Linux-USB Archive on lore.kernel.org
 help / color / Atom feed
* KASAN: use-after-free Read in adu_disconnect
@ 2019-08-05 11:58 syzbot
  2019-08-09 20:24 ` syzbot
  0 siblings, 1 reply; 20+ messages in thread
From: syzbot @ 2019-08-05 11:58 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=148af1b2600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com

usb 4-1: USB disconnect, device number 59
==================================================================
BUG: KASAN: use-after-free in atomic64_read  
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read  
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d67b0c80 by task kworker/1:1/22

CPU: 1 PID: 22 Comm: kworker/1:1 Not tainted 5.3.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  check_memory_region_inline mm/kasan/generic.c:185 [inline]
  check_memory_region+0x128/0x190 mm/kasan/generic.c:192
  atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
  atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
  __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
  adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
  usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
  __device_release_driver drivers/base/dd.c:1120 [inline]
  device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
  bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
  device_del+0x420/0xb10 drivers/base/core.c:2288
  usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
  usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
  hub_port_connect drivers/usb/core/hub.c:4949 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 2764:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 11056:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881d67b0c80
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
  512-byte region [ffff8881d67b0c80, ffff8881d67b0e80)
The buggy address belongs to the page:
page:ffffea000759ec00 refcount:1 mapcount:0 mapping:ffff8881da002500  
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074eca80 0000000200000002 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881d67b0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d67b0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d67b0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff8881d67b0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d67b0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-08-05 11:58 KASAN: use-after-free Read in adu_disconnect syzbot
@ 2019-08-09 20:24 ` syzbot
  2019-09-19 10:35   ` Johan Hovold
                     ` (2 more replies)
  0 siblings, 3 replies; 20+ messages in thread
From: syzbot @ 2019-08-09 20:24 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs

syzbot has found a reproducer for the following crash on:

HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com

usb 1-1: USB disconnect, device number 4
==================================================================
BUG: KASAN: use-after-free in atomic64_read  
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read  
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12

CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  check_memory_region_inline mm/kasan/generic.c:185 [inline]
  check_memory_region+0x128/0x190 mm/kasan/generic.c:192
  atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
  atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
  __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
  adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
  usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
  __device_release_driver drivers/base/dd.c:1120 [inline]
  device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
  bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
  device_del+0x420/0xb10 drivers/base/core.c:2288
  usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
  usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
  hub_port_connect drivers/usb/core/hub.c:4949 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 22:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 1733:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881d1d0aa00
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
  512-byte region [ffff8881d1d0aa00, ffff8881d1d0ac00)
The buggy address belongs to the page:
page:ffffea0007474280 refcount:1 mapcount:0 mapping:ffff8881da002500  
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea000748c280 0000000500000005 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881d1d0a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d1d0a980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d1d0aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff8881d1d0aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d1d0ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-08-09 20:24 ` syzbot
@ 2019-09-19 10:35   ` Johan Hovold
  2019-09-19 10:53     ` syzbot
  2019-09-20  8:26     ` Johan Hovold
  2019-09-20  9:08   ` Johan Hovold
  2019-09-20 14:38   ` Johan Hovold
  2 siblings, 2 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-19 10:35 UTC (permalink / raw)
  To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs

On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
> 
> HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> 
> usb 1-1: USB disconnect, device number 4
> ==================================================================
> BUG: KASAN: use-after-free in atomic64_read  
> include/asm-generic/atomic-instrumented.h:836 [inline]
> BUG: KASAN: use-after-free in atomic_long_read  
> include/asm-generic/atomic-long.h:28 [inline]
> BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
> kernel/locking/mutex.c:1211
> Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12

Should be fixed by the below patch.

#syz test: https://github.com/google/kasan.git f0df5c1b

Johan


From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect

The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().

This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.

This could also lead to NULL-pointer dereferences in a racing open().

Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>     # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---

 drivers/usb/misc/adutux.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..bcc138990e2f 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
 
 	dev = usb_get_intfdata(interface);
 
-	mutex_lock(&dev->mtx);	/* not interruptible */
-	dev->udev = NULL;	/* poison */
 	usb_deregister_dev(interface, &adu_class);
-	mutex_unlock(&dev->mtx);
 
 	mutex_lock(&adutux_mutex);
 	usb_set_intfdata(interface, NULL);
 
+	mutex_lock(&dev->mtx);	/* not interruptible */
+	dev->udev = NULL;	/* poison */
+	mutex_unlock(&dev->mtx);
+
 	/* if the device is not opened, then we clean up right now */
 	if (!dev->open_count)
 		adu_delete(dev);
-- 
2.23.0


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-19 10:35   ` Johan Hovold
@ 2019-09-19 10:53     ` syzbot
  2019-09-20  8:26     ` Johan Hovold
  1 sibling, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-19 10:53 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger  
crash:

Reported-and-tested-by:  
syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com

Tested on:

commit:         f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-19 10:35   ` Johan Hovold
  2019-09-19 10:53     ` syzbot
@ 2019-09-20  8:26     ` Johan Hovold
  2019-09-20  9:02       ` syzbot
  1 sibling, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20  8:26 UTC (permalink / raw)
  To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs

On Thu, Sep 19, 2019 at 12:35:04PM +0200, Johan Hovold wrote:
> On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > syzbot has found a reproducer for the following crash on:
> > 
> > HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > 
> > usb 1-1: USB disconnect, device number 4
> > ==================================================================
> > BUG: KASAN: use-after-free in atomic64_read  
> > include/asm-generic/atomic-instrumented.h:836 [inline]
> > BUG: KASAN: use-after-free in atomic_long_read  
> > include/asm-generic/atomic-long.h:28 [inline]
> > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
> > kernel/locking/mutex.c:1211
> > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> 
> Should be fixed by the below patch.
> 
> #syz test: https://github.com/google/kasan.git f0df5c1b

Hmm. Let's try that again with the commit id from the report...

#syz test: https://github.com/google/kasan.git e96407b4

Johan

> From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Thu, 19 Sep 2019 11:48:38 +0200
> Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
> 
> The driver was clearing its struct usb_device pointer, which it uses as
> an inverted disconnected flag, before deregistering the character device
> and without serialising against racing release().
> 
> This could lead to a use-after-free if a racing release() callback
> observes the cleared pointer and frees the driver data before
> disconnect() is finished with it.
> 
> This could also lead to NULL-pointer dereferences in a racing open().
> 
> Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> Cc: stable <stable@vger.kernel.org>     # 2.6.24
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
> 
>  drivers/usb/misc/adutux.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index 344d523b0502..bcc138990e2f 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
>  
>  	dev = usb_get_intfdata(interface);
>  
> -	mutex_lock(&dev->mtx);	/* not interruptible */
> -	dev->udev = NULL;	/* poison */
>  	usb_deregister_dev(interface, &adu_class);
> -	mutex_unlock(&dev->mtx);
>  
>  	mutex_lock(&adutux_mutex);
>  	usb_set_intfdata(interface, NULL);
>  
> +	mutex_lock(&dev->mtx);	/* not interruptible */
> +	dev->udev = NULL;	/* poison */
> +	mutex_unlock(&dev->mtx);
> +
>  	/* if the device is not opened, then we clean up right now */
>  	if (!dev->open_count)
>  		adu_delete(dev);

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  8:26     ` Johan Hovold
@ 2019-09-20  9:02       ` syzbot
  0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-20  9:02 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: use-after-free Read in adu_disconnect

usb 5-1: config 0 descriptor??
adutux 5-1:0.22: ADU130  now attached to /dev/usb/adutux5
usb 2-1: USB disconnect, device number 4
==================================================================
BUG: KASAN: use-after-free in atomic64_read  
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read  
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d22b0280 by task kworker/1:4/2860

