lkml.org 
[lkml]   [2023]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
On Thu, Aug 17, 2023 at 02:16:26PM +0200, Oliver Neukum wrote:
> On 12.08.23 17:56, Alan Stern wrote:
> Hi,
> > The real problem seems to be some sort of race in usbtmc and the core
> > between URBs being added to an anchor, file I/O being stopped, and URBs
> > being killed or scuttled when the file is flushed.
>
> just to make sure, you think it is failing here:
>
> usb_anchor_resume_wakeups(anchor);

That's what the syzbot console log output shows in the stack dump.

> because we cannot guarantee that the anchor pointer
> is still valid,

That's my conclusion. There don't seem to be any other candidates for a
bad pointer.

> unless we refcount anchors, which would
> make embedding them impossible?

Whether the validity is ensured by refcounting or by some other
mechanism is up to the implementor (i.e., you). I'm merely trying to
restate and explain the syzbot results in terms understandable by
humans.

Alan Stern

\
 
 \ /
  Last update: 2023-08-17 16:14    [W:0.044 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site