KASAN: use-after-free Read in f_hidg_poll

DISCUSSION Greg KH 1 participant 1 message May 17, 2020 1 message not in the archive USB

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): 20200517010233.GA35431@pizza01

Greg KH

author maintainer

2020-05-17 06:26 UTC #1 lore raw

Quoted 5 lines · Kyungtae Kim

We report a bug (in linux-5.6.11) found by FuzzUSB (a modified version of syzkaller)
kernel config: https://kt0755.github.io/etc/config_v5.6.11

Quoted 7 lines

This bug happened when accessing a f_hidg instance deallocated. Specifically, f_hidg_poll() tries to access hidg (at line 424), but memory error occurs because hidg has been freed by configfs_unlink() in another thread (PID: 3190).
To fix, we check if either hidg is still in use when deallocating or it is still vaild after poll_wait() in f_hidg_poll().

Great, can you send a patch for this to resolve the issue?

thanks,

gre gk-h