Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-13 Thread Greg KH
On Tue, Aug 13, 2019 at 03:22:15PM +0200, Oliver Neukum wrote: > Am Dienstag, den 13.08.2019, 14:42 +0200 schrieb Andrey Konovalov: > > > > > > [..] > > > On Thu, Aug 8, 2019 at 4:00 PM Alan Stern wrote: > > > Ah, that looks right, thank you. The patch worked correctly -- good > > > work Oliv

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-13 Thread Andrey Konovalov
On Wed, Aug 7, 2019 at 3:44 PM Andrey Konovalov wrote: > > On Wed, Aug 7, 2019 at 3:44 PM Andrey Konovalov wrote: > > > > On Wed, Aug 7, 2019 at 3:38 PM Oliver Neukum wrote: > > > > > > Am Dienstag, den 06.08.2019, 14:50 +0200 schrieb Andrey Konovalov: > > > > On Tue, Aug 6, 2019 at 2:36 PM Oliv

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-13 Thread Andrey Konovalov
On Tue, Aug 13, 2019 at 3:22 PM Oliver Neukum wrote: > > Am Dienstag, den 13.08.2019, 14:42 +0200 schrieb Andrey Konovalov: > > > > > > [..] > > > On Thu, Aug 8, 2019 at 4:00 PM Alan Stern wrote: > > > Ah, that looks right, thank you. The patch worked correctly -- good > > > work Oliver! > > > >

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-13 Thread Oliver Neukum
Am Dienstag, den 13.08.2019, 14:42 +0200 schrieb Andrey Konovalov: > > [..] > On Thu, Aug 8, 2019 at 4:00 PM Alan Stern wrote: > > Ah, that looks right, thank you. The patch worked correctly -- good > > work Oliver! > > Great! Just a reminder to submit the fix :) I did last week: https://pa

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-13 Thread Andrey Konovalov
On Thu, Aug 8, 2019 at 4:00 PM Alan Stern wrote: > > On Thu, 8 Aug 2019, Andrey Konovalov wrote: > > > On Thu, Aug 8, 2019 at 2:44 PM Dmitry Vyukov wrote: > > > > > > On Thu, Aug 8, 2019 at 2:28 PM Andrey Konovalov > > > wrote: > > > > > > > > On Wed, Aug 7, 2019 at 8:31 PM Alan Stern > > > >

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-08 Thread Alan Stern
On Thu, 8 Aug 2019, Andrey Konovalov wrote: > On Thu, Aug 8, 2019 at 2:44 PM Dmitry Vyukov wrote: > > > > On Thu, Aug 8, 2019 at 2:28 PM Andrey Konovalov > > wrote: > > > > > > On Wed, Aug 7, 2019 at 8:31 PM Alan Stern > > > wrote: > > > > > > > > On Wed, 7 Aug 2019, syzbot wrote: > > > > > >

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-08 Thread Andrey Konovalov
On Thu, Aug 8, 2019 at 2:44 PM Dmitry Vyukov wrote: > > On Thu, Aug 8, 2019 at 2:28 PM Andrey Konovalov wrote: > > > > On Wed, Aug 7, 2019 at 8:31 PM Alan Stern wrote: > > > > > > On Wed, 7 Aug 2019, syzbot wrote: > > > > > > > Hello, > > > > > > > > syzbot has tested the proposed patch and the

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-08 Thread Dmitry Vyukov
On Thu, Aug 8, 2019 at 2:28 PM Andrey Konovalov wrote: > > On Wed, Aug 7, 2019 at 8:31 PM Alan Stern wrote: > > > > On Wed, 7 Aug 2019, syzbot wrote: > > > > > Hello, > > > > > > syzbot has tested the proposed patch and the reproducer did not trigger > > > crash: > > > > > > Reported-and-tested-b

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-08 Thread Andrey Konovalov
On Wed, Aug 7, 2019 at 8:31 PM Alan Stern wrote: > > On Wed, 7 Aug 2019, syzbot wrote: > > > Hello, > > > > syzbot has tested the proposed patch and the reproducer did not trigger > > crash: > > > > Reported-and-tested-by: > > syzbot+1b2449b7b5dc240d1...@syzkaller.appspotmail.com > > > > Tested on

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Alan Stern
On Wed, 7 Aug 2019, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger > crash: > > Reported-and-tested-by: > syzbot+1b2449b7b5dc240d1...@syzkaller.appspotmail.com > > Tested on: > > commit: 6a3599ce usb-fuzzer: main usb gadget fuzzer

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread syzbot
Hello, syzbot has tested the proposed patch and the reproducer did not trigger crash: Reported-and-tested-by: syzbot+1b2449b7b5dc240d1...@syzkaller.appspotmail.com Tested on: commit: 6a3599ce usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasa

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Alan Stern
On Wed, 7 Aug 2019, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered > crash: > KASAN: use-after-free Read in device_release_driver_internal > Tested on: > > commit: 6a3599ce usb-fuzzer: main usb gadget

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread syzbot
Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: KASAN: use-after-free Read in device_release_driver_internal == BUG: KASAN: use-after-free in __lock_acquire+0x3a5d/0x5340 kernel/locking

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Alan Stern
On Wed, 7 Aug 2019, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered > crash: > KASAN: use-after-free Read in device_release_driver_internal > > usb 4-1: USB discon

