Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 08 Nov 2017 10:22:01 -0600
Message-ID: <20171108102201.Horde.Dw2XZ5R--z8myMPckc2RKFC@gator4166.hostgator.com>
From:   "Gustavo A. R. Silva" <garsilva@embeddedor.com>
To:     Andrey Konovalov <andreyknvl@google.com>
Cc:     Mauro Carvalho Chehab <mchehab@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Dmitry Vyukov <dvyukov@google.com>,
        Kostya Serebryany <kcc@google.com>,
        syzkaller <syzkaller@googlegroups.com>
Subject: Re: usb/media/em28xx: use-after-free in em28xx_dvb_fini
References: <CAAeHK+xNemb9-+pqifrXd5qsnEvbS8h+cgAgy0FhzL1A7FRfJA@mail.gmail.com>
 <20171107211850.GA17663@embeddedor.com>
 <CAAeHK+wtAhx_i3N4ONkNiqU_k=Pgk9p4dxAV9LGs4d=CPxLZcQ@mail.gmail.com>
 <20171108100301.Horde.pDKmT_QqqGyUbLr9ES3Gy9m@gator4166.hostgator.com>
 <CAAeHK+yvAAGkw4gqruBTJRLX9OabdcU-pXSfbPhUD1Sv9dwRbw@mail.gmail.com>
In-Reply-To: <CAAeHK+yvAAGkw4gqruBTJRLX9OabdcU-pXSfbPhUD1Sv9dwRbw@mail.gmail.com>
User-Agent: Horde Application Framework 5
Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes
MIME-Version: 1.0
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


Quoting Andrey Konovalov <andreyknvl@google.com>:

> On Wed, Nov 8, 2017 at 5:03 PM, Gustavo A. R. Silva
> <garsilva@embeddedor.com> wrote:
>>
>> Quoting Andrey Konovalov <andreyknvl@google.com>:
>>
>>> On Tue, Nov 7, 2017 at 10:18 PM, Gustavo A. R. Silva
>>> <garsilva@embeddedor.com> wrote:
>>>>
>>>> Hi Andrey,
>>>>
>>>> Could you please try this patch?
>>>>
>>>> Thank you
>>>>
>>>> Gustavo A. R. Silva
>>>
>>>
>>> Hi Gustavo,
>>>
>>> Still see the crash with your patch.
>>>
>>> Thanks!
>>>
>>
>> Thank you, Andrey. I will look into this further.
>
> Since I'm able to reproduce this, I can apply a patch with debug
> printk's or something similar and run the reproducer. Send me a patch
> if you think it might help.
>

Awesome.

I'm pretty sure this bug is related to other issues like this one:  
https://groups.google.com/forum/#!topic/syzkaller/FnJq_QkwCLQ

em28xx is an old driver and it might require some refactoring in order  
to fix such issues.

I appreciate your help.

Thank you
--
Gustavo A. R. Silva

>>
>>
>>>>
>>>> ---
>>>>  drivers/media/usb/em28xx/em28xx-dvb.c | 3 +++
>>>>  1 file changed, 3 insertions(+)
>>>>
>>>> diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c
>>>> b/drivers/media/usb/em28xx/em28xx-dvb.c
>>>> index 4a7db62..fc3fb92 100644
>>>> --- a/drivers/media/usb/em28xx/em28xx-dvb.c
>>>> +++ b/drivers/media/usb/em28xx/em28xx-dvb.c
>>>> @@ -2073,6 +2073,9 @@ static int em28xx_dvb_fini(struct em28xx *dev)
>>>>         struct em28xx_dvb *dvb;
>>>>         struct i2c_client *client;
>>>>
>>>> +       if (!dev)
>>>> +               return 0;
>>>> +
>>>>         if (dev->is_audio_only) {
>>>>                 /* Shouldn't initialize IR for this interface */
>>>>                 return 0;
>>>> --
>>>> 2.7.4
>>>>
>>
>>
>>
>>
>>
>>


From 1583514591272893465@xxx Wed Nov 08 16:06:35 +0000 2017
X-GM-THRID: 1583464386862260131
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread