Re: KASAN: use-after-free Read in hidraw_ioctl

From: Alan Stern
Date: Wed Aug 21 2019 - 12:19:47 EST


#syz test: https://github.com/google/kasan.git e96407b4

Index: usb-devel/drivers/hid/hidraw.c
===================================================================
--- usb-devel.orig/drivers/hid/hidraw.c
+++ usb-devel/drivers/hid/hidraw.c
@@ -370,7 +370,7 @@ static long hidraw_ioctl(struct file *fi

mutex_lock(&minors_lock);
dev = hidraw_table[minor];
- if (!dev) {
+ if (!dev || !dev->exist) {
ret = -ENODEV;
goto out;
}