Messages in this thread Patch in this message | | | Date | Tue, 22 Nov 2022 19:57:59 +0800 | Subject | Re: [syzbot] KASAN: use-after-free Write in expire_timers | From | Yu Liao <> |
| |
On 2022/11/22 2:35, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: b6e7fdfd6f6a Merge tag 'iommu-fixes-v6.1-rc5' of git://git.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=11c28f95880000 > kernel config: https://syzkaller.appspot.com/x/.config?x=95fb379f123ba8ce > dashboard link: https://syzkaller.appspot.com/bug?extid=38ee3533e07da8749f85 > compiler: aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > userspace arch: arm64
Fix data race between virtual_ncidev_close() and virtual_ncidev_open().
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b6e7fdfd6f6a
--- a/drivers/nfc/virtual_ncidev.c +++ b/drivers/nfc/virtual_ncidev.c @@ -161,12 +161,8 @@ static int virtual_ncidev_close(struct inode *inode, struct file *file)
if (state == virtual_ncidev_enabled) { state = virtual_ncidev_disabling; - mutex_unlock(&nci_mutex); - nci_unregister_device(ndev); nci_free_device(ndev); - - mutex_lock(&nci_mutex); }
state = virtual_ncidev_disabled; --
| |