Re: [syzbot] KASAN: use-after-free Read in dev_uevent

[stern@xxxxxxxxxxxxxxxxxxx]

On Thu, Feb 24, 2022 at 11:37:39PM +0100, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
> On Thu, Feb 24, 2022 at 04:23:26PM -0500, stern@xxxxxxxxxxxxxxxxxxx wrote:
> > Can you tell us how this should be fixed?
> 
> It should be fixed by properly using the driver core to bind/unbind the
> driver to devices like I mentioned previously :)

This would involve creating a "gadget" bus_type (or should it be a 
device_type under the platform bus?) and registering the gadgets 
on it, right?.  Similarly, the gadget drivers would be registered on 
this bus.  I suppose we can control which drivers get bound to which 
gadgets with careful matching code.

> That will be more work, but it's the correct fix here.  Otherwise it
> needs to take the same bus locks that the device lives on to keep things
> in sync, like the driver core would do if it were managing these things.
> That could be the "short term" fix if no one wants to do the real work
> needed here.  Nothing should be needed to change in the driver core
> itself, it is rightfully thinking it owns the device and can free it
> when needed.

All right, thanks.  I'll think about implementing it.

Alan Stern