CPU: 1 PID: 2860 Comm: kworker/1:4 Not tainted 5.3.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  check_memory_region_inline mm/kasan/generic.c:185 [inline]
  check_memory_region+0x128/0x190 mm/kasan/generic.c:192
  atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
  atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
  __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
  adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
  usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
  __device_release_driver drivers/base/dd.c:1120 [inline]
  device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
  bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
  device_del+0x420/0xb10 drivers/base/core.c:2288
  usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
  usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
  hub_port_connect drivers/usb/core/hub.c:4949 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 5:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 2895:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881d22b0280
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
  512-byte region [ffff8881d22b0280, ffff8881d22b0480)
The buggy address belongs to the page:
page:ffffea000748ac00 refcount:1 mapcount:0 mapping:ffff8881da002500  
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074fbc00 0000000200000002 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881d22b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d22b0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d22b0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff8881d22b0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d22b0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15d8afb5600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-08-09 20:24 ` syzbot
  2019-09-19 10:35   ` Johan Hovold
@ 2019-09-20  9:08   ` Johan Hovold
  2019-09-20  9:13     ` Dmitry Vyukov
  2019-09-20  9:20     ` syzbot
  2019-09-20 14:38   ` Johan Hovold
  2 siblings, 2 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-20  9:08 UTC (permalink / raw)
  To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs

On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
> 
> HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> 
> usb 1-1: USB disconnect, device number 4
> ==================================================================
> BUG: KASAN: use-after-free in atomic64_read  
> include/asm-generic/atomic-instrumented.h:836 [inline]
> BUG: KASAN: use-after-free in atomic_long_read  
> include/asm-generic/atomic-long.h:28 [inline]
> BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
> kernel/locking/mutex.c:1211
> Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12

Let's resend and retest with commit id from latest report to make sure
the patch was actually applied during the last run:

#syz test: https://github.com/google/kasan.git e96407b4

Johan


From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect

The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().

This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.

This could also lead to NULL-pointer dereferences in a racing open().

Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>     # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---

 drivers/usb/misc/adutux.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..bcc138990e2f 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
 
 	dev = usb_get_intfdata(interface);
 
-	mutex_lock(&dev->mtx);	/* not interruptible */
-	dev->udev = NULL;	/* poison */
 	usb_deregister_dev(interface, &adu_class);
-	mutex_unlock(&dev->mtx);
 
 	mutex_lock(&adutux_mutex);
 	usb_set_intfdata(interface, NULL);
 
+	mutex_lock(&dev->mtx);	/* not interruptible */
+	dev->udev = NULL;	/* poison */
+	mutex_unlock(&dev->mtx);
+
 	/* if the device is not opened, then we clean up right now */
 	if (!dev->open_count)
 		adu_delete(dev);
-- 
2.23.0


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:08   ` Johan Hovold
@ 2019-09-20  9:13     ` Dmitry Vyukov
  2019-09-20  9:21       ` Johan Hovold
  2019-09-20  9:20     ` syzbot
  1 sibling, 1 reply; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20  9:13 UTC (permalink / raw)
  To: Johan Hovold
  Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
	USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > syzbot has found a reproducer for the following crash on:
> >
> > HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> >
> > usb 1-1: USB disconnect, device number 4
> > ==================================================================
> > BUG: KASAN: use-after-free in atomic64_read
> > include/asm-generic/atomic-instrumented.h:836 [inline]
> > BUG: KASAN: use-after-free in atomic_long_read
> > include/asm-generic/atomic-long.h:28 [inline]
> > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > kernel/locking/mutex.c:1211
> > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
>
> Let's resend and retest with commit id from latest report to make sure
> the patch was actually applied during the last run:

The reply contains:
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
that's what's being parsed and applied during testing.


