Messages in this thread | | | From | Zheng Hacker <> | Date | Thu, 13 Apr 2023 23:35:17 +0800 | Subject | Re: [PATCH] misc: hisi_hikey_usb: Fix use after free bug in hisi_hikey_usb_remove due to race condition |
| |
Greg KH <gregkh@linuxfoundation.org> 于2023年4月13日周四 20:48写道: > > On Thu, Apr 13, 2023 at 07:12:07PM +0800, Zheng Hacker wrote: > > Yongqin Liu <yongqin.liu@linaro.org> 于2023年4月13日周四 18:55写道: > > > > > > Hi, Zheng > > > > > > On Thu, 13 Apr 2023 at 16:08, Zheng Hacker <hackerzheng666@gmail.com> wrote: > > > > > > > > Friendly ping about the bug. > > > > > > Sorry, wasn't aware of this message before, > > > > > > Could you please help share the instructions to reproduce the problem > > > this change fixes? > > > > > > > Hi Yongqin, > > > > Thanks for your reply. This bug is found by static analysis. There is no PoC. > > > > >From my personal experience, triggering race condition bugs stably in > > the kernel needs some tricks. > > For example, you can insert some sleep-time code to slow down the > > thread until the related object is freed. > > Besides, you can use gdb to control the time window. Also, there are > > some other tricks as [1] said. > > > > As for the reproduction, this attack vector requires that the attacker > > can physically access the device. > > When he/she unplugs the usb, the remove function is triggered, and if > > the set callback is invoked, there might be a race condition. > > How does the removal of the USB device trigger a platform device > removal?
Sorry I made a mistake. The USB device usually calls disconnect callback when it's unpluged. What I want to express here is When the driver-related device(here it's USB GPIO Hub) was removed, the remove function is triggered. > > Are you sure this can be triggered by some other way other than manually > unloading the driver?
As I didn't make a PoC, I'm not 100 percent sure about that.
Best regards, Zheng
> > thanks, > > greg k-h
| |