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread syzbot
Hello, syzbot has tested the proposed patch and the reproducer did not trigger crash: Reported-and-tested-by: syzbot+1b2449b7b5dc240d1...@syzkaller.appspotmail.com Tested on: commit: 6a3599ce usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasa

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread syzbot
Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: KASAN: use-after-free Read in device_release_driver_internal usb 4-1: USB disconnect, device number 2 == BUG: KASAN: use-after-free in

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Andrey Konovalov
On Tue, Aug 6, 2019 at 5:34 PM Oliver Neukum wrote: > > Am Dienstag, den 06.08.2019, 10:19 -0400 schrieb Alan Stern: > > In any case, I don't know if this missing "get" would cause the > > problem, but it might well. > > Hi, > > upon further thought, this should be automated. Checking for > refcou

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Andrey Konovalov
On Wed, Aug 7, 2019 at 3:44 PM Andrey Konovalov wrote: > > On Wed, Aug 7, 2019 at 3:44 PM Andrey Konovalov wrote: > > > > On Wed, Aug 7, 2019 at 3:38 PM Oliver Neukum wrote: > > > > > > Am Dienstag, den 06.08.2019, 14:50 +0200 schrieb Andrey Konovalov: > > > > On Tue, Aug 6, 2019 at 2:36 PM Oliv

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Andrey Konovalov
On Wed, Aug 7, 2019 at 3:44 PM Andrey Konovalov wrote: > > On Wed, Aug 7, 2019 at 3:38 PM Oliver Neukum wrote: > > > > Am Dienstag, den 06.08.2019, 14:50 +0200 schrieb Andrey Konovalov: > > > On Tue, Aug 6, 2019 at 2:36 PM Oliver Neukum wrote: > > > > > > > > Am Donnerstag, den 01.08.2019, 14:47

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Andrey Konovalov
On Wed, Aug 7, 2019 at 3:38 PM Oliver Neukum wrote: > > Am Dienstag, den 06.08.2019, 14:50 +0200 schrieb Andrey Konovalov: > > On Tue, Aug 6, 2019 at 2:36 PM Oliver Neukum wrote: > > > > > > Am Donnerstag, den 01.08.2019, 14:47 -0400 schrieb Alan Stern: > > > > > > > > I think this must be caused

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-07 Thread Oliver Neukum
Am Dienstag, den 06.08.2019, 14:50 +0200 schrieb Andrey Konovalov: > On Tue, Aug 6, 2019 at 2:36 PM Oliver Neukum wrote: > > > > Am Donnerstag, den 01.08.2019, 14:47 -0400 schrieb Alan Stern: > > > > > > I think this must be caused by an unbalanced refcount. That is, > > > something must drop o

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-06 Thread Oliver Neukum
Am Dienstag, den 06.08.2019, 10:19 -0400 schrieb Alan Stern: > In any case, I don't know if this missing "get" would cause the > problem, but it might well. Hi, upon further thought, this should be automated. Checking for refcount leaks is KASAN's job. In particular, refcounts should not * decr

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-06 Thread Andrey Konovalov
On Tue, Aug 6, 2019 at 2:36 PM Oliver Neukum wrote: > > Am Donnerstag, den 01.08.2019, 14:47 -0400 schrieb Alan Stern: > > > > I think this must be caused by an unbalanced refcount. That is, > > something must drop one more reference to the device than it takes. > > That would explain why the inv

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-06 Thread Oliver Neukum
Am Dienstag, den 06.08.2019, 10:19 -0400 schrieb Alan Stern: > On Tue, 6 Aug 2019, Oliver Neukum wrote: > > > Am Donnerstag, den 01.08.2019, 14:47 -0400 schrieb Alan Stern: > > > > > > I think this must be caused by an unbalanced refcount. That is, > > > something must drop one more reference to

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-06 Thread Alan Stern
On Tue, 6 Aug 2019, Oliver Neukum wrote: > Am Donnerstag, den 01.08.2019, 14:47 -0400 schrieb Alan Stern: > > > > I think this must be caused by an unbalanced refcount. That is, > > something must drop one more reference to the device than it takes. > > That would explain why the invalid access

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-06 Thread Oliver Neukum
Am Donnerstag, den 01.08.2019, 14:47 -0400 schrieb Alan Stern: > > I think this must be caused by an unbalanced refcount. That is, > something must drop one more reference to the device than it takes. > That would explain why the invalid access occurs inside a single > bus_remove_device() call, b

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-01 Thread Alan Stern
On Thu, 1 Aug 2019, Andrey Konovalov wrote: > On Tue, Jul 23, 2019 at 4:28 PM syzbot > wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit:6a3599ce usb-fuzzer: main usb gadget fuzzer driver > > git tree: https://github.com/google/kasan.git usb-fuzzer >

Re: KASAN: use-after-free Read in device_release_driver_internal

2019-08-01 Thread Andrey Konovalov
On Tue, Jul 23, 2019 at 4:28 PM syzbot wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit:6a3599ce usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=13f6

KASAN: use-after-free Read in device_release_driver_internal

2019-07-23 Thread syzbot
Hello, syzbot found the following crash on: HEAD commit:6a3599ce usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=13f640cc60 kernel config: https://syzkaller.appspot.com/x/.