KASAN: use-after-free Read in usblp_bulk_read

Status: fixed on 2020/07/17 17:58
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com
Fix commit: 296a193b0612 usblp: poison URBs upon disconnect
First crash: 2296d, last: 2217d
▶ ▼ Discussions (22)
Title Replies (including bot) Last reply
[PATCH 4.4 00/46] 4.4.237-rc1 review 53 (53) 2020/09/28 12:17
[PATCH 5.8 000/118] 5.8.11-rc1 review 125 (125) 2020/09/24 17:06
[PATCH 4.19 00/49] 4.19.147-rc1 review 59 (59) 2020/09/24 02:16
[PATCH 5.4 00/72] 5.4.67-rc1 review 75 (75) 2020/09/22 20:19
[PATCH 4.14 00/94] 4.14.199-rc1 review 97 (97) 2020/09/22 20:18
[PATCH 4.9 00/70] 4.9.237-rc1 review 73 (73) 2020/09/22 20:17
[PATCH] usblp: fix race between disconnect() and read() 4 (4) 2020/09/17 16:45
[PATCH 4.19 000/206] 4.19.130-rc1 review 234 (234) 2020/09/17 14:45
[PATCH 4.14 000/136] 4.14.186-rc1 review 142 (142) 2020/07/17 17:16
[PATCH 4.9 000/191] 4.9.229-rc1 review 199 (199) 2020/07/01 06:45
[PATCH 4.4 000/135] 4.4.229-rc1 review 140 (140) 2020/06/30 17:20
[PATCH 5.7 000/477] 5.7.6-rc1 review 485 (485) 2020/06/26 13:45
[PATCH 5.4 000/314] 5.4.49-rc1 review 321 (321) 2020/06/24 21:58
[PATCH AUTOSEL 4.14 001/108] power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select 113 (113) 2020/06/23 18:59
[PATCH AUTOSEL 5.4 001/266] power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select 269 (269) 2020/06/23 15:41
[PATCH AUTOSEL 4.19 001/172] power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select 175 (175) 2020/06/23 15:35
[PATCH AUTOSEL 5.7 001/388] staging: wfx: fix potential deadlock in wfx_tx_flush() 410 (410) 2020/06/23 15:30
[PATCH AUTOSEL 4.4 01/60] clk: sunxi: Fix incorrect usage of round_down() 65 (65) 2020/06/22 00:07
[PATCH AUTOSEL 4.9 01/80] power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select 81 (81) 2020/06/18 01:34
[PATCH] usblp: poison URBs upon disconnect 3 (3) 2020/05/18 07:53
KASAN: use-after-free Read in usblp_bulk_read 6 (7) 2020/05/06 20:09
Re: KASAN: use-after-free Read in usblp_bulk_read 5 (5) 2020/04/25 18:12
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in usblp_bulk_read (2) usb 19 2 2173d 2203d 0/29 auto-closed as invalid on 2020/11/18 22:11

Sample crash report:
usblp0: nonzero read bulk status received: -71
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x3c7b/0x56e0 kernel/locking/lockdep.c:4250
Read of size 8 at addr ffff88809830d140 by task kworker/u4:3/23312

