* KASAN: use-after-free Read in adu_disconnect
@ 2019-08-05 11:58 syzbot
2019-08-09 20:24 ` syzbot
0 siblings, 1 reply; 20+ messages in thread
From: syzbot @ 2019-08-05 11:58 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=148af1b2600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
usb 4-1: USB disconnect, device number 59
==================================================================
BUG: KASAN: use-after-free in atomic64_read
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d67b0c80 by task kworker/1:1/22
CPU: 1 PID: 22 Comm: kworker/1:1 Not tainted 5.3.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x128/0x190 mm/kasan/generic.c:192
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
__mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:1120 [inline]
device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
device_del+0x420/0xb10 drivers/base/core.c:2288
usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
hub_port_connect drivers/usb/core/hub.c:4949 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 2764:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 11056:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881d67b0c80
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
512-byte region [ffff8881d67b0c80, ffff8881d67b0e80)
The buggy address belongs to the page:
page:ffffea000759ec00 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074eca80 0000000200000002 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d67b0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d67b0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d67b0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d67b0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d67b0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-08-05 11:58 KASAN: use-after-free Read in adu_disconnect syzbot
@ 2019-08-09 20:24 ` syzbot
2019-09-19 10:35 ` Johan Hovold
` (2 more replies)
0 siblings, 3 replies; 20+ messages in thread
From: syzbot @ 2019-08-09 20:24 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
syzbot has found a reproducer for the following crash on:
HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
usb 1-1: USB disconnect, device number 4
==================================================================
BUG: KASAN: use-after-free in atomic64_read
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x128/0x190 mm/kasan/generic.c:192
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
__mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:1120 [inline]
device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
device_del+0x420/0xb10 drivers/base/core.c:2288
usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
hub_port_connect drivers/usb/core/hub.c:4949 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 22:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 1733:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881d1d0aa00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
512-byte region [ffff8881d1d0aa00, ffff8881d1d0ac00)
The buggy address belongs to the page:
page:ffffea0007474280 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea000748c280 0000000500000005 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d1d0a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d1d0a980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d1d0aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d1d0aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d1d0ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-08-09 20:24 ` syzbot
@ 2019-09-19 10:35 ` Johan Hovold
2019-09-19 10:53 ` syzbot
2019-09-20 8:26 ` Johan Hovold
2019-09-20 9:08 ` Johan Hovold
2019-09-20 14:38 ` Johan Hovold
2 siblings, 2 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-19 10:35 UTC (permalink / raw)
To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
>
> usb 1-1: USB disconnect, device number 4
> ==================================================================
> BUG: KASAN: use-after-free in atomic64_read
> include/asm-generic/atomic-instrumented.h:836 [inline]
> BUG: KASAN: use-after-free in atomic_long_read
> include/asm-generic/atomic-long.h:28 [inline]
> BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> kernel/locking/mutex.c:1211
> Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
Should be fixed by the below patch.
#syz test: https://github.com/google/kasan.git f0df5c1b
Johan
From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().
This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.
This could also lead to NULL-pointer dereferences in a racing open().
Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org> # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/adutux.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..bcc138990e2f 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
dev = usb_get_intfdata(interface);
- mutex_lock(&dev->mtx); /* not interruptible */
- dev->udev = NULL; /* poison */
usb_deregister_dev(interface, &adu_class);
- mutex_unlock(&dev->mtx);
mutex_lock(&adutux_mutex);
usb_set_intfdata(interface, NULL);
+ mutex_lock(&dev->mtx); /* not interruptible */
+ dev->udev = NULL; /* poison */
+ mutex_unlock(&dev->mtx);
+
/* if the device is not opened, then we clean up right now */
if (!dev->open_count)
adu_delete(dev);
--
2.23.0
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-19 10:35 ` Johan Hovold
@ 2019-09-19 10:53 ` syzbot
2019-09-20 8:26 ` Johan Hovold
1 sibling, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-19 10:53 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Tested on:
commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-19 10:35 ` Johan Hovold
2019-09-19 10:53 ` syzbot
@ 2019-09-20 8:26 ` Johan Hovold
2019-09-20 9:02 ` syzbot
1 sibling, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 8:26 UTC (permalink / raw)
To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Thu, Sep 19, 2019 at 12:35:04PM +0200, Johan Hovold wrote:
> On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > syzbot has found a reproducer for the following crash on:
> >
> > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > git tree: https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> >
> > usb 1-1: USB disconnect, device number 4
> > ==================================================================
> > BUG: KASAN: use-after-free in atomic64_read
> > include/asm-generic/atomic-instrumented.h:836 [inline]
> > BUG: KASAN: use-after-free in atomic_long_read
> > include/asm-generic/atomic-long.h:28 [inline]
> > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > kernel/locking/mutex.c:1211
> > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
>
> Should be fixed by the below patch.
>
> #syz test: https://github.com/google/kasan.git f0df5c1b
Hmm. Let's try that again with the commit id from the report...
#syz test: https://github.com/google/kasan.git e96407b4
Johan
> From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Thu, 19 Sep 2019 11:48:38 +0200
> Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
>
> The driver was clearing its struct usb_device pointer, which it uses as
> an inverted disconnected flag, before deregistering the character device
> and without serialising against racing release().
>
> This could lead to a use-after-free if a racing release() callback
> observes the cleared pointer and frees the driver data before
> disconnect() is finished with it.