> #syz test: https://github.com/google/kasan.git e96407b4
>
> Johan
>
>
> From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Thu, 19 Sep 2019 11:48:38 +0200
> Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
>
> The driver was clearing its struct usb_device pointer, which it uses as
> an inverted disconnected flag, before deregistering the character device
> and without serialising against racing release().
>
> This could lead to a use-after-free if a racing release() callback
> observes the cleared pointer and frees the driver data before
> disconnect() is finished with it.
>
> This could also lead to NULL-pointer dereferences in a racing open().
>
> Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> Cc: stable <stable@vger.kernel.org>     # 2.6.24
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>
>  drivers/usb/misc/adutux.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index 344d523b0502..bcc138990e2f 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
>
>         dev = usb_get_intfdata(interface);
>
> -       mutex_lock(&dev->mtx);  /* not interruptible */
> -       dev->udev = NULL;       /* poison */
>         usb_deregister_dev(interface, &adu_class);
> -       mutex_unlock(&dev->mtx);
>
>         mutex_lock(&adutux_mutex);
>         usb_set_intfdata(interface, NULL);
>
> +       mutex_lock(&dev->mtx);  /* not interruptible */
> +       dev->udev = NULL;       /* poison */
> +       mutex_unlock(&dev->mtx);
> +
>         /* if the device is not opened, then we clean up right now */
>         if (!dev->open_count)
>                 adu_delete(dev);
> --
> 2.23.0
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920090803.GM30545%40localhost.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:08   ` Johan Hovold
  2019-09-20  9:13     ` Dmitry Vyukov
@ 2019-09-20  9:20     ` syzbot
  2019-09-20 10:02       ` Johan Hovold
  1 sibling, 1 reply; 20+ messages in thread
From: syzbot @ 2019-09-20  9:20 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: use-after-free Read in adu_interrupt_in_callback

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50  
kernel/locking/lockdep.c:3753
Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051

CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
  lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
  _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
  adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
  __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
  usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
  dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
  call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
  expire_timers kernel/time/timer.c:1366 [inline]
  __run_timers kernel/time/timer.c:1685 [inline]
  __run_timers kernel/time/timer.c:1653 [inline]
  run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
  __do_softirq+0x221/0x912 kernel/softirq.c:292
  invoke_softirq kernel/softirq.c:373 [inline]
  irq_exit+0x178/0x1a0 kernel/softirq.c:413
  exiting_irq arch/x86/include/asm/apic.h:537 [inline]
  smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
  apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
  </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9  
db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff  
e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
  vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
  vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
  printk+0xba/0xed kernel/printk/printk.c:2046
  really_probe.cold+0x81/0x13a drivers/base/dd.c:616
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 3051:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 3051:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff8881cd4d0280
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 216 bytes inside of
  512-byte region [ffff8881cd4d0280, ffff8881cd4d0480)
The buggy address belongs to the page:
page:ffffea0007353400 refcount:1 mapcount:0 mapping:ffff8881da002500  
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881cd4d0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff8881cd4d0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881cd4d0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                     ^
  ffff8881cd4d0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881cd4d0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=159037c9600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15217e45600000


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:13     ` Dmitry Vyukov
@ 2019-09-20  9:21       ` Johan Hovold
  2019-09-20  9:28         ` Dmitry Vyukov
  0 siblings, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20  9:21 UTC (permalink / raw)
  To: Dmitry Vyukov
  Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman,
	LKML, USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > syzbot has found a reproducer for the following crash on:
> > >
> > > HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > >
> > > usb 1-1: USB disconnect, device number 4
> > > ==================================================================
> > > BUG: KASAN: use-after-free in atomic64_read
> > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > BUG: KASAN: use-after-free in atomic_long_read
> > > include/asm-generic/atomic-long.h:28 [inline]
> > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > kernel/locking/mutex.c:1211
> > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> >
> > Let's resend and retest with commit id from latest report to make sure
> > the patch was actually applied during the last run:
> 
> The reply contains:
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> that's what's being parsed and applied during testing.

Thanks for confirming, but I can't seem to find that link in the report
from syzbot:

	https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com

Is it supposed to be there?

