Re: KASAN: use-after-free Read in sg_release

[Tony Battersby]

On 9/20/22 10:46, Rondreis wrote:
> Hello,
>
> When fuzzing the Linux kernel driver v6.0-rc6, the following crash was
> triggered.
>
> HEAD commit: 521a547ced6477c54b4b0cc206000406c221b4d6
> git tree: upstream
>
> kernel config: https://pastebin.com/raw/hekxU61F
> console output: https://pastebin.com/raw/73a8RzBY
>
> Sorry for failing to extract the reproducer. But on other versions of
> Linux, I also triggered this crash.
>
> I would appreciate it if you have any idea how to solve this bug.
>
sg_release() calls "kref_put(&sfp->f_ref, sg_remove_sfp)" which
eventually does "kref_put(&sdp->d_ref, sg_device_destroy)" which does
"kfree(sdp)", but sg_release() continues to access sdp afterward.  Try
the following patch.