>
> This could also lead to NULL-pointer dereferences in a racing open().
>
> Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> Cc: stable <stable@vger.kernel.org> # 2.6.24
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>
> drivers/usb/misc/adutux.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index 344d523b0502..bcc138990e2f 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
>
> dev = usb_get_intfdata(interface);
>
> - mutex_lock(&dev->mtx); /* not interruptible */
> - dev->udev = NULL; /* poison */
> usb_deregister_dev(interface, &adu_class);
> - mutex_unlock(&dev->mtx);
>
> mutex_lock(&adutux_mutex);
> usb_set_intfdata(interface, NULL);
>
> + mutex_lock(&dev->mtx); /* not interruptible */
> + dev->udev = NULL; /* poison */
> + mutex_unlock(&dev->mtx);
> +
> /* if the device is not opened, then we clean up right now */
> if (!dev->open_count)
> adu_delete(dev);
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 8:26 ` Johan Hovold
@ 2019-09-20 9:02 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-20 9:02 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: use-after-free Read in adu_disconnect
usb 5-1: config 0 descriptor??
adutux 5-1:0.22: ADU130 now attached to /dev/usb/adutux5
usb 2-1: USB disconnect, device number 4
==================================================================
BUG: KASAN: use-after-free in atomic64_read
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d22b0280 by task kworker/1:4/2860
CPU: 1 PID: 2860 Comm: kworker/1:4 Not tainted 5.3.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x128/0x190 mm/kasan/generic.c:192
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
__mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:1120 [inline]
device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
device_del+0x420/0xb10 drivers/base/core.c:2288
usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
hub_port_connect drivers/usb/core/hub.c:4949 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 5:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 2895:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881d22b0280
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
512-byte region [ffff8881d22b0280, ffff8881d22b0480)
The buggy address belongs to the page:
page:ffffea000748ac00 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074fbc00 0000000200000002 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d22b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d22b0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d22b0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d22b0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d22b0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15d8afb5600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-08-09 20:24 ` syzbot
2019-09-19 10:35 ` Johan Hovold
@ 2019-09-20 9:08 ` Johan Hovold
2019-09-20 9:13 ` Dmitry Vyukov
2019-09-20 9:20 ` syzbot
2019-09-20 14:38 ` Johan Hovold
2 siblings, 2 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 9:08 UTC (permalink / raw)
To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
>
> usb 1-1: USB disconnect, device number 4
> ==================================================================
> BUG: KASAN: use-after-free in atomic64_read
> include/asm-generic/atomic-instrumented.h:836 [inline]
> BUG: KASAN: use-after-free in atomic_long_read
> include/asm-generic/atomic-long.h:28 [inline]
> BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> kernel/locking/mutex.c:1211
> Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
Let's resend and retest with commit id from latest report to make sure
the patch was actually applied during the last run:
#syz test: https://github.com/google/kasan.git e96407b4
Johan
From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().
This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.
This could also lead to NULL-pointer dereferences in a racing open().
Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org> # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/adutux.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..bcc138990e2f 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
dev = usb_get_intfdata(interface);
- mutex_lock(&dev->mtx); /* not interruptible */
- dev->udev = NULL; /* poison */
usb_deregister_dev(interface, &adu_class);
- mutex_unlock(&dev->mtx);
mutex_lock(&adutux_mutex);
usb_set_intfdata(interface, NULL);
+ mutex_lock(&dev->mtx); /* not interruptible */
+ dev->udev = NULL; /* poison */
+ mutex_unlock(&dev->mtx);
+
/* if the device is not opened, then we clean up right now */
if (!dev->open_count)
adu_delete(dev);
--
2.23.0
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:08 ` Johan Hovold
@ 2019-09-20 9:13 ` Dmitry Vyukov
2019-09-20 9:21 ` Johan Hovold
2019-09-20 9:20 ` syzbot
1 sibling, 1 reply; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20 9:13 UTC (permalink / raw)
To: Johan Hovold
Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > syzbot has found a reproducer for the following crash on:
> >
> > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > git tree: https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> >
> > usb 1-1: USB disconnect, device number 4
> > ==================================================================
> > BUG: KASAN: use-after-free in atomic64_read
> > include/asm-generic/atomic-instrumented.h:836 [inline]
> > BUG: KASAN: use-after-free in atomic_long_read
> > include/asm-generic/atomic-long.h:28 [inline]
> > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > kernel/locking/mutex.c:1211
> > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
>
> Let's resend and retest with commit id from latest report to make sure
> the patch was actually applied during the last run:
The reply contains:
patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
that's what's being parsed and applied during testing.
> #syz test: https://github.com/google/kasan.git e96407b4
>
> Johan
>
>
> From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Thu, 19 Sep 2019 11:48:38 +0200
> Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
>
> The driver was clearing its struct usb_device pointer, which it uses as
> an inverted disconnected flag, before deregistering the character device
> and without serialising against racing release().
>
> This could lead to a use-after-free if a racing release() callback
> observes the cleared pointer and frees the driver data before
> disconnect() is finished with it.
>
> This could also lead to NULL-pointer dereferences in a racing open().