Johan

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:21       ` Johan Hovold
@ 2019-09-20  9:28         ` Dmitry Vyukov
  2019-09-20  9:35           ` Johan Hovold
  0 siblings, 1 reply; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20  9:28 UTC (permalink / raw)
  To: Johan Hovold
  Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
	USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> > >
> > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > > syzbot has found a reproducer for the following crash on:
> > > >
> > > > HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > > >
> > > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > > >
> > > > usb 1-1: USB disconnect, device number 4
> > > > ==================================================================
> > > > BUG: KASAN: use-after-free in atomic64_read
> > > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > > BUG: KASAN: use-after-free in atomic_long_read
> > > > include/asm-generic/atomic-long.h:28 [inline]
> > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > > kernel/locking/mutex.c:1211
> > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> > >
> > > Let's resend and retest with commit id from latest report to make sure
> > > the patch was actually applied during the last run:
> >
> > The reply contains:
> > patch:          https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> > that's what's being parsed and applied during testing.
>
> Thanks for confirming, but I can't seem to find that link in the report
> from syzbot:
>
>         https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
>
> Is it supposed to be there?

I meant the previous one:
https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/

The one that you pointed to indeed does not have a patch (was tested
without any patches). But you did not include any in the request, so
this WAI.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:28         ` Dmitry Vyukov
@ 2019-09-20  9:35           ` Johan Hovold
  2019-09-20 10:05             ` Dmitry Vyukov
  0 siblings, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20  9:35 UTC (permalink / raw)
  To: Dmitry Vyukov
  Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman,
	LKML, USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 11:28:22AM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> > > >
> > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > > > syzbot has found a reproducer for the following crash on:
> > > > >
> > > > > HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > > > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > > > >
> > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > > > >
> > > > > usb 1-1: USB disconnect, device number 4
> > > > > ==================================================================
> > > > > BUG: KASAN: use-after-free in atomic64_read
> > > > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > > > BUG: KASAN: use-after-free in atomic_long_read
> > > > > include/asm-generic/atomic-long.h:28 [inline]
> > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > > > kernel/locking/mutex.c:1211
> > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> > > >
> > > > Let's resend and retest with commit id from latest report to make sure
> > > > the patch was actually applied during the last run:
> > >
> > > The reply contains:
> > > patch:          https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> > > that's what's being parsed and applied during testing.
> >
> > Thanks for confirming, but I can't seem to find that link in the report
> > from syzbot:
> >
> >         https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
> >
> > Is it supposed to be there?
> 
> I meant the previous one:
> https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/
> 
> The one that you pointed to indeed does not have a patch (was tested
> without any patches). But you did not include any in the request, so
> this WAI.

Ok, that was what I thought. I first tried retriggering the test by
responding to the mail with the patch and a new test directive, but when
that test failed, I figured the patch had not been applied and that I
had to include it directly in the mail when retesting.

Apparently misremembered someone from google responding to a patch with
a test directive, but perhaps they also included the patch in that mail.

Johan

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:20     ` syzbot
@ 2019-09-20 10:02       ` Johan Hovold
  2019-09-20 10:08         ` Dmitry Vyukov
  2019-09-20 10:21         ` syzbot
  0 siblings, 2 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 10:02 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs

