lkml.org 
[lkml]   [2021]   [Jul]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [syzbot] KASAN: use-after-free Read in em28xx_close_extension
On Tue, Jul 27, 2021 at 05:14:55PM +0300, Dan Carpenter wrote:
> On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote:
> > Along the probe path,
> >
> > em28xx_usb_probe
> > dev = kzalloc(sizeof(*dev), GFP_KERNEL);
> > retval = em28xx_init_dev(dev, udev, intf, nr);
> > em28xx_init_extension(dev);
> > em28xx_ir_init(struct em28xx *dev)
> > kref_get(&dev->ref);
> >
> > kref_init(&dev->ref);
>
> Good detective work.
>
> I've created a Smatch check to try find these. It uses the fact that
> Smatch creates a bunch of fake assignments to set all the struct members
> of "dev" to zero. Then it uses the modification hook to find the
> kref_init(). Those are sort of new uses for those hooks so that's quite
> fun.
>
> I'll test it out overnight and see how it works.

My Smatch check didn't find any other bugs, but it only had 3 false
positives so I'll keep running it nightly on new code.

regards,
dan carpenter

\
 
 \ /
  Last update: 2021-07-28 15:39    [W:0.072 / U:0.416 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site