archive mirror
 help / color / mirror / Atom feed
From: Dan Carpenter <>
To: Hillf Danton <>
Cc: syzbot <>,,,,
Subject: Re: [syzbot] KASAN: use-after-free Read in em28xx_close_extension
Date: Tue, 27 Jul 2021 17:14:55 +0300	[thread overview]
Message-ID: <20210727141455.GM1931@kadam> (raw)
In-Reply-To: <>

On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote:
> Along the probe path,
> em28xx_usb_probe
>   dev = kzalloc(sizeof(*dev), GFP_KERNEL);
>   retval = em28xx_init_dev(dev, udev, intf, nr);
>     em28xx_init_extension(dev);
>       em28xx_ir_init(struct em28xx *dev)
>         kref_get(&dev->ref);
>   kref_init(&dev->ref);

Good detective work.

I've created a Smatch check to try find these.  It uses the fact that
Smatch creates a bunch of fake assignments to set all the struct members
of "dev" to zero.  Then it uses the modification hook to find the
kref_init().  Those are sort of new uses for those hooks so that's quite

I'll test it out overnight and see how it works.

drivers/media/usb/em28xx/em28xx-cards.c:4086 em28xx_usb_probe() warn: kref has already been modifed (see line 3979)

dan carpenter

#include "smatch.h"
#include "smatch_slist.h"
#include "smatch_extra.h"

static int my_id;


static int get_line(struct sm_state *sm)
	struct sm_state *tmp;
	int line = 0;

	FOR_EACH_PTR(sm->possible, tmp) {
		if (tmp->state == &undefined &&
		    tmp->line > line)
			line = tmp->line;

	if (!line)
		return sm->line;
	return line;

static void match_modify(struct sm_state *sm, struct expression *mod_expr)
	if (sm->state != &fresh &&
	    mod_expr &&
	    mod_expr->type == EXPR_CALL &&
	    sym_name_is("kref_init", mod_expr->fn))
		sm_warning("kref has already been modifed (see line %d)", get_line(sm));

	set_state(my_id, sm->name, sm->sym, &undefined);

static bool is_alloc(struct expression *expr)
	static struct expression *ignore, *alloc_expr;
	struct expression *right;

	if (!expr || expr->type != EXPR_ASSIGNMENT || expr->op != '=')
		return false;
	if (expr == ignore)
		return false;
	if (expr == alloc_expr)
		return true;
	right = strip_expr(expr->right);
	if (right->type == EXPR_CALL &&
	    (sym_name_is("kzalloc", right->fn) ||
	     sym_name_is("kmalloc", right->fn))) {
		alloc_expr = expr;
		return true;
	ignore = expr;
	return false;

static void match_assign(struct expression *expr)
	char *name;

	if (!is_alloc(get_faked_expression()))
	name = expr_to_str(expr->left);
	if (name && strstr(name, "refcount.refs.counter"))
		set_state_expr(my_id, expr->left, &fresh);

void check_kref_init_too_late(int id)
	my_id = id;

	add_hook(&match_assign, ASSIGNMENT_HOOK_AFTER);
	add_modification_hook(my_id, &match_modify);

  parent reply	other threads:[~2021-07-27 14:15 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-14 14:27 [syzbot] KASAN: use-after-free Read in em28xx_close_extension syzbot
     [not found] ` <>
2021-07-27 14:14   ` Dan Carpenter [this message]
2021-07-27 15:13     ` Dongliang Mu
2021-07-27 15:33       ` Dan Carpenter
2021-07-28 13:39     ` Dan Carpenter
2021-10-01  8:55 ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210727141455.GM1931@kadam \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).