lkml.org 
[lkml]   [2022]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [syzbot] KASAN: use-after-free Read in port100_send_complete
From
On 3/8/22 21:03, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 38f80f42147f MAINTAINERS: Remove dead patchwork link
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14b0d321700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=542b2708133cc492
> dashboard link: https://syzkaller.appspot.com/bug?extid=16bcb127fb73baeecb14
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a63d21700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d21be1700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+16bcb127fb73baeecb14@syzkaller.appspotmail.com
>
> port100 5-1:0.0: NFC: Urb failure (status -71)
> ==================================================================
> BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
> Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26

We need to kill urbs on disconnect, since urbs callbacks they may access
freed memory

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master




With regards,
Pavel Skripkindiff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index d7db1a0e6be1..00d8ea6dcb5d 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -1612,7 +1612,9 @@ static int port100_probe(struct usb_interface *interface,
nfc_digital_free_device(dev->nfc_digital_dev);

error:
+ usb_kill_urb(dev->in_urb);
usb_free_urb(dev->in_urb);
+ usb_kill_urb(dev->out_urb);
usb_free_urb(dev->out_urb);
usb_put_dev(dev->udev);
\
 
 \ /
  Last update: 2022-03-08 19:13    [W:0.034 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site