Messages in this thread | | | Date | Thu, 17 Aug 2023 14:16:26 +0200 | Subject | Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups | From | Oliver Neukum <> |
| |
On 12.08.23 17:56, Alan Stern wrote: Hi,
> The real problem seems to be some sort of race in usbtmc and the core > between URBs being added to an anchor, file I/O being stopped, and URBs > being killed or scuttled when the file is flushed.
just to make sure, you think it is failing here:
usb_anchor_resume_wakeups(anchor);
because we cannot guarantee that the anchor pointer is still valid, unless we refcount anchors, which would make embedding them impossible?
Regards Oliver
| |