Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [usb?] [fs?] KASAN: slab-use-after-free Read in comedi_release_hardware_device | Date | Wed, 7 Feb 2024 19:34:05 +0800 |
| |
On Wed, 07 Feb 2024 00:44:22 -0800 > HEAD commit: ed5551279c91 Merge 6.8-rc3 into usb-next > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d42d8fe80000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
--- x/drivers/comedi/drivers.c +++ y/drivers/comedi/drivers.c @@ -1034,6 +1034,7 @@ int comedi_auto_config(struct device *ha { struct comedi_device *dev; int ret; + static DEFINE_MUTEX(ac_mutex); if (!hardware_device) { pr_warn("BUG! %s called with NULL hardware_device\n", __func__); @@ -1051,12 +1052,14 @@ int comedi_auto_config(struct device *ha driver->driver_name); return -EINVAL; } + mutex_lock(&ac_mutex); dev = comedi_alloc_board_minor(hardware_device); if (IS_ERR(dev)) { dev_warn(hardware_device, "driver '%s' could not create device.\n", driver->driver_name); + mutex_unlock(&ac_mutex); return PTR_ERR(dev); } /* Note: comedi_alloc_board_minor() locked dev->mutex. */ @@ -1084,6 +1087,7 @@ int comedi_auto_config(struct device *ha driver->driver_name, dev->board_name); mutex_unlock(&dev->mutex); } + mutex_unlock(&ac_mutex); return ret; } EXPORT_SYMBOL_GPL(comedi_auto_config); --
| |