Messages in this thread | | | Date | Tue, 27 Jul 2021 18:33:23 +0300 | From | Dan Carpenter <> | Subject | Re: [syzbot] KASAN: use-after-free Read in em28xx_close_extension |
| |
On Tue, Jul 27, 2021 at 11:13:13PM +0800, Dongliang Mu wrote: > On Tue, Jul 27, 2021 at 10:15 PM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > > > On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote: > > > Along the probe path, > > > > > > em28xx_usb_probe > > > dev = kzalloc(sizeof(*dev), GFP_KERNEL); > > > retval = em28xx_init_dev(dev, udev, intf, nr); > > > em28xx_init_extension(dev); > > > em28xx_ir_init(struct em28xx *dev) > > > kref_get(&dev->ref); > > > > > > kref_init(&dev->ref); > > > > Hi Dan, > > I have developed a patch [1] to fix this crash. Would you like to help > me double-check if it correctly fixes the underlying bug? > > [1] [PATCH v2] [media] em28xx-input: fix refcount bug in > em28xx_usb_disconnect https://lkml.org/lkml/2021/7/19/263
No one likes to review patches which aren't sent over email... :/ LKML.org doesn't give the message-id so I can't use b4 to download the email.
That patch doesn't make any sense. We call kref_get() at the start of the function so we need to call kref_put() at the end. The fact that em28xx_ir_fini() calls kref_put() doesn't matter. We will only call fini if the init() succeeds (hopefully). The em28xx_ir_init() error handling is Ad Hoc Style but I don't see anything outright buggy.
I think Hillf's approach is correct.
regards, dan carpenter
| |