Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CAB7eexLHN1gn2QPdo1_PF70sPbo2cA8skwG17oZb7+J1DQ+J1Q@mail.gmail.com>
 <CAB7eexKGRgDWBLiRs=U70OPLREESi+bCgwt=7wWCESBDZDM=zQ@mail.gmail.com> <YxC7ix+MerW5xGsB@kroah.com>
In-Reply-To: <YxC7ix+MerW5xGsB@kroah.com>
From:   Rondreis <linhaoguo86@gmail.com>
Date:   Sun, 4 Sep 2022 21:21:07 +0800
Message-ID: <CAB7eexK+x8+RZp16aJFmdmqqEL=NMYp+Fy+hAJG+CWUUEH1_fg@mail.gmail.com>
Subject: Re: KASAN: use-after-free Read in configfs_composite_bind
To:     Greg KH <gregkh@linuxfoundation.org>
Cc:     linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Thanks for your reply! I ran the reproducer again on the master
branch(commit id: 7726d4c3e60bfe206738894267414a5f10510f1a) and it
didn't crash.

The reason for not using the latest version is I can't attach more
than one gadget at a time using `configfs` and `dummy_hcd`. When I
attach the second gadget with a different `udc` it always fails and
the kernel message says:

```
[ 1625.254858] Error: Driver 'configfs-gadget' is already registered,
aborting...
[ 1625.271018] UDC core: g1: driver registration failed: -16
```

I'm not sure if this is a new feature from version v5.19(v5.18, commit
id: 4b0986a3613c92f4ec1bdc7f60ec66fea135991f works very well) or a
potential bug, or my mistake...

The kernel config is: https://pastebin.com/raw/SLmNMMRd
The shell to attach gadgets is: https://pastebin.com/raw/2eDPNip3
The kernel log is: https://pastebin.com/raw/MaDwMQWk

Best wishes!
Rondreis