lkml.org 
[lkml]   [2019]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: use-after-free Read in hiddev_release
On Mon, 5 Aug 2019, Hillf Danton wrote:

> 1, no dev no open.
>
> --- a/drivers/hid/usbhid/hiddev.c
> +++ b/drivers/hid/usbhid/hiddev.c
> @@ -284,6 +284,10 @@ static int hiddev_open(struct inode *ino
> spin_unlock_irq(&list->hiddev->list_lock);
>
> mutex_lock(&hiddev->existancelock);
> + if (!list->hiddev->exist) {
> + res = -ENODEV;
> + goto bail_unlock;
> + }
> if (!list->hiddev->open++)
> if (list->hiddev->exist) {
> struct hid_device *hid = hiddev->hid;
> --
>
> 2, list_del before vfree.
>
> --- a/drivers/hid/usbhid/hiddev.c
> +++ b/drivers/hid/usbhid/hiddev.c
> @@ -300,6 +304,9 @@ bail_normal_power:
> hid_hw_power(hid, PM_HINT_NORMAL);
> bail_unlock:
> mutex_unlock(&hiddev->existancelock);
> + spin_lock_irq(&list->hiddev->list_lock);
> + list_del(&list->node);
> + spin_unlock_irq(&list->hiddev->list_lock);
> bail:
> file->private_data = NULL;
> vfree(list);

Hilf,

both patches look good to me. Could you please resend them properly so
that I could apply them? Thanks,

--
Jiri Kosina
SUSE Labs

\
 
 \ /
  Last update: 2019-08-05 14:25    [W:0.031 / U:0.096 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site