CPU: 1 PID: 23312 Comm: kworker/u4:3 Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x436 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 __lock_acquire+0x3c7b/0x56e0 kernel/locking/lockdep.c:4250
 lock_acquire+0x1f1/0xad0 kernel/locking/lockdep.c:4959
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:159
 usblp_bulk_read+0x211/0x270 drivers/usb/class/usblp.c:303
 __usb_hcd_giveback_urb+0x30d/0x540 drivers/usb/core/hcd.c:1650
 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716
 skbpoolfree drivers/block/aoe/aoedev.c:432 [inline]
 freedev drivers/block/aoe/aoedev.c:290 [inline]
 dummy_timer+0x11ea/0x2f9f drivers/block/aoe/aoedev.c:366
 call_timer_fn+0x1ac/0x760 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers.part.0+0x54c/0xa20 kernel/time/timer.c:1773
 __run_timers kernel/time/timer.c:1745 [inline]
 run_timer_softirq+0xae/0x1a0 kernel/time/timer.c:1786
 __do_softirq+0x34c/0xa60 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x111/0x170 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu kernel/softirq.c:417 [inline]
 irq_exit_rcu+0x229/0x270 kernel/softirq.c:429
 sysvec_apic_timer_interrupt+0x54/0x120 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:765 [inline]
RIP: 0010:qlink_free mm/kasan/quarantine.c:151 [inline]
RIP: 0010:qlist_free_all+0xfc/0x140 mm/kasan/quarantine.c:167
Code: 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 4c 8b 70 18 e9 40 ff ff ff e8 b3 5b c6 ff 48 83 3d 6b cf 01 08 00 74 36 4c 89 ff 57 9d <0f> 1f 44 00 00 4d 85 e4 75 9e 49 c7 45 08 00 00 00 00 49 c7 45 00
RSP: 0018:ffffc9000a327e18 EFLAGS: 00000282
RAX: 000000000000038f RBX: ffff88804b436000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000282
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880a30df580
R13: ffffc9000a327e50 R14: ffff8880aa002000 R15: 0000000000000282
 quarantine_reduce+0x17e/0x200 mm/kasan/quarantine.c:260
 __kasan_kmalloc.constprop.0+0x9e/0xd0 mm/kasan/common.c:475
 slab_post_alloc_hook mm/slab.h:586 [inline]
 slab_alloc mm/slab.c:3320 [inline]
 kmem_cache_alloc+0x12c/0x3b0 mm/slab.c:3484
 prepare_kernel_cred+0x21/0x780 kernel/cred.c:687
 call_usermodehelper_exec_async+0xaa/0x710 kernel/umh.c:85
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Allocated by task 2519:
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494
 kmem_cache_alloc_trace+0x14f/0x2d0 mm/slab.c:3551
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:669 [inline]
 usblp_probe+0xed/0x1110 drivers/usb/class/usblp.c:1105
 usb_probe_interface+0x2f7/0x780 drivers/usb/core/driver.c:374
 really_probe+0x282/0x8a0 drivers/base/dd.c:525
 driver_probe_device+0xfe/0x1d0 drivers/base/dd.c:701
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:807
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x28d/0x3f0 drivers/base/dd.c:873
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xacf/0x1b00 drivers/base/core.c:2680
 usb_set_configuration+0xef6/0x17a0 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0xba/0xf2 drivers/usb/core/generic.c:241
 usb_probe_device+0xc6/0x210 drivers/usb/core/driver.c:272
 really_probe+0x282/0x8a0 drivers/base/dd.c:525
 driver_probe_device+0xfe/0x1d0 drivers/base/dd.c:701
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:807
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x28d/0x3f0 drivers/base/dd.c:873
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xacf/0x1b00 drivers/base/core.c:2680
 usb_new_device.cold+0x748/0x103b drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x2033/0x3e40 drivers/usb/core/hub.c:5576
 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Freed by task 2519:
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 kasan_set_free_info mm/kasan/common.c:316 [inline]
 __kasan_slab_free+0xf5/0x140 mm/kasan/common.c:455
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x103/0x2c0 mm/slab.c:3757
 usblp_disconnect.cold+0x24/0x29 drivers/usb/class/usblp.c:1382
 usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:436
 __device_release_driver+0x3b7/0x6e0 drivers/base/dd.c:1113
 device_release_driver_internal drivers/base/dd.c:1144 [inline]
 device_release_driver+0x26/0x40 drivers/base/dd.c:1167
 bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:533
 device_del+0x47c/0xd20 drivers/base/core.c:2857
 usb_disable_device+0x361/0x800 drivers/usb/core/message.c:1245
 usb_disconnect.cold+0x251/0x742 drivers/usb/core/hub.c:2217
 hub_port_connect drivers/usb/core/hub.c:5059 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x1965/0x3e40 drivers/usb/core/hub.c:5576
 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

The buggy address belongs to the object at ffff88809830d000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 320 bytes inside of
 1024-byte region [ffff88809830d000, ffff88809830d400)
The buggy address belongs to the page:
page:ffffea000260c340 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea000288ef88 ffffea00025e83c8 ffff8880aa000c40
raw: 0000000000000000 ffff88809830d000 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809830d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809830d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88809830d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff88809830d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809830d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/08 08:35 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/06/30 06:15 upstream 719fdd32921f 917afeaa .config console log report ci-qemu-upstream
2020/06/13 05:16 upstream 435faf5c218a f4724dd3 .config console log report ci-qemu-upstream
2020/06/08 11:40 upstream 435faf5c218a 7604bb03 .config console log report ci-qemu-upstream
2020/05/27 13:05 upstream 444fc5cde643 fdf90f62 .config console log report ci-qemu-upstream-386
2020/06/06 19:43 https://github.com/google/kasan.git usb-fuzzer 2089c6ed5a17 e6b89e4e .config console log report ci2-upstream-usb
2020/04/20 10:53 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 347a5dc3 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.