KASAN: use-after-free Read in usb_anchor_resume_wakeups

Status: auto-closed as invalid on 2020/11/24 04:41
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+58e201002fe1e775e1ae@syzkaller.appspotmail.com
First crash: 2584d, last: 2194d
▶ ▼ Duplicate bugs (1)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: use-after-free Write in usb_anchor_resume_wakeups usb 22 9 2195d 2577d 0/29 closed as dup on 2019/08/21 12:26
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
KASAN: use-after-free Read in usb_anchor_resume_wakeups 4 (6) 2019/09/25 07:16
Reminder: 52 active syzbot reports in usb subsystem 4 (4) 2019/09/19 19:01
Reminder: 8 open syzbot bugs in input subsystem 1 (1) 2019/07/24 02:27
Reminder: 67 open syzbot bugs in usb subsystem 1 (1) 2019/07/24 01:35
Reminder: 47 open syzbot bugs in usb subsystem 1 (1) 2019/07/09 19:01
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in usb_anchor_resume_wakeups (3) usb 19 6 1529d 1749d 0/29 auto-obsoleted due to no activity on 2022/09/19 12:39
linux-6.1 KASAN: use-after-free Read in usb_anchor_resume_wakeups 19 1 482d 482d 0/3 auto-obsoleted due to no activity on 2025/07/12 12:59
upstream KASAN: use-after-free Read in usb_anchor_resume_wakeups (4) usb 22 215 1d19h 1397d 0/29 upstream: reported on 2022/10/01 13:43
upstream KASAN: use-after-free Read in usb_anchor_resume_wakeups (2) usb 19 4 1923d 2025d 0/29 auto-closed as invalid on 2021/08/21 21:47
linux-5.15 KASAN: use-after-free Read in usb_anchor_resume_wakeups (2) 19 1 546d 546d 0/3 auto-obsoleted due to no activity on 2025/05/09 10:36
linux-5.15 KASAN: use-after-free Read in usb_anchor_resume_wakeups 19 1 1155d 1155d 0/3 auto-obsoleted due to no activity on 2023/09/08 22:47

Sample crash report:
xpad 4-1:0.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 4-1:0.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: use-after-free in register_lock_class+0x1591/0x1630 kernel/locking/lockdep.c:1250
Read of size 2 at addr ffff88809a228892 by task systemd-udevd/11520