>
> Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> Cc: stable <stable@vger.kernel.org> # 2.6.24
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>
> drivers/usb/misc/adutux.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index 344d523b0502..bcc138990e2f 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
>
> dev = usb_get_intfdata(interface);
>
> - mutex_lock(&dev->mtx); /* not interruptible */
> - dev->udev = NULL; /* poison */
> usb_deregister_dev(interface, &adu_class);
> - mutex_unlock(&dev->mtx);
>
> mutex_lock(&adutux_mutex);
> usb_set_intfdata(interface, NULL);
>
> + mutex_lock(&dev->mtx); /* not interruptible */
> + dev->udev = NULL; /* poison */
> + mutex_unlock(&dev->mtx);
> +
> /* if the device is not opened, then we clean up right now */
> if (!dev->open_count)
> adu_delete(dev);
> --
> 2.23.0
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920090803.GM30545%40localhost.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:08 ` Johan Hovold
2019-09-20 9:13 ` Dmitry Vyukov
@ 2019-09-20 9:20 ` syzbot
2019-09-20 10:02 ` Johan Hovold
1 sibling, 1 reply; 20+ messages in thread
From: syzbot @ 2019-09-20 9:20 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: use-after-free Read in adu_interrupt_in_callback
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
kernel/locking/lockdep.c:3753
Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
__lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
__usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
expire_timers kernel/time/timer.c:1366 [inline]
__run_timers kernel/time/timer.c:1685 [inline]
__run_timers kernel/time/timer.c:1653 [inline]
run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
__do_softirq+0x221/0x912 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x178/0x1a0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:537 [inline]
smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9
db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff
e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2046
really_probe.cold+0x81/0x13a drivers/base/dd.c:616
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 3051:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 3051:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881cd4d0280
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 216 bytes inside of
512-byte region [ffff8881cd4d0280, ffff8881cd4d0480)
The buggy address belongs to the page:
page:ffffea0007353400 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881cd4d0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881cd4d0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881cd4d0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881cd4d0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881cd4d0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=159037c9600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=15217e45600000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:13 ` Dmitry Vyukov
@ 2019-09-20 9:21 ` Johan Hovold
2019-09-20 9:28 ` Dmitry Vyukov
0 siblings, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 9:21 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman,
LKML, USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > syzbot has found a reproducer for the following crash on:
> > >
> > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > git tree: https://github.com/google/kasan.git usb-fuzzer
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > >
> > > usb 1-1: USB disconnect, device number 4
> > > ==================================================================
> > > BUG: KASAN: use-after-free in atomic64_read
> > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > BUG: KASAN: use-after-free in atomic_long_read
> > > include/asm-generic/atomic-long.h:28 [inline]
> > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > kernel/locking/mutex.c:1211
> > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> >
> > Let's resend and retest with commit id from latest report to make sure
> > the patch was actually applied during the last run:
>
> The reply contains:
> patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> that's what's being parsed and applied during testing.
Thanks for confirming, but I can't seem to find that link in the report
from syzbot:
https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
Is it supposed to be there?
Johan
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:21 ` Johan Hovold
@ 2019-09-20 9:28 ` Dmitry Vyukov
2019-09-20 9:35 ` Johan Hovold
0 siblings, 1 reply; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20 9:28 UTC (permalink / raw)
To: Johan Hovold
Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> > >
> > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > > syzbot has found a reproducer for the following crash on:
> > > >
> > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > > git tree: https://github.com/google/kasan.git usb-fuzzer
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > > >
> > > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > > >
> > > > usb 1-1: USB disconnect, device number 4
> > > > ==================================================================
> > > > BUG: KASAN: use-after-free in atomic64_read
> > > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > > BUG: KASAN: use-after-free in atomic_long_read
> > > > include/asm-generic/atomic-long.h:28 [inline]
> > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > > kernel/locking/mutex.c:1211
> > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> > >
> > > Let's resend and retest with commit id from latest report to make sure
> > > the patch was actually applied during the last run:
> >
> > The reply contains:
> > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> > that's what's being parsed and applied during testing.
>
> Thanks for confirming, but I can't seem to find that link in the report
> from syzbot:
>
> https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
>
> Is it supposed to be there?
I meant the previous one:
https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/
The one that you pointed to indeed does not have a patch (was tested
without any patches). But you did not include any in the request, so
this WAI.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:28 ` Dmitry Vyukov
@ 2019-09-20 9:35 ` Johan Hovold
2019-09-20 10:05 ` Dmitry Vyukov
0 siblings, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 9:35 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman,
LKML, USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 11:28:22AM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> > > >
> > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > > > syzbot has found a reproducer for the following crash on:
> > > > >
> > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > > > git tree: https://github.com/google/kasan.git usb-fuzzer
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > > > >
> > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > > > >
> > > > > usb 1-1: USB disconnect, device number 4
> > > > > ==================================================================
> > > > > BUG: KASAN: use-after-free in atomic64_read
> > > > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > > > BUG: KASAN: use-after-free in atomic_long_read
> > > > > include/asm-generic/atomic-long.h:28 [inline]
> > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > > > kernel/locking/mutex.c:1211
> > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> > > >
> > > > Let's resend and retest with commit id from latest report to make sure
> > > > the patch was actually applied during the last run:
> > >
> > > The reply contains:
> > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> > > that's what's being parsed and applied during testing.
> >
> > Thanks for confirming, but I can't seem to find that link in the report
> > from syzbot:
> >
> > https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
> >
> > Is it supposed to be there?
