Messages in this thread | | | Date | Tue, 22 Nov 2022 03:58:34 -0800 | Subject | Re: [syzbot] KASAN: use-after-free Write in expire_timers | From | syzbot <> |
| |
> On 2022/11/22 2:35, syzbot wrote: >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: b6e7fdfd6f6a Merge tag 'iommu-fixes-v6.1-rc5' of git://git.. >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=11c28f95880000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=95fb379f123ba8ce >> dashboard link: https://syzkaller.appspot.com/bug?extid=38ee3533e07da8749f85 >> compiler: aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 >> userspace arch: arm64 > > Fix data race between virtual_ncidev_close() and virtual_ncidev_open(). > > #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
This crash does not have a reproducer. I cannot test it.
> b6e7fdfd6f6a > > --- a/drivers/nfc/virtual_ncidev.c > +++ b/drivers/nfc/virtual_ncidev.c > @@ -161,12 +161,8 @@ static int virtual_ncidev_close(struct inode *inode, > struct file *file) > > if (state == virtual_ncidev_enabled) { > state = virtual_ncidev_disabling; > - mutex_unlock(&nci_mutex); > - > nci_unregister_device(ndev); > nci_free_device(ndev); > - > - mutex_lock(&nci_mutex); > } > > state = virtual_ncidev_disabled; > --
| |