Messages in this thread | | | Date | Wed, 6 May 2020 11:47:32 -0500 | From | Pete Zaitcev <> | Subject | Re: KASAN: use-after-free Read in usblp_bulk_read |
| |
On Wed, 06 May 2020 11:14:42 +0200 Oliver Neukum <oneukum@suse.com> wrote:
> Very well. We are not going to find it without exceptional luck. Yet > there may be a real issue, too. We simply do not know. How about the > attached patch?
> usblp_unlink_urbs(usblp); > mutex_unlock(&usblp->mut); > + usb_poison_anchored_urbs(&usblp->urbs); > > if (!usblp->used) > usblp_cleanup(usblp);
This can't be right. Our URBs are freed by the callback, and this technique is not compatible with poisoning, at least with how the usb/core.c implements it. The usb_poison_urb() waits for URB to complete, and if the callback frees it, it's a problem.
-- Pete
| |