>
> I meant the previous one:
> https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/
>
> The one that you pointed to indeed does not have a patch (was tested
> without any patches). But you did not include any in the request, so
> this WAI.
Ok, that was what I thought. I first tried retriggering the test by
responding to the mail with the patch and a new test directive, but when
that test failed, I figured the patch had not been applied and that I
had to include it directly in the mail when retesting.
Apparently misremembered someone from google responding to a patch with
a test directive, but perhaps they also included the patch in that mail.
Johan
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:20 ` syzbot
@ 2019-09-20 10:02 ` Johan Hovold
2019-09-20 10:08 ` Dmitry Vyukov
2019-09-20 10:21 ` syzbot
0 siblings, 2 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 10:02 UTC (permalink / raw)
To: syzbot
Cc: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer still triggered
> crash:
> KASAN: use-after-free Read in adu_interrupt_in_callback
>
> ==================================================================
> BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
> kernel/locking/lockdep.c:3753
> Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
>
> CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> print_address_description+0x6a/0x32c mm/kasan/report.c:351
> __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
> kasan_report+0xe/0x12 mm/kasan/common.c:612
> __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
> lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
> adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
> __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
> usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
> dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
> call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
> expire_timers kernel/time/timer.c:1366 [inline]
> __run_timers kernel/time/timer.c:1685 [inline]
> __run_timers kernel/time/timer.c:1653 [inline]
> run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
> __do_softirq+0x221/0x912 kernel/softirq.c:292
> invoke_softirq kernel/softirq.c:373 [inline]
> irq_exit+0x178/0x1a0 kernel/softirq.c:413
> exiting_irq arch/x86/include/asm/apic.h:537 [inline]
> smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
> </IRQ>
> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
> RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
> Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9
> db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff
> e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
> RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
> RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
> RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
> RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
> R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
> R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
> vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
> vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
> printk+0xba/0xed kernel/printk/printk.c:2046
> really_probe.cold+0x81/0x13a drivers/base/dd.c:616
> driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> __device_attach+0x217/0x360 drivers/base/dd.c:882
> bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> device_add+0xae6/0x16f0 drivers/base/core.c:2114
> usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> really_probe+0x281/0x650 drivers/base/dd.c:548
> driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> __device_attach+0x217/0x360 drivers/base/dd.c:882
> bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> device_add+0xae6/0x16f0 drivers/base/core.c:2114
> usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> port_event drivers/usb/core/hub.c:5359 [inline]
> hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>
> Allocated by task 3051:
> save_stack+0x1b/0x80 mm/kasan/common.c:69
> set_track mm/kasan/common.c:77 [inline]
> __kasan_kmalloc mm/kasan/common.c:487 [inline]
> __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
> kmalloc include/linux/slab.h:552 [inline]
> kzalloc include/linux/slab.h:748 [inline]
> adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
> usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> really_probe+0x281/0x650 drivers/base/dd.c:548
> driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> __device_attach+0x217/0x360 drivers/base/dd.c:882
> bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> device_add+0xae6/0x16f0 drivers/base/core.c:2114
> usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> really_probe+0x281/0x650 drivers/base/dd.c:548
> driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> __device_attach+0x217/0x360 drivers/base/dd.c:882
> bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> device_add+0xae6/0x16f0 drivers/base/core.c:2114
> usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> port_event drivers/usb/core/hub.c:5359 [inline]
> hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>
> Freed by task 3051:
> save_stack+0x1b/0x80 mm/kasan/common.c:69
> set_track mm/kasan/common.c:77 [inline]
> __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
> slab_free_hook mm/slub.c:1423 [inline]
> slab_free_freelist_hook mm/slub.c:1470 [inline]
> slab_free mm/slub.c:3012 [inline]
> kfree+0xe4/0x2f0 mm/slub.c:3953
> adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
> usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> really_probe+0x281/0x650 drivers/base/dd.c:548
> driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> __device_attach+0x217/0x360 drivers/base/dd.c:882
> bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> device_add+0xae6/0x16f0 drivers/base/core.c:2114
> usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> really_probe+0x281/0x650 drivers/base/dd.c:548
> driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> __device_attach+0x217/0x360 drivers/base/dd.c:882
> bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> device_add+0xae6/0x16f0 drivers/base/core.c:2114
> usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> port_event drivers/usb/core/hub.c:5359 [inline]
> hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
This looks like a separate issue, which should be fixed by a separate
patch. Not sure how to tell syzbot that. Dmitry?
There's is indeed another bug in the driver, which could lead to crashes
in the completion handler after clearing the struct usb_device pointer,
but possibly also to the above use-after-free if a new device is probed
immediately after a disconnect.
The below patch addresses both bugs, let's see if that helps.
#syz test: https://github.com/google/kasan.git e96407b4
Johan
From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more
FIXME: separate stopping URBs
The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().
This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.
This could also lead to NULL-pointer dereferences in a racing open().
Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org> # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/adutux.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..a6996772745e 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface)
dev = usb_get_intfdata(interface);
- mutex_lock(&dev->mtx); /* not interruptible */
- dev->udev = NULL; /* poison */
usb_deregister_dev(interface, &adu_class);
- mutex_unlock(&dev->mtx);
+
+ usb_poison_urb(dev->interrupt_in_urb);
+ usb_poison_urb(dev->interrupt_out_urb);
mutex_lock(&adutux_mutex);
usb_set_intfdata(interface, NULL);
+ mutex_lock(&dev->mtx); /* not interruptible */
+ dev->udev = NULL; /* poison */
+ mutex_unlock(&dev->mtx);
+
/* if the device is not opened, then we clean up right now */
if (!dev->open_count)
adu_delete(dev);
--
2.23.0
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 9:35 ` Johan Hovold
@ 2019-09-20 10:05 ` Dmitry Vyukov
0 siblings, 0 replies; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20 10:05 UTC (permalink / raw)
To: Johan Hovold
Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 11:35 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Sep 20, 2019 at 11:28:22AM +0200, Dmitry Vyukov wrote:
> > On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote:
> > >
> > > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> > > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> > > > >
> > > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > > > > syzbot has found a reproducer for the following crash on:
> > > > > >
> > > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > > > > git tree: https://github.com/google/kasan.git usb-fuzzer
> > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > > > > >
> > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > > > > >
> > > > > > usb 1-1: USB disconnect, device number 4
> > > > > > ==================================================================
> > > > > > BUG: KASAN: use-after-free in atomic64_read
> > > > > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > > > > BUG: KASAN: use-after-free in atomic_long_read
> > > > > > include/asm-generic/atomic-long.h:28 [inline]
> > > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > > > > kernel/locking/mutex.c:1211
> > > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> > > > >
> > > > > Let's resend and retest with commit id from latest report to make sure
> > > > > the patch was actually applied during the last run:
> > > >
> > > > The reply contains:
> > > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> > > > that's what's being parsed and applied during testing.
> > >
> > > Thanks for confirming, but I can't seem to find that link in the report
> > > from syzbot:
> > >
> > > https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
> > >
> > > Is it supposed to be there?
> >
> > I meant the previous one:
> > https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/
> >
> > The one that you pointed to indeed does not have a patch (was tested
> > without any patches). But you did not include any in the request, so
> > this WAI.
>
> Ok, that was what I thought. I first tried retriggering the test by
> responding to the mail with the patch and a new test directive, but when
> that test failed, I figured the patch had not been applied and that I
> had to include it directly in the mail when retesting.
>
> Apparently misremembered someone from google responding to a patch with
> a test directive, but perhaps they also included the patch in that mail.
Yes, they probably included. But some developers point to own git
tree/branch with the fix (e.g. on github), and then they don't need to
attach patch separately.
Note the first time you included the patch inline in the email. syzbot
understands that too: you can either include inline or attach. So it
tested with your patch.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 10:02 ` Johan Hovold
@ 2019-09-20 10:08 ` Dmitry Vyukov
2019-09-20 10:16 ` Andrey Konovalov
2019-09-20 14:31 ` Johan Hovold
2019-09-20 10:21 ` syzbot
1 sibling, 2 replies; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20 10:08 UTC (permalink / raw)
To: Johan Hovold
Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer still triggered
> > crash:
> > KASAN: use-after-free Read in adu_interrupt_in_callback
> >
> > ==================================================================
> > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
> > kernel/locking/lockdep.c:3753
> > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
> >
> > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > Workqueue: usb_hub_wq hub_event
> > Call Trace:
> > <IRQ>
> > __dump_stack lib/dump_stack.c:77 [inline]
> > dump_stack+0xca/0x13e lib/dump_stack.c:113
> > print_address_description+0x6a/0x32c mm/kasan/report.c:351
> > __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
> > kasan_report+0xe/0x12 mm/kasan/common.c:612
> > __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
> > lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
> > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> > _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
> > adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
> > __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
> > usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
> > dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
> > call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
> > expire_timers kernel/time/timer.c:1366 [inline]
> > __run_timers kernel/time/timer.c:1685 [inline]
> > __run_timers kernel/time/timer.c:1653 [inline]
> > run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
> > __do_softirq+0x221/0x912 kernel/softirq.c:292
> > invoke_softirq kernel/softirq.c:373 [inline]
> > irq_exit+0x178/0x1a0 kernel/softirq.c:413
> > exiting_irq arch/x86/include/asm/apic.h:537 [inline]
> > smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
> > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
> > </IRQ>
> > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
> > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
> > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9
> > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff
> > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
> > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
> > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
> > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
> > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
> > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
> > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
> > vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
> > vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
> > printk+0xba/0xed kernel/printk/printk.c:2046
> > really_probe.cold+0x81/0x13a drivers/base/dd.c:616
> > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > really_probe+0x281/0x650 drivers/base/dd.c:548
> > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > port_event drivers/usb/core/hub.c:5359 [inline]
> > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > kthread+0x318/0x420 kernel/kthread.c:255
> > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> >
> > Allocated by task 3051:
> > save_stack+0x1b/0x80 mm/kasan/common.c:69
> > set_track mm/kasan/common.c:77 [inline]
> > __kasan_kmalloc mm/kasan/common.c:487 [inline]
> > __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
> > kmalloc include/linux/slab.h:552 [inline]
> > kzalloc include/linux/slab.h:748 [inline]
> > adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
> > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> > really_probe+0x281/0x650 drivers/base/dd.c:548
> > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > really_probe+0x281/0x650 drivers/base/dd.c:548
> > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > port_event drivers/usb/core/hub.c:5359 [inline]
> > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > kthread+0x318/0x420 kernel/kthread.c:255
> > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> >
> > Freed by task 3051:
> > save_stack+0x1b/0x80 mm/kasan/common.c:69
> > set_track mm/kasan/common.c:77 [inline]
> > __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
> > slab_free_hook mm/slub.c:1423 [inline]
> > slab_free_freelist_hook mm/slub.c:1470 [inline]
> > slab_free mm/slub.c:3012 [inline]
> > kfree+0xe4/0x2f0 mm/slub.c:3953
> > adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
> > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> > really_probe+0x281/0x650 drivers/base/dd.c:548
> > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > really_probe+0x281/0x650 drivers/base/dd.c:548
> > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > port_event drivers/usb/core/hub.c:5359 [inline]
> > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > kthread+0x318/0x420 kernel/kthread.c:255
> > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>
> This looks like a separate issue, which should be fixed by a separate
> patch. Not sure how to tell syzbot that. Dmitry?
