Re: [Report]: BUG: KASAN: use-after-free in usb_hcd_pci_remove

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Aug 15, 2020 at 12:55:57AM +0300, Andy Shevchenko wrote:
> On Friday, August 14, 2020, Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> wrote:
> 
> > On Fri, Aug 14, 2020 at 09:07:20PM +0300, Andy Shevchenko wrote:
> > > On Fri, Aug 14, 2020 at 06:18:16PM +0100, John Garry wrote:
> >
> > > > diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
> > > > index 4dc443aaef5c..44a8d3644973 100644
> > > > --- a/drivers/usb/core/hcd-pci.c
> > > > +++ b/drivers/usb/core/hcd-pci.c
> > > > @@ -346,9 +346,9 @@ void usb_hcd_pci_remove(struct pci_dev *dev)
> > > >             dev_set_drvdata(&dev->dev, NULL);
> > > >             up_read(&companions_rwsem);
> > > >     }
> > > > -   usb_put_hcd(hcd);
> > > >     if ((hcd->driver->flags & HCD_MASK) < HCD_USB3)
> > > >             pci_free_irq_vectors(dev);
> > > > +   usb_put_hcd(hcd);
> > >
> > > It's not correct approach.
> > > We need to copy flags to a temporary variable.
> > > I will send a new patch soon to test, thanks!
> >
> > Just out of curiosity, can you explain what is wrong with John's
> > approach?  The problem isn't obvious to me.
> 
> 
> Alloc vector -> create HCD -> put HCD -> free vector
> 
> VS.
> 
> Alloc vector -> create HCD -> free vector -> put HCD
> 
> Of course I might miss something...

Sure, the difference in ordering was pretty obvious.  What is not 
obvious is why this should cause a problem.

Do you think that the host controller driver is going to try to use the 
IRQ vector somewhere between the pci_free_irq_vectors call and the 
usb_put_hcd call?  If that's not going to happen then I don't see what 
difference the order of the two calls makes.

Alan Stern



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux