Re: KASAN: use-after-free Read in usbhid_close (3)

From: Jiri Kosina
Date: Thu Apr 23 2020 - 05:59:14 EST


On Wed, 22 Apr 2020, Alan Stern wrote:

> > Jiri, you should know: Are HID drivers supposed to work okay when the
> > ->close callback is issued after (or concurrently with) the ->stop
> > callback?
>
> No response.

Sorry, I've been a bit swamped recently. Thanks a lot for taking care of
this.

> I'll assume that strange callback orderings should be supported. Let's
> see if the patch below fixes the race in usbhid.

Unfortunately I don't believe the supportability of this is fully defined.
I have tried to quickly go over the few major drivers and didn't find
anything relying various orderings, but I might have easily missed some
case.

So unless we have a programatic way to check it, the patch you created for
mutual exclusion is a good bandaid I believe.

Thanks again Alan, I'll push it to Linus for 5.7.

--
Jiri Kosina
SUSE Labs