On Mo, 2019-05-13 at 03:23 -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: 43151d6c usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=16b64110a00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234 > dashboard link: https://syzkaller.appspot.com/bug?extid=200d4bb11b23d929335f > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1634c900a00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+200d4bb11b23d929335f@xxxxxxxxxxxxxxxxxxxxxxxxx > > usb 1-1: config 0 descriptor?? > usb 1-1: reset high-speed USB device number 2 using dummy_hcd > usb 1-1: device descriptor read/64, error -71 > usb 1-1: Using ep0 maxpacket: 8 > usb 1-1: Loading firmware file isl3887usb > usb 1-1: Direct firmware load for isl3887usb failed with error -2 > usb 1-1: Firmware not found. > ================================================================== > BUG: KASAN: use-after-free in p54u_load_firmware_cb.cold+0x97/0x13a > drivers/net/wireless/intersil/p54/p54usb.c:936 > Read of size 8 at addr ffff88809803f588 by task kworker/1:0/17 Hi, it looks to me as if refcounting is broken. You should have a usb_put_dev() in p54u_load_firmware_cb() or in p54u_disconnect(), but not both. Regards Oliver
