Re: [syzbot] KASAN: use-after-free Read in em28xx_close_extension

[Dan Carpenter <dan.carpenter@oracle.com>]

On Tue, Jul 27, 2021 at 11:13:13PM +0800, Dongliang Mu wrote:
> On Tue, Jul 27, 2021 at 10:15 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
> >
> > On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote:
> > > Along the probe path,
> > >
> > > em28xx_usb_probe
> > >   dev = kzalloc(sizeof(*dev), GFP_KERNEL);
> > >   retval = em28xx_init_dev(dev, udev, intf, nr);
> > >     em28xx_init_extension(dev);
> > >       em28xx_ir_init(struct em28xx *dev)
> > >         kref_get(&dev->ref);
> > >
> > >   kref_init(&dev->ref);
> >
> 
> Hi Dan,
> 
> I have developed a patch [1] to fix this crash. Would you like to help
> me double-check if it correctly fixes the underlying bug?
> 
> [1] [PATCH v2] [media] em28xx-input: fix refcount bug in
> em28xx_usb_disconnect  https://lkml.org/lkml/2021/7/19/263

No one likes to review patches which aren't sent over email...  :/
LKML.org doesn't give the message-id so I can't use b4 to download the
email.

That patch doesn't make any sense.  We call kref_get() at the start of
the function so we need to call kref_put() at the end.  The fact that
em28xx_ir_fini() calls kref_put() doesn't matter.  We will only call
fini if the init() succeeds (hopefully).  The em28xx_ir_init() error
handling is Ad Hoc Style but I don't see anything outright buggy.

I think Hillf's approach is correct.

regards,
dan carpenter