > We report a bug (in linux-5.6.11) found by FuzzUSB (a modified version > of syzkaller) > > kernel config: https://kt0755.github.io/etc/config_v5.6.11 > > This bug happened when accessing a f_hidg instance deallocated. > Specifically, f_hidg_poll() tries to access hidg (at line 424), > but memory error occurs because hidg has been freed > by configfs_unlink() in another thread (PID: 3190). > > To fix, we check if either hidg is still in use when deallocating > or it is still vaild after poll_wait() in f_hidg_poll().
Great, can you send a patch for this to resolve the issue?
thanks,
gre gk-h
| |