Re: [syzbot] [usb?] [fs?] KASAN: slab-use-after-free Read in comedi_release_hardware_device

[Hillf Danton <hdanton@sina.com>]

On Wed, 07 Feb 2024 00:44:22 -0800
> HEAD commit:    ed5551279c91 Merge 6.8-rc3 into usb-next
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d42d8fe80000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git  usb-testing

--- x/drivers/comedi/drivers.c
+++ y/drivers/comedi/drivers.c
@@ -1034,6 +1034,7 @@ int comedi_auto_config(struct device *ha
 {
 	struct comedi_device *dev;
 	int ret;
+	static DEFINE_MUTEX(ac_mutex);
 
 	if (!hardware_device) {
 		pr_warn("BUG! %s called with NULL hardware_device\n", __func__);
@@ -1051,12 +1052,14 @@ int comedi_auto_config(struct device *ha
 			 driver->driver_name);
 		return -EINVAL;
 	}
+	mutex_lock(&ac_mutex);
 
 	dev = comedi_alloc_board_minor(hardware_device);
 	if (IS_ERR(dev)) {
 		dev_warn(hardware_device,
 			 "driver '%s' could not create device.\n",
 			 driver->driver_name);
+		mutex_unlock(&ac_mutex);
 		return PTR_ERR(dev);
 	}
 	/* Note: comedi_alloc_board_minor() locked dev->mutex. */
@@ -1084,6 +1087,7 @@ int comedi_auto_config(struct device *ha
 			 driver->driver_name, dev->board_name);
 		mutex_unlock(&dev->mutex);
 	}
+	mutex_unlock(&ac_mutex);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(comedi_auto_config);
--