Messages in this thread | | | Date | Thu, 23 Mar 2017 11:04:19 -0400 (EDT) | From | Alan Stern <> | Subject | Re: usb: use-after-free write in usb_hcd_link_urb_to_ep |
| |
On Thu, 23 Mar 2017, Dmitry Vyukov wrote:
> > Putting these together: > > > > The memory was allocated in usb_internal_control_msg() line 93. > > The later events occurred within the call in line 100 to > > usb_start_wait_urb(). > > > > The invalid access occurred within usb_start_wait_urb() line 56. > > > > The memory was deallocated within usb_start_wait_urb() line 78. > > > > Since these routines don't involve any loops or backward jumps, this > > says that the invalid access occurred before the memory was > > deallocated! So why is it reported as a problem? > > > My first guess would be that pid 3348 did 2 calls to open and the urb > was somehow referenced across these calls. Is it possible?
I don't think so. The URB gets allocated and deallocated separately for each call. You can see this very plainly by reading the source code for usb_internal_control_msg() and usb_start_wait_urb().
It's possible that the same memory location was allocated and deallocated for two different calls at different times. That wouldn't fool syzkaller, would it?
Alan Stern
| |