* Re: KASAN: use-after-free Write in config_item_get
[not found] <20200511055200.GA31686@pizza01>
@ 2020-05-11 6:35 ` Greg KH
0 siblings, 0 replies; only message in thread
From: Greg KH @ 2020-05-11 6:35 UTC (permalink / raw)
To: Kyungtae Kim; +Cc: Joel Becker, Christoph Hellwig, syzkaller, LKML, Dave Tian
On Mon, May 11, 2020 at 05:52:16AM +0000, Kyungtae Kim wrote:
> We report a bug (in linux-5.6.8) found by FuzzUSB (a modified version
> of syzkaller)
>
> kernel config: https://kt0755.github.io/etc/config_v5.6.8
>
>
> This bug happened when accessing a configfs_item instance right after being
> deallocated.
> Specifically, config_item_get() tries to access ci_kref element in a config_item instance.
> But this led to memory access violation because that instance (held by a fsg_opts structure)
> had been freed by fsg_free_inst() in another thread (PID: 2603).
>
> To fix, it needs to check if the config_item instance is still in use
> when trying to deallocate it.
Great, can you create a patch to fix this now that you have a solid test
for it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-05-11 6:35 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20200511055200.GA31686@pizza01>
2020-05-11 6:35 ` KASAN: use-after-free Write in config_item_get Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.