CPU: 0 PID: 11520 Comm: systemd-udevd Not tainted 5.8.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x436 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 register_lock_class+0x1591/0x1630 kernel/locking/lockdep.c:1250
 __lock_acquire+0xfa/0x56e0 kernel/locking/lockdep.c:4259
 lock_acquire+0x1f1/0xad0 kernel/locking/lockdep.c:4959
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:159
 __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122
 usb_anchor_resume_wakeups drivers/usb/core/urb.c:909 [inline]
 usb_anchor_resume_wakeups+0xbe/0xe0 drivers/usb/core/urb.c:902
 __usb_hcd_giveback_urb+0x31a/0x540 drivers/usb/core/hcd.c:1653
 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716
 skbpoolfree drivers/block/aoe/aoedev.c:432 [inline]
 freedev drivers/block/aoe/aoedev.c:290 [inline]
 dummy_timer+0x11ea/0x2f9f drivers/block/aoe/aoedev.c:366
 call_timer_fn+0x1ac/0x760 kernel/time/timer.c:1415
 expire_timers kernel/time/timer.c:1460 [inline]
 __run_timers.part.0+0x54c/0xa20 kernel/time/timer.c:1784
 __run_timers kernel/time/timer.c:1756 [inline]
 run_timer_softirq+0xae/0x1a0 kernel/time/timer.c:1797
 __do_softirq+0x34c/0xa60 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x111/0x170 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu kernel/softirq.c:417 [inline]
 irq_exit_rcu+0x229/0x270 kernel/softirq.c:429
 sysvec_apic_timer_interrupt+0x54/0x120 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:585
RIP: 0010:unwind_next_frame+0xc5b/0x1f90 arch/x86/kernel/unwind_orc.c:543
Code: 48 89 44 24 18 e8 75 f2 ff ff 84 c0 0f 84 75 f7 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8b 14 24 4c 8b 64 24 60 4c 8b 44 24 20 <4c> 8b 4c 24 28 48 c1 ea 03 48 8b 4c 24 30 80 3c 02 00 0f 85 b9 11
RSP: 0018:ffffc90005357770 EFLAGS: 00000202
RAX: dffffc0000000000 RBX: 1ffff92000a6aef6 RCX: 1ffff92000a6af12
RDX: ffffc90005357880 RSI: ffffc90005357f38 RDI: ffffc90005357f38
RBP: 0000000000000001 R08: ffffffff8b256816 R09: ffffffff8b25681a
R10: 000000000007201e R11: 0000000000000001 R12: ffffc90005357f40
R13: ffffc9000535787d R14: ffffc90005357898 R15: ffffc90005357848
 arch_stack_walk+0x81/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:123
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494
 slab_post_alloc_hook mm/slab.h:586 [inline]
 slab_alloc mm/slab.c:3320 [inline]
 kmem_cache_alloc+0x12c/0x3b0 mm/slab.c:3484
 ep_ptable_queue_proc+0xaf/0x390 fs/eventpoll.c:1317
 poll_wait include/linux/poll.h:51 [inline]
 signalfd_poll+0xba/0x200 fs/signalfd.c:66
 vfs_poll include/linux/poll.h:90 [inline]
 ep_item_poll+0x14a/0x3e0 fs/eventpoll.c:887
 ep_insert fs/eventpoll.c:1536 [inline]
 do_epoll_ctl+0xe85/0x3310 fs/eventpoll.c:2239
 __do_sys_epoll_ctl fs/eventpoll.c:2291 [inline]
 __se_sys_epoll_ctl fs/eventpoll.c:2282 [inline]
 __x64_sys_epoll_ctl+0x13f/0x1c0 fs/eventpoll.c:2282
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f03816662aa
Code: 48 8b 0d f1 fb 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 e9 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d be fb 2a 00 f7 d8 64 89 01 48
RSP: 002b:00007fffcfbe63f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e9
RAX: ffffffffffffffda RBX: 00007fffcfbe64f0 RCX: 00007f03816662aa
RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000004
RBP: 000055fe35de2028 R08: 0000000000000020 R09: 0000000000000018
R10: 00007fffcfbe6498 R11: 0000000000000202 R12: 000055fe35df34e4
R13: 000055fe35de6ad0 R14: 0000000000000003 R15: 000000000000000e

Allocated by task 2492:
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494
 kmem_cache_alloc_trace+0x14f/0x2d0 mm/slab.c:3551
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:669 [inline]
 xpad_probe+0x24b/0x1b60 drivers/input/joystick/xpad.c:1729
 usb_probe_interface+0x2f7/0x780 drivers/usb/core/driver.c:374
 really_probe+0x282/0x8a0 drivers/base/dd.c:520
 driver_probe_device+0xfe/0x1d0 drivers/base/dd.c:696
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:802
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x28d/0x3f0 drivers/base/dd.c:868
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xacf/0x1be0 drivers/base/core.c:2700
 usb_set_configuration+0xef6/0x17a0 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0xba/0xf2 drivers/usb/core/generic.c:241
 usb_probe_device+0xc6/0x210 drivers/usb/core/driver.c:272
 really_probe+0x282/0x8a0 drivers/base/dd.c:520
 driver_probe_device+0xfe/0x1d0 drivers/base/dd.c:696
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:802
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x28d/0x3f0 drivers/base/dd.c:868
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xacf/0x1be0 drivers/base/core.c:2700
 usb_new_device.cold+0x748/0x103b drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x2033/0x3e40 drivers/usb/core/hub.c:5576
 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Freed by task 8119:
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 kasan_set_free_info mm/kasan/common.c:316 [inline]
 __kasan_slab_free+0xf5/0x140 mm/kasan/common.c:455
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x103/0x2c0 mm/slab.c:3757
 xpad_disconnect+0x1b9/0x474 drivers/input/joystick/xpad.c:1877
 usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:436
 __device_release_driver+0x3b7/0x6e0 drivers/base/dd.c:1108
 device_release_driver_internal drivers/base/dd.c:1139 [inline]
 device_release_driver+0x26/0x40 drivers/base/dd.c:1162
 bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:533
 device_del+0x47c/0xd20 drivers/base/core.c:2877
 usb_disable_device+0x361/0x800 drivers/usb/core/message.c:1245
 usb_disconnect.cold+0x251/0x742 drivers/usb/core/hub.c:2217
 hub_port_connect drivers/usb/core/hub.c:5059 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x1965/0x3e40 drivers/usb/core/hub.c:5576
 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

