lkml.org 
[lkml]   [2017]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: usb: use-after-free write in usb_hcd_link_urb_to_ep
On Thu, 23 Mar 2017, Dmitry Vyukov wrote:

> > Putting these together:
> >
> > The memory was allocated in usb_internal_control_msg() line 93.
> > The later events occurred within the call in line 100 to
> > usb_start_wait_urb().
> >
> > The invalid access occurred within usb_start_wait_urb() line 56.
> >
> > The memory was deallocated within usb_start_wait_urb() line 78.
> >
> > Since these routines don't involve any loops or backward jumps, this
> > says that the invalid access occurred before the memory was
> > deallocated! So why is it reported as a problem?
>
>
> My first guess would be that pid 3348 did 2 calls to open and the urb
> was somehow referenced across these calls. Is it possible?

I don't think so. The URB gets allocated and deallocated separately
for each call. You can see this very plainly by reading the source
code for usb_internal_control_msg() and usb_start_wait_urb().

It's possible that the same memory location was allocated and
deallocated for two different calls at different times. That wouldn't
fool syzkaller, would it?

Alan Stern

\
 
 \ /
  Last update: 2017-03-23 16:05    [W:0.073 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site