From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE9D5C77B6E for ; Thu, 13 Apr 2023 12:48:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229810AbjDMMsF (ORCPT ); Thu, 13 Apr 2023 08:48:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229722AbjDMMsD (ORCPT ); Thu, 13 Apr 2023 08:48:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A0F88A74 for ; Thu, 13 Apr 2023 05:48:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2708D63906 for ; Thu, 13 Apr 2023 12:48:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2EF60C433EF; Thu, 13 Apr 2023 12:48:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1681390081; bh=Pe5uMNkQGXHvLTcEYPm3B5O3mU81jY6Z+wmWp5Fn52M=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BxU01KBW2dz0eHNO8dz3BP30VjT2oL54cWZ24vnOeT2hJzl8ygGwq0qtW5S2SnGqv NK6l3GFl2JC5Ybb17x2FwqmOWhjZ7TJzS670pVYkDmRTuZqOHeDDmWuVil+uauN5Qv zFJnNH1pD/SWxzpm0IxGAVUzs0eZfL6VYApiKZJ0= Date: Thu, 13 Apr 2023 14:47:58 +0200 From: Greg KH To: Zheng Hacker Cc: Yongqin Liu , John Stultz , Zheng Wang , Sumit Semwal , arnd@arndb.de, linux-kernel@vger.kernel.org, 1395428693sheep@gmail.com, alex000young@gmail.com, Mauro Carvalho Chehab Subject: Re: [PATCH] misc: hisi_hikey_usb: Fix use after free bug in hisi_hikey_usb_remove due to race condition Message-ID: <2023041308-nerd-dry-98a6@gregkh> References: <20230312145305.1908607-1-zyytlz.wz@163.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Apr 13, 2023 at 07:12:07PM +0800, Zheng Hacker wrote: > Yongqin Liu 于2023年4月13日周四 18:55写道： > > > > Hi, Zheng > > > > On Thu, 13 Apr 2023 at 16:08, Zheng Hacker wrote: > > > > > > Friendly ping about the bug. > > > > Sorry, wasn't aware of this message before, > > > > Could you please help share the instructions to reproduce the problem > > this change fixes? > > > > Hi Yongqin, > > Thanks for your reply. This bug is found by static analysis. There is no PoC. > > >From my personal experience, triggering race condition bugs stably in > the kernel needs some tricks. > For example, you can insert some sleep-time code to slow down the > thread until the related object is freed. > Besides, you can use gdb to control the time window. Also, there are > some other tricks as [1] said. > > As for the reproduction, this attack vector requires that the attacker > can physically access the device. > When he/she unplugs the usb, the remove function is triggered, and if > the set callback is invoked, there might be a race condition. How does the removal of the USB device trigger a platform device removal? Are you sure this can be triggered by some other way other than manually unloading the driver? thanks, greg k-h