Re: use-after-free with Lenovo Ultra Docking Station

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Feb 18, 2025 at 07:52:34AM +0100, Philipp Leskovitz wrote:
> [1.] One line summary of the problem:
> A use-after-free is triggered when the device ThinkPad Ultra Docking Station is connected.
> 
> [2.] Full description of the problem/report:
> 
> When I click the notebook into the docking station (ThinkPad Ultra Docking
> Station, Type 40AJ), a kernel crash sometimes occurs. I think the function
> kernfs_new_node (fs/kernfs/dir.c) accesses a memory that has already been
> released. It looks to me that an access in this function occurs with the
> query "parent->mode & S_ISGID". The error occurs with kernel version 6.8.12
> and 6.12.x.
> 
> general protection fault, probably for non-canonical address 0xfefefefefefeff3d: 0000 [#1] PREEMPT SMP NOPTI
> CPU: 7 PID: 2433 Comm: kworker/7:3 Tainted: P O T 6.8.12-grsec+ #1

6.8.12 is a very old, and obsolete, unsupported, and known-buggy kernel
version.  Does this also happen on the latest release (i.3. 6.13.3 or
our development tree (6.14-rc3)?

Lots of work has happened in the year in this driver since 6.8 was
released.

thanks,

greg k-h