From: Alan Stern <stern@rowland.harvard.edu>
To: Oliver Neukum <oneukum@suse.com>
Cc: syzbot <syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com>,
<andreyknvl@google.com>, <hverkuil@xs4all.nl>,
<linux-kernel@vger.kernel.org>, <linux-media@vger.kernel.org>,
<linux-usb@vger.kernel.org>, <mchehab@kernel.org>,
<syzkaller-bugs@googlegroups.com>
Subject: Re: KASAN: use-after-free Read in si470x_int_in_callback (2)
Date: Thu, 28 Nov 2019 12:33:42 -0500 (EST) [thread overview]
Message-ID: <Pine.LNX.4.44L0.1911281225340.19734-100000@netrider.rowland.org> (raw)
In-Reply-To: <1574938260.21204.5.camel@suse.com>
On Thu, 28 Nov 2019, Oliver Neukum wrote:
> Hi,
>
> it is a bit awkward to complain here, as your patch tests as correct
> while mine didn't, but this is a race condition.
> You can't guarantee that urb->status != 0.
> The kill may happen while the completion handler is running for
> a successful transfer.
>
> I really appreciate your help, but I must understand what is going
> wrong here. You are stopping the resubmit, but how could the resubmit
> ever have not failed?
You probably have figured all this out already, but I'll answer anyway.
The code I changed doesn't race with the error condition you were
concerned about. The two are independent, and it doesn't matter if the
kill happens while the completion handler is running.
In the case my patch addresses, the resubmit does not fail. Rather, it
succeeds but then the URB completes with a -EPROTO error. The problem
is that the completion handler then resubmits the URB again, and it
completes again with the same error, right away, in a tight loop --
which prevents the CPU from executing any other code. The way to fix
the problem is to break the loop by not resubmitting, which is what the
patch does.
Alan Stern
next prev parent reply other threads:[~2019-11-28 17:33 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-18 14:53 KASAN: use-after-free Read in si470x_int_in_callback (2) syzbot
2019-11-18 13:44 ` Oliver Neukum
2019-11-19 9:10 ` syzbot
2019-11-20 10:32 ` Oliver Neukum
2019-11-20 23:50 ` syzbot
2019-11-21 12:00 ` Oliver Neukum
2019-11-22 10:33 ` syzbot
2019-11-22 15:35 ` Alan Stern
2019-11-22 19:00 ` Oliver Neukum
2019-11-22 20:12 ` Alan Stern
2019-11-27 10:27 ` Oliver Neukum
2019-11-27 16:30 ` syzbot
2019-11-27 18:07 ` Alan Stern
2019-11-27 20:55 ` syzbot
2019-11-27 21:11 ` Alan Stern
2019-11-28 15:19 ` Oliver Neukum
2019-11-28 17:25 ` Alan Stern
2019-11-28 10:51 ` Oliver Neukum
2019-11-28 17:33 ` Alan Stern [this message]
2019-11-28 11:10 ` Oliver Neukum
2019-11-28 13:53 ` syzbot
2019-12-04 15:03 ` Oliver Neukum
2019-12-04 18:17 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.1911281225340.19734-100000@netrider.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=andreyknvl@google.com \
--cc=hverkuil@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=oneukum@suse.com \
--cc=syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).