There is no way, but also no need. There is nothing it can do with that info.
If you think it's a separate one and you fixed the first one, mail the
patch with the first fix.
Optionally, you can fix the second one as well, and then ask it to
test a patch with 2 fixes (but you will need either to squash them or
point to a git tree with both commits).
> There's is indeed another bug in the driver, which could lead to crashes
> in the completion handler after clearing the struct usb_device pointer,
> but possibly also to the above use-after-free if a new device is probed
> immediately after a disconnect.
>
> The below patch addresses both bugs, let's see if that helps.
>
> #syz test: https://github.com/google/kasan.git e96407b4
>
> Johan
>
> From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Thu, 19 Sep 2019 11:48:38 +0200
> Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more
>
> FIXME: separate stopping URBs
>
> The driver was clearing its struct usb_device pointer, which it uses as
> an inverted disconnected flag, before deregistering the character device
> and without serialising against racing release().
>
> This could lead to a use-after-free if a racing release() callback
> observes the cleared pointer and frees the driver data before
> disconnect() is finished with it.
>
> This could also lead to NULL-pointer dereferences in a racing open().
>
> Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> Cc: stable <stable@vger.kernel.org> # 2.6.24
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
> drivers/usb/misc/adutux.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index 344d523b0502..a6996772745e 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface)
>
> dev = usb_get_intfdata(interface);
>
> - mutex_lock(&dev->mtx); /* not interruptible */
> - dev->udev = NULL; /* poison */
> usb_deregister_dev(interface, &adu_class);
> - mutex_unlock(&dev->mtx);
> +
> + usb_poison_urb(dev->interrupt_in_urb);
> + usb_poison_urb(dev->interrupt_out_urb);
>
> mutex_lock(&adutux_mutex);
> usb_set_intfdata(interface, NULL);
>
> + mutex_lock(&dev->mtx); /* not interruptible */
> + dev->udev = NULL; /* poison */
> + mutex_unlock(&dev->mtx);
> +
> /* if the device is not opened, then we clean up right now */
> if (!dev->open_count)
> adu_delete(dev);
> --
> 2.23.0
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920100233.GP30545%40localhost.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 10:08 ` Dmitry Vyukov
@ 2019-09-20 10:16 ` Andrey Konovalov
2019-09-20 14:31 ` Johan Hovold
1 sibling, 0 replies; 20+ messages in thread
From: Andrey Konovalov @ 2019-09-20 10:16 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Johan Hovold, syzbot, dmg, Greg Kroah-Hartman, LKML, USB list,
syzkaller-bugs
On Fri, Sep 20, 2019 at 12:08 PM Dmitry Vyukov <dvyukov@google.com> wrote:
>
> On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot has tested the proposed patch but the reproducer still triggered
> > > crash:
> > > KASAN: use-after-free Read in adu_interrupt_in_callback
> > >
> > > ==================================================================
> > > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
> > > kernel/locking/lockdep.c:3753
> > > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
> > >
> > > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > > Google 01/01/2011
> > > Workqueue: usb_hub_wq hub_event
> > > Call Trace:
> > > <IRQ>
> > > __dump_stack lib/dump_stack.c:77 [inline]
> > > dump_stack+0xca/0x13e lib/dump_stack.c:113
> > > print_address_description+0x6a/0x32c mm/kasan/report.c:351
> > > __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
> > > kasan_report+0xe/0x12 mm/kasan/common.c:612
> > > __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
> > > lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
> > > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> > > _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
> > > adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
> > > __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
> > > usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
> > > dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
> > > call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
> > > expire_timers kernel/time/timer.c:1366 [inline]
> > > __run_timers kernel/time/timer.c:1685 [inline]
> > > __run_timers kernel/time/timer.c:1653 [inline]
> > > run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
> > > __do_softirq+0x221/0x912 kernel/softirq.c:292
> > > invoke_softirq kernel/softirq.c:373 [inline]
> > > irq_exit+0x178/0x1a0 kernel/softirq.c:413
> > > exiting_irq arch/x86/include/asm/apic.h:537 [inline]
> > > smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
> > > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
> > > </IRQ>
> > > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
> > > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
> > > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9
> > > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff
> > > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
> > > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
> > > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
> > > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
> > > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
> > > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
> > > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
> > > vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
> > > vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
> > > printk+0xba/0xed kernel/printk/printk.c:2046
> > > really_probe.cold+0x81/0x13a drivers/base/dd.c:616
> > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > > really_probe+0x281/0x650 drivers/base/dd.c:548
> > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > > hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > > port_event drivers/usb/core/hub.c:5359 [inline]
> > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > > kthread+0x318/0x420 kernel/kthread.c:255
> > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> > >
> > > Allocated by task 3051:
> > > save_stack+0x1b/0x80 mm/kasan/common.c:69
> > > set_track mm/kasan/common.c:77 [inline]
> > > __kasan_kmalloc mm/kasan/common.c:487 [inline]
> > > __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
> > > kmalloc include/linux/slab.h:552 [inline]
> > > kzalloc include/linux/slab.h:748 [inline]
> > > adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
> > > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> > > really_probe+0x281/0x650 drivers/base/dd.c:548
> > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > > really_probe+0x281/0x650 drivers/base/dd.c:548
> > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > > hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > > port_event drivers/usb/core/hub.c:5359 [inline]
> > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > > kthread+0x318/0x420 kernel/kthread.c:255
> > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> > >
> > > Freed by task 3051:
> > > save_stack+0x1b/0x80 mm/kasan/common.c:69
> > > set_track mm/kasan/common.c:77 [inline]
> > > __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
> > > slab_free_hook mm/slub.c:1423 [inline]
> > > slab_free_freelist_hook mm/slub.c:1470 [inline]
> > > slab_free mm/slub.c:3012 [inline]
> > > kfree+0xe4/0x2f0 mm/slub.c:3953
> > > adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
> > > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> > > really_probe+0x281/0x650 drivers/base/dd.c:548
> > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > > really_probe+0x281/0x650 drivers/base/dd.c:548
> > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > > __device_attach+0x217/0x360 drivers/base/dd.c:882
> > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > > device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > > hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > > port_event drivers/usb/core/hub.c:5359 [inline]
> > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > > kthread+0x318/0x420 kernel/kthread.c:255
> > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> >
> > This looks like a separate issue, which should be fixed by a separate
> > patch. Not sure how to tell syzbot that. Dmitry?
>
> There is no way, but also no need. There is nothing it can do with that info.
> If you think it's a separate one and you fixed the first one, mail the
> patch with the first fix.
> Optionally, you can fix the second one as well, and then ask it to
> test a patch with 2 fixes (but you will need either to squash them or
> point to a git tree with both commits).
(Pointing to a git tree doesn't work with the USB fuzzing instance
though, so you'll need to squash).
>
> > There's is indeed another bug in the driver, which could lead to crashes
> > in the completion handler after clearing the struct usb_device pointer,
> > but possibly also to the above use-after-free if a new device is probed
> > immediately after a disconnect.
> >
> > The below patch addresses both bugs, let's see if that helps.
> >
> > #syz test: https://github.com/google/kasan.git e96407b4
> >
> > Johan
> >
> > From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001
> > From: Johan Hovold <johan@kernel.org>
> > Date: Thu, 19 Sep 2019 11:48:38 +0200
> > Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more
> >
> > FIXME: separate stopping URBs
> >
> > The driver was clearing its struct usb_device pointer, which it uses as
> > an inverted disconnected flag, before deregistering the character device
> > and without serialising against racing release().
> >
> > This could lead to a use-after-free if a racing release() callback
> > observes the cleared pointer and frees the driver data before
> > disconnect() is finished with it.
> >
> > This could also lead to NULL-pointer dereferences in a racing open().
> >
> > Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > Cc: stable <stable@vger.kernel.org> # 2.6.24
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> > ---
> > drivers/usb/misc/adutux.c | 10 +++++++---
> > 1 file changed, 7 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> > index 344d523b0502..a6996772745e 100644
> > --- a/drivers/usb/misc/adutux.c
> > +++ b/drivers/usb/misc/adutux.c
> > @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface)
> >
> > dev = usb_get_intfdata(interface);
> >
> > - mutex_lock(&dev->mtx); /* not interruptible */
> > - dev->udev = NULL; /* poison */
> > usb_deregister_dev(interface, &adu_class);
> > - mutex_unlock(&dev->mtx);
> > +
> > + usb_poison_urb(dev->interrupt_in_urb);
> > + usb_poison_urb(dev->interrupt_out_urb);
> >
> > mutex_lock(&adutux_mutex);
> > usb_set_intfdata(interface, NULL);
> >
> > + mutex_lock(&dev->mtx); /* not interruptible */
> > + dev->udev = NULL; /* poison */
> > + mutex_unlock(&dev->mtx);
> > +
> > /* if the device is not opened, then we clean up right now */
> > if (!dev->open_count)
> > adu_delete(dev);
> > --
> > 2.23.0
> >
> > --
> > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920100233.GP30545%40localhost.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 10:02 ` Johan Hovold
2019-09-20 10:08 ` Dmitry Vyukov
@ 2019-09-20 10:21 ` syzbot
1 sibling, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-20 10:21 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: use-after-free Read in adu_release
==================================================================
BUG: KASAN: use-after-free in adu_release+0x4dc/0x590
drivers/usb/misc/adutux.c:322
Read of size 4 at addr ffff8881d4ec4d1c by task syz-executor.5/3225
CPU: 1 PID: 3225 Comm: syz-executor.5 Not tainted 5.3.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
adu_release+0x4dc/0x590 drivers/usb/misc/adutux.c:322
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x413511
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffddbaa5fc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413511
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000760130 R09: ffffffffffffffff
R10: 00007ffddbaa5ee0 R11: 0000000000000293 R12: 0000000000000001
R13: 00007ffddbaa6000 R14: 0000000000000000 R15: 00007ffddbaa6010
Allocated by task 2885:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 2885:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881d4ec4c80
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 156 bytes inside of
512-byte region [ffff8881d4ec4c80, ffff8881d4ec4e80)
The buggy address belongs to the page:
page:ffffea000753b100 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0xffff8881d4ec4f00 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074fea80 0000000400000004 ffff8881da002500
raw: ffff8881d4ec4f00 00000000800c0008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d4ec4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881d4ec4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881d4ec4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d4ec4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d4ec4e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1251ee8d600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=16ddc075600000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 10:08 ` Dmitry Vyukov
2019-09-20 10:16 ` Andrey Konovalov
@ 2019-09-20 14:31 ` Johan Hovold
1 sibling, 0 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 14:31 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman,
LKML, USB list, syzkaller-bugs
On Fri, Sep 20, 2019 at 12:08:30PM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot has tested the proposed patch but the reproducer still triggered
> > > crash:
> > > KASAN: use-after-free Read in adu_interrupt_in_callback
> > This looks like a separate issue, which should be fixed by a separate
> > patch. Not sure how to tell syzbot that. Dmitry?
