From: Pavel Skripkin <paskripkin@gmail.com>
To: "Zhang, Qiang1" <qiang1.zhang@intel.com>,
syzbot <syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.com>,
"gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"rafael@kernel.org" <rafael@kernel.org>,
"syzkaller-bugs@googlegroups.com"
<syzkaller-bugs@googlegroups.com>,
"balbi@kernel.org" <balbi@kernel.org>,
"stern@rowland.harvard.edu" <stern@rowland.harvard.edu>
Subject: Re: [syzbot] KASAN: use-after-free Read in dev_uevent
Date: Wed, 23 Feb 2022 14:23:47 +0300 [thread overview]
Message-ID: <81102f38-3e1f-ec36-3119-a098bd5a85c4@gmail.com> (raw)
In-Reply-To: <PH0PR11MB58805E3C4CF7D4C41D49BFCFDA3C9@PH0PR11MB5880.namprd11.prod.outlook.com>
Hi Qiang1,
On 2/23/22 14:17, Zhang, Qiang1 wrote:
>
> Cc: Alan Stern
> Felipe Balbi
>
> Hello syzbot, Please try it:
>
> From 574d45ff924e2d2f9b9f5cc3e846f8004498a811 Mon Sep 17 00:00:00 2001
> From: Zqiang <qiang1.zhang@intel.com>
> Date: Wed, 23 Feb 2022 18:18:22 +0800
> Subject: [PATCH] driver core: Fix use-after-free in dev_uevent()
>
> In dev_uevent(), if the "dev->driver" is valid, the "dev->driver->name"
> be accessed, there may be a window period between these two operations.
> in this window period if the "dev->driver" is set to null
> (in usb_gadget_unregister_driver function), when the "dev->driver->name"
> is accessed again, invalid address will be accessed. fix it by checking
> "dev->driver" again.
>
> Signed-off-by: Zqiang <qiang1.zhang@intel.com>
> ---
> drivers/base/core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index 3d6430eb0c6a..a45b927ee76e 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -2317,7 +2317,7 @@ static int dev_uevent(struct kobject *kobj, struct kobj_uevent_env *env)
> add_uevent_var(env, "DEVTYPE=%s", dev->type->name);
>
> if (dev->driver)
> - add_uevent_var(env, "DRIVER=%s", dev->driver->name);
> + add_uevent_var(env, "DRIVER=%s", dev_driver_string(dev));
>
> /* Add common DT information about the device */
> of_device_uevent(dev, env);
> --
> 2.25.1
>
you should use '#syz test' command to ask syzbot to test the patch.
Basic syntax is '#syz test: <git tree> <branch or sha>' and syzbot will
apply attached patch (if you have attached it)
More about syzbot interactions here [1].
[1]
https://github.com/google/syzkaller/blob/15439f1624735bde5ae3f3b66c1b964a98
With regards,
Pavel Skripkin
next prev parent reply other threads:[~2022-02-23 11:23 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-19 5:48 KASAN: use-after-free Read in dev_uevent syzbot
2022-02-20 17:19 ` [syzbot] " syzbot
2022-02-23 6:51 ` Zhang, Qiang1
2022-02-23 7:13 ` gregkh
2022-02-23 8:08 ` Zhang, Qiang1
2022-02-23 11:17 ` Zhang, Qiang1
2022-02-23 11:23 ` Pavel Skripkin [this message]
2022-02-23 11:27 ` Pavel Skripkin
2022-02-23 11:29 ` gregkh
2022-02-23 14:38 ` stern
2022-02-23 16:00 ` gregkh
2022-02-23 16:34 ` stern
2022-02-24 1:44 ` Zhang, Qiang1
2022-02-24 3:14 ` Zhang, Qiang1
2022-02-24 21:23 ` stern
2022-02-24 22:37 ` gregkh
2022-02-25 2:06 ` stern
2022-02-25 8:53 ` gregkh
2022-02-25 15:51 ` stern
2022-02-26 9:07 ` gregkh
2022-03-02 19:10 ` stern
2022-03-02 21:36 ` gregkh
2022-02-25 1:45 ` Zhang, Qiang1
[not found] <20220223233323.2104-1-hdanton@sina.com>
2022-02-24 0:09 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=81102f38-3e1f-ec36-3119-a098bd5a85c4@gmail.com \
--to=paskripkin@gmail.com \
--cc=balbi@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=qiang1.zhang@intel.com \
--cc=rafael@kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).