Re: [syzbot] KASAN: use-after-free Read in dev_uevent

stern
2022-02-25T02:06:17Z

On Thu, Feb 24, 2022 at 11:37:39PM +0100, gregkh@linuxfoundation.org wrote:
> On Thu, Feb 24, 2022 at 04:23:26PM -0500, stern@rowland.harvard.edu wrote:
> > Can you tell us how this should be fixed?
>
> It should be fixed by properly using the driver core to bind/unbind the
> driver to devices like I mentioned previously :)

This would involve creating a "gadget" bus_type (or should it be a
device_type under the platform bus?) and registering the gadgets
on it, right?. Similarly, the gadget drivers would be registered on
this bus. I suppose we can control which drivers get bound to which
gadgets with careful matching code.

> That will be more work, but it's the correct fix here. Otherwise it
> needs to take the same bus locks that the device lives on to keep things
> in sync, like the driver core would do if it were managing these things.
> That could be the "short term" fix if no one wants to do the real work
> needed here. Nothing should be needed to change in the driver core
> itself, it is rightfully thinking it owns the device and can free it
> when needed.

All right, thanks. I'll think about implementing it.

Alan Stern