Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1607586

Re: usb: use-after-free write in usb_hcd_link_urb_to_ep

Show all headers | View raw

On Thu, 23 Mar 2017, Dmitry Vyukov wrote:

> > Putting these together:
> >
> >         The memory was allocated in usb_internal_control_msg() line 93.
> >         The later events occurred within the call in line 100 to
> >         usb_start_wait_urb().
> >
> >         The invalid access occurred within usb_start_wait_urb() line 56.
> >
> >         The memory was deallocated within usb_start_wait_urb() line 78.
> >
> > Since these routines don't involve any loops or backward jumps, this
> > says that the invalid access occurred before the memory was
> > deallocated!  So why is it reported as a problem?
> 
> 
> My first guess would be that pid 3348 did 2 calls to open and the urb
> was somehow referenced across these calls. Is it possible?

I don't think so.  The URB gets allocated and deallocated separately
for each call.  You can see this very plainly by reading the source 
code for usb_internal_control_msg() and usb_start_wait_urb().

It's possible that the same memory location was allocated and
deallocated for two different calls at different times.  That wouldn't
fool syzkaller, would it?

Alan Stern

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

usb: use-after-free write in usb_hcd_link_urb_to_ep Dmitry Vyukov <dvyukov@google.com> - 2017-03-23 13:20 +0100
  Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Alan Stern <stern@rowland.harvard.edu> - 2017-03-23 15:40 +0100
    Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Dmitry Vyukov <dvyukov@google.com> - 2017-03-23 15:50 +0100
      Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Alan Stern <stern@rowland.harvard.edu> - 2017-03-23 16:10 +0100
        Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Dmitry Vyukov <dvyukov@google.com> - 2017-03-23 16:30 +0100
          Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Dmitry Vyukov <dvyukov@google.com> - 2017-03-24 11:40 +0100
            Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Alan Stern <stern@rowland.harvard.edu> - 2017-03-24 15:30 +0100
              Re: usb: use-after-free write in usb_hcd_link_urb_to_ep Dmitry Vyukov <dvyukov@google.com> - 2017-03-24 18:20 +0100

csiph-web