The buggy address belongs to the object at ffff88809a228800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 146 bytes inside of
 1024-byte region [ffff88809a228800, ffff88809a228c00)
The buggy address belongs to the page:
page:ffffea0002688a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88809a228000
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea0002473d88 ffffea00024e4488 ffff8880aa000c40
raw: ffff88809a228000 ffff88809a228000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809a228780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88809a228800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88809a228880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88809a228900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809a228980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (41):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/27 04:40 upstream 92ed30191993 51265195 .config console log report ci-upstream-kasan-gce
2020/07/21 16:21 upstream 4fa640dc5230 21f1765e .config console log report ci-upstream-kasan-gce-386
2020/04/30 05:40 https://github.com/google/kasan.git usb-fuzzer 059e7e0ff26c 2dd552a5 .config console log report ci2-upstream-usb
2020/04/21 18:00 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 f20434a8 .config console log report ci2-upstream-usb
2020/04/21 16:37 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 f20434a8 .config console log report ci2-upstream-usb
2020/04/16 09:33 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 c743fcb3 .config console log report ci2-upstream-usb
2020/04/15 20:33 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 3f3c5574 .config console log report ci2-upstream-usb
2020/03/23 01:13 https://github.com/google/kasan.git usb-fuzzer e17994d1e7b1 78267cec .config console log report ci2-upstream-usb
2020/03/22 20:43 https://github.com/google/kasan.git usb-fuzzer e17994d1e7b1 78267cec .config console log report ci2-upstream-usb
2020/03/16 18:34 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 749688d2 .config console log report ci2-upstream-usb
2020/03/08 06:24 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 2e9971bb .config console log report ci2-upstream-usb
2020/03/08 01:32 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 2e9971bb .config console log report ci2-upstream-usb
2020/01/07 12:43 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 1bcd407e .config console log report ci2-upstream-usb
2020/01/05 18:49 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 d646e21f .config console log report ci2-upstream-usb
2019/12/18 23:13 https://github.com/google/kasan.git usb-fuzzer 6a325cd078d2 79b211f7 .config console log report ci2-upstream-usb
2019/12/02 04:49 https://github.com/google/kasan.git usb-fuzzer 32b5e2b28188 f879db37 .config console log report ci2-upstream-usb
2019/11/24 19:35 https://github.com/google/kasan.git usb-fuzzer da06441bb485 598ca6c8 .config console log report ci2-upstream-usb
2019/09/11 19:25 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config console log report ci2-upstream-usb
2019/09/10 09:51 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config console log report ci2-upstream-usb
2019/09/06 21:54 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 acb5b744 .config console log report ci2-upstream-usb
2019/09/03 02:59 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 14544a56 .config console log report ci2-upstream-usb
2019/08/13 21:59 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 74d61399 .config console log report ci2-upstream-usb
2019/08/08 21:53 https://github.com/google/kasan.git usb-fuzzer e96407b49762 bcc419e9 .config console log report ci2-upstream-usb
2019/08/05 08:01 https://github.com/google/kasan.git usb-fuzzer e96407b49762 6affd8e8 .config console log report ci2-upstream-usb
2019/07/26 01:11 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 0d7a1249 .config console log report ci2-upstream-usb
2019/07/23 17:14 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 bb071d58 .config console log report ci2-upstream-usb
2019/07/21 18:17 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config console log report ci2-upstream-usb
2019/07/20 03:07 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config console log report ci2-upstream-usb
2019/07/17 12:12 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 0d10349c .config console log report ci2-upstream-usb
2019/07/15 08:57 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 a827bf70 .config console log report ci2-upstream-usb
2019/07/15 05:06 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 a827bf70 .config console log report ci2-upstream-usb
2019/07/15 01:15 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 2bbe2f05 .config console log report ci2-upstream-usb
2019/07/12 18:28 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 baa5258a .config console log report ci2-upstream-usb
2019/07/12 03:11 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 baa5258a .config console log report ci2-upstream-usb
2019/07/11 08:56 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 ff7bf04c .config console log report ci2-upstream-usb
2019/07/10 17:11 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report ci2-upstream-usb
2019/07/08 14:17 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report ci2-upstream-usb
2019/07/08 03:04 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report ci2-upstream-usb
2019/07/07 12:09 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report ci2-upstream-usb
2019/07/03 08:55 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 55565fa0 .config console log report ci2-upstream-usb
2019/07/02 11:59 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 5f175e9c .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.