lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [syzbot] KASAN: use-after-free Read in em28xx_close_extension
On Tue, Jul 27, 2021 at 11:13:13PM +0800, Dongliang Mu wrote:
> On Tue, Jul 27, 2021 at 10:15 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
> >
> > On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote:
> > > Along the probe path,
> > >
> > > em28xx_usb_probe
> > > dev = kzalloc(sizeof(*dev), GFP_KERNEL);
> > > retval = em28xx_init_dev(dev, udev, intf, nr);
> > > em28xx_init_extension(dev);
> > > em28xx_ir_init(struct em28xx *dev)
> > > kref_get(&dev->ref);
> > >
> > > kref_init(&dev->ref);
> >
>
> Hi Dan,
>
> I have developed a patch [1] to fix this crash. Would you like to help
> me double-check if it correctly fixes the underlying bug?
>
> [1] [PATCH v2] [media] em28xx-input: fix refcount bug in
> em28xx_usb_disconnect https://lkml.org/lkml/2021/7/19/263

No one likes to review patches which aren't sent over email... :/
LKML.org doesn't give the message-id so I can't use b4 to download the
email.

That patch doesn't make any sense. We call kref_get() at the start of
the function so we need to call kref_put() at the end. The fact that
em28xx_ir_fini() calls kref_put() doesn't matter. We will only call
fini if the init() succeeds (hopefully). The em28xx_ir_init() error
handling is Ad Hoc Style but I don't see anything outright buggy.

I think Hillf's approach is correct.

regards,
dan carpenter

\
 
 \ /
  Last update: 2021-07-27 17:36    [W:1.447 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site