Re: [PATCH] au0828: fix use-after-free at USB probing

2017-12-12 Thread Gustavo A. R. Silva
Hey Andrey, Quoting Andrey Konovalov : On Thu, Nov 23, 2017 at 2:31 AM, Gustavo A. R. Silva wrote: Hi Andrey, I have successfully installed and tested syzkaller with QEMU. Can you please tell me how to reproduce this bug or share with me the full crash report? Also, can you point me out to

Re: [PATCH] au0828: fix use-after-free at USB probing

2017-11-22 Thread Gustavo A. R. Silva
Hi Andrey, I have successfully installed and tested syzkaller with QEMU. Can you please tell me how to reproduce this bug or share with me the full crash report? Also, can you point me out to the PoC file? Much appreciated Thank you! -- Gustavo A. R. Silva Quoting Andrey Konovalov : On

Re: [PATCH] au0828: fix use-after-free at USB probing

2017-11-20 Thread Andrey Konovalov
On Fri, Nov 10, 2017 at 6:35 PM, Gustavo A. R. Silva wrote: > > Quoting Andrey Konovalov : > >> On Fri, Nov 10, 2017 at 1:21 AM, Gustavo A. R. Silva >> wrote: >>> >>> Hi Andrey, >>> >>> Could you please try this patch? >>> >>> Thank you Hi! Sorry for the delay. With this patch I still see the

Re: [PATCH] au0828: fix use-after-free at USB probing

2017-11-10 Thread Gustavo A. R. Silva
Quoting Andrey Konovalov : On Fri, Nov 10, 2017 at 1:21 AM, Gustavo A. R. Silva wrote: Hi Andrey, Could you please try this patch? Thank you Hi Gustavo, With your patch I get a different crash. Not sure if it's another bug or the same one manifesting differently. That's the same one.

Re: [PATCH] au0828: fix use-after-free at USB probing

2017-11-10 Thread Andrey Konovalov
On Fri, Nov 10, 2017 at 1:21 AM, Gustavo A. R. Silva wrote: > Hi Andrey, > > Could you please try this patch? > > Thank you Hi Gustavo, With your patch I get a different crash. Not sure if it's another bug or the same one manifesting differently. au0828: recv_control_msg() Failed receiving cont

[PATCH] au0828: fix use-after-free at USB probing

2017-11-09 Thread Gustavo A. R. Silva
Hi Andrey, Could you please try this patch? Thank you The device is typically freed on failure after trying to set USB interface0 to as5 in function au0828_analog_register. Fix use-after-free by returning the error value inmediately after failure, instead of jumping to au0828_usb_disconnect wh