Re: KASAN: use-after-free Read in cfusbl_device_notify

On Fri, Jun 24, 2022 at 08:32:31AM +0200, Eric Dumazet wrote:

On Fri, Jun 24, 2022 at 8:25 AM Dae R. Jeong [off-list ref] wrote:

quoted

On Fri, Jun 24, 2022 at 08:15:54AM +0200, Eric Dumazet wrote:

quoted

On Fri, Jun 24, 2022 at 8:08 AM Dae R. Jeong [off-list ref] wrote:

quoted

Hello,

We observed a crash "KASAN: use-after-free Read in cfusbl_device_notify" during fuzzing.

This is a known problem.

Some drivers do not like NETDEV_UNREGISTER being delivered multiple times.

Make sure in your fuzzing to have NET_DEV_REFCNT_TRACKER=y

Thanks.

Our config already have CONFIG_NET_DEV_REFCNT_TRACKER=y.

Are you also setting netdev_unregister_timeout_secs to a smaller value ?

netdev_unregister_timeout_secs
------------------------------

Unregister network device timeout in seconds.
This option controls the timeout (in seconds) used to issue a warning while
waiting for a network device refcount to drop to 0 during device
unregistration. A lower value may be useful during bisection to detect
a leaked reference faster. A larger value may be useful to prevent false
warnings on slow/loaded systems.
Default value is 10, minimum 1, maximum 3600.

We are using the same config that Syzkaller uses. So its value is 140.

I'm not a network developer so I don't know whether there is a
possibility of a false alarm. Our fuzzer is a research prototype in
development, and I don't want to interrupt you with false alarms...

quoted

Anyway, this UAF report seems not interesting.

Thank you for your quick reply.


Best regards,
Dae R. Jeong.

Best regards,
Dae R. Jeong.