On Fri, Aug 14, 2020 at 06:18:16PM +0100, John Garry wrote: Thanks for notifying me, my comments below. ... > From a3b9e1b405d1efdfee2ee672bbf7dc1c7de62d66 Mon Sep 17 00:00:00 2001 > From: John Garry <john.garry@xxxxxxxxxx> > Date: Fri, 14 Aug 2020 18:14:51 +0100 > Subject: [PATCH] usb: hcd: Fix use-after-free in usb_hcd_pci_remove() > > KASAN reports when CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled: Please, reduce these huge trace backs, they have a lot of unneeded bulk. > ================================================================== > [58.095667] BUG: KASAN: use-after-free in usb_hcd_pci_remove+0xbc/0x168 > [58.102272] Read of size 8 at addr ffff002a0b6e8120 by task swapper/0/1 ... > [58.497758] ffff002a0b6e8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb > fb fb > [58.504968] > ================================================================== > > Fix by relocating the usb_put_hcd() call until after the hcd->driver->flags > check. > > Signed-off-by: John Garry <john.garry@xxxxxxxxxx> > > diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c > index 4dc443aaef5c..44a8d3644973 100644 > --- a/drivers/usb/core/hcd-pci.c > +++ b/drivers/usb/core/hcd-pci.c > @@ -346,9 +346,9 @@ void usb_hcd_pci_remove(struct pci_dev *dev) > dev_set_drvdata(&dev->dev, NULL); > up_read(&companions_rwsem); > } > - usb_put_hcd(hcd); > if ((hcd->driver->flags & HCD_MASK) < HCD_USB3) > pci_free_irq_vectors(dev); > + usb_put_hcd(hcd); It's not correct approach. We need to copy flags to a temporary variable. I will send a new patch soon to test, thanks! > pci_disable_device(dev); > } > EXPORT_SYMBOL_GPL(usb_hcd_pci_remove); -- With Best Regards, Andy Shevchenko
