Re: KASAN: use-after-free Read in device_del

[Oliver Neukum]

Am Montag, den 03.06.2019, 04:41 -0700 schrieb syzbot:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    69bbe8c7 usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=1684d87ca00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=193d8457178b3229
> dashboard link: https://syzkaller.appspot.com/bug?extid=93f2f45b19519b289613
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> 
> Unfortunately, I don't have any reproducer for this crash yet.

Will this do?

	Regards
		Oliver
From 6867abc1701f18892d32e8aeaf644901e9bcbf82 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@xxxxxxxx>
Date: Wed, 5 Jun 2019 13:49:21 +0200
Subject: [PATCH] usb: hso: initialize so that we can tear down in the error
 case

Initualization must follow the sequence stuff is undone in case
we bail out. Thus the parent pointer must be set earlier.

Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
---
 drivers/net/usb/hso.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 6a0ecddff310..4d9100fb9f6e 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2653,6 +2653,9 @@ static struct hso_device *hso_create_bulk_serial_device(
 				     BULK_URB_TX_SIZE))
 		goto exit;
 
+	/* and record this serial */
+	set_serial_by_index(serial->minor, serial);
+
 	serial->in_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK,
 				     USB_DIR_IN);
 	if (!serial->in_endp) {
@@ -2669,9 +2672,6 @@ static struct hso_device *hso_create_bulk_serial_device(
 
 	serial->write_data = hso_std_serial_write_data;
 
-	/* and record this serial */
-	set_serial_by_index(serial->minor, serial);
-
 	/* setup the proc dirs and files if needed */
 	hso_log_port(hso_dev);
 
-- 
2.16.4