On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+0243cb250a51eeefb8cc@xxxxxxxxxxxxxxxxxxxxxxxxx > > usb 1-1: USB disconnect, device number 4 > ================================================================== > BUG: KASAN: use-after-free in atomic64_read > include/asm-generic/atomic-instrumented.h:836 [inline] > BUG: KASAN: use-after-free in atomic_long_read > include/asm-generic/atomic-long.h:28 [inline] > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > kernel/locking/mutex.c:1211 > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 Let's resend and retest using the latest usb-fuzzer kernel, which includes the fix for a couple char dev races that we were now hitting: #syz test: https://github.com/google/kasan.git e0bd8d79 I'll fix the failure to stop I/O at disconnect separately. Johan >From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@xxxxxxxxxx> Date: Thu, 19 Sep 2019 11:48:38 +0200 Subject: [PATCH] USB: adutux: fix use-after-free on disconnect The driver was clearing its struct usb_device pointer, which it uses as an inverted disconnected flag, before deregistering the character device and without serialising against racing release(). This could lead to a use-after-free if a racing release() callback observes the cleared pointer and frees the driver data before disconnect() is finished with it. This could also lead to NULL-pointer dereferences in a racing open(). Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") Reported-by: syzbot+0243cb250a51eeefb8cc@xxxxxxxxxxxxxxxxxxxxxxxxx Cc: stable <stable@xxxxxxxxxxxxxxx> # 2.6.24 Signed-off-by: Johan Hovold <johan@xxxxxxxxxx> --- drivers/usb/misc/adutux.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c index 344d523b0502..bcc138990e2f 100644 --- a/drivers/usb/misc/adutux.c +++ b/drivers/usb/misc/adutux.c @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface) dev = usb_get_intfdata(interface); - mutex_lock(&dev->mtx); /* not interruptible */ - dev->udev = NULL; /* poison */ usb_deregister_dev(interface, &adu_class); - mutex_unlock(&dev->mtx); mutex_lock(&adutux_mutex); usb_set_intfdata(interface, NULL); + mutex_lock(&dev->mtx); /* not interruptible */ + dev->udev = NULL; /* poison */ + mutex_unlock(&dev->mtx); + /* if the device is not opened, then we clean up right now */ if (!dev->open_count) adu_delete(dev); -- 2.23.0
