Messages in this thread | | | Date | Fri, 24 Jun 2022 15:56:48 +0900 | From | "Dae R. Jeong" <> | Subject | Re: KASAN: use-after-free Read in cfusbl_device_notify |
| |
On Fri, Jun 24, 2022 at 08:32:31AM +0200, Eric Dumazet wrote: > On Fri, Jun 24, 2022 at 8:25 AM Dae R. Jeong <threeearcat@gmail.com> wrote: > > > > On Fri, Jun 24, 2022 at 08:15:54AM +0200, Eric Dumazet wrote: > > > On Fri, Jun 24, 2022 at 8:08 AM Dae R. Jeong <threeearcat@gmail.com> wrote: > > > > > > > > Hello, > > > > > > > > We observed a crash "KASAN: use-after-free Read in cfusbl_device_notify" during fuzzing. > > > > > > This is a known problem. > > > > > > Some drivers do not like NETDEV_UNREGISTER being delivered multiple times. > > > > > > Make sure in your fuzzing to have NET_DEV_REFCNT_TRACKER=y > > > > > > Thanks. > > > > Our config already have CONFIG_NET_DEV_REFCNT_TRACKER=y. > > Are you also setting netdev_unregister_timeout_secs to a smaller value ? > > netdev_unregister_timeout_secs > ------------------------------ > > Unregister network device timeout in seconds. > This option controls the timeout (in seconds) used to issue a warning while > waiting for a network device refcount to drop to 0 during device > unregistration. A lower value may be useful during bisection to detect > a leaked reference faster. A larger value may be useful to prevent false > warnings on slow/loaded systems. > Default value is 10, minimum 1, maximum 3600.
We are using the same config that Syzkaller uses. So its value is 140.
I'm not a network developer so I don't know whether there is a possibility of a false alarm. Our fuzzer is a research prototype in development, and I don't want to interrupt you with false alarms...
> > Anyway, this UAF report seems not interesting. > > > > Thank you for your quick reply. > > > > > > Best regards, > > Dae R. Jeong.
Best regards, Dae R. Jeong.
| |