>
> There is no way, but also no need. There is nothing it can do with that info.
> If you think it's a separate one and you fixed the first one, mail the
> patch with the first fix.
> Optionally, you can fix the second one as well, and then ask it to
> test a patch with 2 fixes (but you will need either to squash them or
> point to a git tree with both commits).
>
> > There's is indeed another bug in the driver, which could lead to crashes
> > in the completion handler after clearing the struct usb_device pointer,
> > but possibly also to the above use-after-free if a new device is probed
> > immediately after a disconnect.
> >
> > The below patch addresses both bugs, let's see if that helps.
> >
> > #syz test: https://github.com/google/kasan.git e96407b4
Ok, so I was using an old syzbot kernel from when this was first
reported and apparently hit a second issue which had since been fixed by
Alan.
I was starring at usb-next and couldn't see how it was possible to
trigger this, but that code had Alan's fix 303911cfc5b9 ("USB: core: Fix
races in character device registration and deregistraion").
Guess I had to bitten by this to learn the syzbot interface. ;)
Johan
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-08-09 20:24 ` syzbot
2019-09-19 10:35 ` Johan Hovold
2019-09-20 9:08 ` Johan Hovold
@ 2019-09-20 14:38 ` Johan Hovold
2019-09-20 14:58 ` syzbot
2 siblings, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 14:38 UTC (permalink / raw)
To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
>
> usb 1-1: USB disconnect, device number 4
> ==================================================================
> BUG: KASAN: use-after-free in atomic64_read
> include/asm-generic/atomic-instrumented.h:836 [inline]
> BUG: KASAN: use-after-free in atomic_long_read
> include/asm-generic/atomic-long.h:28 [inline]
> BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> kernel/locking/mutex.c:1211
> Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
Let's resend and retest using the latest usb-fuzzer kernel, which
includes the fix for a couple char dev races that we were now hitting:
#syz test: https://github.com/google/kasan.git e0bd8d79
I'll fix the failure to stop I/O at disconnect separately.
Johan
From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().
This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.
This could also lead to NULL-pointer dereferences in a racing open().
Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org> # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/adutux.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..bcc138990e2f 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
dev = usb_get_intfdata(interface);
- mutex_lock(&dev->mtx); /* not interruptible */
- dev->udev = NULL; /* poison */
usb_deregister_dev(interface, &adu_class);
- mutex_unlock(&dev->mtx);
mutex_lock(&adutux_mutex);
usb_set_intfdata(interface, NULL);
+ mutex_lock(&dev->mtx); /* not interruptible */
+ dev->udev = NULL; /* poison */
+ mutex_unlock(&dev->mtx);
+
/* if the device is not opened, then we clean up right now */
if (!dev->open_count)
adu_delete(dev);
--
2.23.0
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect
2019-09-20 14:38 ` Johan Hovold
@ 2019-09-20 14:58 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-20 14:58 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Tested on:
commit: e0bd8d79 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=8847e5384a16f66a
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=122eb075600000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2019-09-20 14:58 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-05 11:58 KASAN: use-after-free Read in adu_disconnect syzbot
2019-08-09 20:24 ` syzbot
2019-09-19 10:35 ` Johan Hovold
2019-09-19 10:53 ` syzbot
2019-09-20 8:26 ` Johan Hovold
2019-09-20 9:02 ` syzbot
2019-09-20 9:08 ` Johan Hovold
2019-09-20 9:13 ` Dmitry Vyukov
2019-09-20 9:21 ` Johan Hovold
2019-09-20 9:28 ` Dmitry Vyukov
2019-09-20 9:35 ` Johan Hovold
2019-09-20 10:05 ` Dmitry Vyukov
2019-09-20 9:20 ` syzbot
2019-09-20 10:02 ` Johan Hovold
2019-09-20 10:08 ` Dmitry Vyukov
2019-09-20 10:16 ` Andrey Konovalov
2019-09-20 14:31 ` Johan Hovold
2019-09-20 10:21 ` syzbot
2019-09-20 14:38 ` Johan Hovold
2019-09-20 14:58 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).