Re: [syzbot] KASAN: use-after-free Read in port100_send_complete

[Pavel Skripkin <paskripkin@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1295 bytes --]

On 3/8/22 21:03, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    38f80f42147f MAINTAINERS: Remove dead patchwork link
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14b0d321700000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=542b2708133cc492
> dashboard link: https://syzkaller.appspot.com/bug?extid=16bcb127fb73baeecb14
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14a63d21700000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17d21be1700000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+16bcb127fb73baeecb14@syzkaller.appspotmail.com
> 
> port100 5-1:0.0: NFC: Urb failure (status -71)
> ==================================================================
> BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
> Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26

We need to kill urbs on disconnect, since urbs callbacks they may access 
freed memory

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master




With regards,
Pavel Skripkin

[-- Attachment #2: ph --]
[-- Type: text/plain, Size: 440 bytes --]

diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index d7db1a0e6be1..00d8ea6dcb5d 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -1612,7 +1612,9 @@ static int port100_probe(struct usb_interface *interface,
 	nfc_digital_free_device(dev->nfc_digital_dev);
 
 error:
+	usb_kill_urb(dev->in_urb);
 	usb_free_urb(dev->in_urb);
+	usb_kill_urb(dev->out_urb);
 	usb_free_urb(dev->out_urb);
 	usb_put_dev(dev->udev);