On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer still triggered  
> crash:
> KASAN: use-after-free Read in adu_interrupt_in_callback
> 
> ==================================================================
> BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50  
> kernel/locking/lockdep.c:3753
> Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
> 
> CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
> Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> Call Trace:
>   <IRQ>
>   __dump_stack lib/dump_stack.c:77 [inline]
>   dump_stack+0xca/0x13e lib/dump_stack.c:113
>   print_address_description+0x6a/0x32c mm/kasan/report.c:351
>   __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
>   kasan_report+0xe/0x12 mm/kasan/common.c:612
>   __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
>   lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
>   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>   _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
>   adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
>   __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
>   usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
>   dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
>   call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
>   expire_timers kernel/time/timer.c:1366 [inline]
>   __run_timers kernel/time/timer.c:1685 [inline]
>   __run_timers kernel/time/timer.c:1653 [inline]
>   run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
>   __do_softirq+0x221/0x912 kernel/softirq.c:292
>   invoke_softirq kernel/softirq.c:373 [inline]
>   irq_exit+0x178/0x1a0 kernel/softirq.c:413
>   exiting_irq arch/x86/include/asm/apic.h:537 [inline]
>   smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
>   apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
>   </IRQ>
> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
> RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
> Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9  
> db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff  
> e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
> RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
> RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
> RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
> RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
> R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
> R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
>   vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
>   vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
>   printk+0xba/0xed kernel/printk/printk.c:2046
>   really_probe.cold+0x81/0x13a drivers/base/dd.c:616
>   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
>   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
>   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>   __device_attach+0x217/0x360 drivers/base/dd.c:882
>   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
>   device_add+0xae6/0x16f0 drivers/base/core.c:2114
>   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
>   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
>   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
>   really_probe+0x281/0x650 drivers/base/dd.c:548
>   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
>   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
>   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>   __device_attach+0x217/0x360 drivers/base/dd.c:882
>   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
>   device_add+0xae6/0x16f0 drivers/base/core.c:2114
>   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
>   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
>   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
>   port_event drivers/usb/core/hub.c:5359 [inline]
>   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
>   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
>   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
>   kthread+0x318/0x420 kernel/kthread.c:255
>   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> 
> Allocated by task 3051:
>   save_stack+0x1b/0x80 mm/kasan/common.c:69
>   set_track mm/kasan/common.c:77 [inline]
>   __kasan_kmalloc mm/kasan/common.c:487 [inline]
>   __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
>   kmalloc include/linux/slab.h:552 [inline]
>   kzalloc include/linux/slab.h:748 [inline]
>   adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
>   usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
>   really_probe+0x281/0x650 drivers/base/dd.c:548
>   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
>   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
>   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>   __device_attach+0x217/0x360 drivers/base/dd.c:882
>   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
>   device_add+0xae6/0x16f0 drivers/base/core.c:2114
>   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
>   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
>   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
>   really_probe+0x281/0x650 drivers/base/dd.c:548
>   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
>   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
>   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>   __device_attach+0x217/0x360 drivers/base/dd.c:882
>   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
>   device_add+0xae6/0x16f0 drivers/base/core.c:2114
>   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
>   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
>   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
>   port_event drivers/usb/core/hub.c:5359 [inline]
>   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
>   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
>   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
>   kthread+0x318/0x420 kernel/kthread.c:255
>   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> 
> Freed by task 3051:
>   save_stack+0x1b/0x80 mm/kasan/common.c:69
>   set_track mm/kasan/common.c:77 [inline]
>   __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
>   slab_free_hook mm/slub.c:1423 [inline]
>   slab_free_freelist_hook mm/slub.c:1470 [inline]
>   slab_free mm/slub.c:3012 [inline]
>   kfree+0xe4/0x2f0 mm/slub.c:3953
>   adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
>   usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
>   really_probe+0x281/0x650 drivers/base/dd.c:548
>   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
>   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
>   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>   __device_attach+0x217/0x360 drivers/base/dd.c:882
>   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
>   device_add+0xae6/0x16f0 drivers/base/core.c:2114
>   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
>   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
>   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
>   really_probe+0x281/0x650 drivers/base/dd.c:548
>   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
>   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
>   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>   __device_attach+0x217/0x360 drivers/base/dd.c:882
>   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
>   device_add+0xae6/0x16f0 drivers/base/core.c:2114
>   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
>   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
>   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
>   port_event drivers/usb/core/hub.c:5359 [inline]
>   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
>   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
>   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
>   kthread+0x318/0x420 kernel/kthread.c:255
>   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

This looks like a separate issue, which should be fixed by a separate
patch. Not sure how to tell syzbot that. Dmitry?

There's is indeed another bug in the driver, which could lead to crashes
in the completion handler after clearing the struct usb_device pointer,
but possibly also to the above use-after-free if a new device is probed
immediately after a disconnect.

The below patch addresses both bugs, let's see if that helps.

#syz test: https://github.com/google/kasan.git e96407b4

Johan

From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more

FIXME: separate stopping URBs

The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().

This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.

This could also lead to NULL-pointer dereferences in a racing open().

Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>     # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/misc/adutux.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..a6996772745e 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface)
 
 	dev = usb_get_intfdata(interface);
 
-	mutex_lock(&dev->mtx);	/* not interruptible */
-	dev->udev = NULL;	/* poison */
 	usb_deregister_dev(interface, &adu_class);
-	mutex_unlock(&dev->mtx);
+
+	usb_poison_urb(dev->interrupt_in_urb);
+	usb_poison_urb(dev->interrupt_out_urb);
 
 	mutex_lock(&adutux_mutex);
 	usb_set_intfdata(interface, NULL);
 
+	mutex_lock(&dev->mtx);	/* not interruptible */
+	dev->udev = NULL;	/* poison */
+	mutex_unlock(&dev->mtx);
+
 	/* if the device is not opened, then we clean up right now */
 	if (!dev->open_count)
 		adu_delete(dev);
-- 
2.23.0


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20  9:35           ` Johan Hovold
@ 2019-09-20 10:05             ` Dmitry Vyukov
  0 siblings, 0 replies; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20 10:05 UTC (permalink / raw)
  To: Johan Hovold
  Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
	USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 11:35 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Sep 20, 2019 at 11:28:22AM +0200, Dmitry Vyukov wrote:
> > On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote:
> > >
> > > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote:
> > > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote:
> > > > >
> > > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> > > > > > syzbot has found a reproducer for the following crash on:
> > > > > >
> > > > > > HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> > > > > > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> > > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> > > > > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > > > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> > > > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> > > > > >
> > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > > > > >
> > > > > > usb 1-1: USB disconnect, device number 4
> > > > > > ==================================================================
> > > > > > BUG: KASAN: use-after-free in atomic64_read
> > > > > > include/asm-generic/atomic-instrumented.h:836 [inline]
> > > > > > BUG: KASAN: use-after-free in atomic_long_read
> > > > > > include/asm-generic/atomic-long.h:28 [inline]
> > > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
> > > > > > kernel/locking/mutex.c:1211
> > > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12
> > > > >
> > > > > Let's resend and retest with commit id from latest report to make sure
> > > > > the patch was actually applied during the last run:
> > > >
> > > > The reply contains:
> > > > patch:          https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000
> > > > that's what's being parsed and applied during testing.
> > >
> > > Thanks for confirming, but I can't seem to find that link in the report
> > > from syzbot:
> > >
> > >         https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com
> > >
> > > Is it supposed to be there?
> >
> > I meant the previous one:
> > https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/
> >
> > The one that you pointed to indeed does not have a patch (was tested
> > without any patches). But you did not include any in the request, so
> > this WAI.
>
> Ok, that was what I thought. I first tried retriggering the test by
> responding to the mail with the patch and a new test directive, but when
> that test failed, I figured the patch had not been applied and that I
> had to include it directly in the mail when retesting.
>
> Apparently misremembered someone from google responding to a patch with
> a test directive, but perhaps they also included the patch in that mail.

Yes, they probably included. But some developers point to own git
tree/branch with the fix (e.g. on github), and then they don't need to
attach patch separately.
Note the first time you included the patch inline in the email. syzbot
understands that too: you can either include inline or attach. So it
tested with your patch.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20 10:02       ` Johan Hovold
@ 2019-09-20 10:08         ` Dmitry Vyukov
  2019-09-20 10:16           ` Andrey Konovalov
  2019-09-20 14:31           ` Johan Hovold
  2019-09-20 10:21         ` syzbot
  1 sibling, 2 replies; 20+ messages in thread
From: Dmitry Vyukov @ 2019-09-20 10:08 UTC (permalink / raw)
  To: Johan Hovold
  Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML,
	USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote:
>
> On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer still triggered
> > crash:
> > KASAN: use-after-free Read in adu_interrupt_in_callback
> >
> > ==================================================================
> > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
> > kernel/locking/lockdep.c:3753
> > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
> >
> > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > Workqueue: usb_hub_wq hub_event
> > Call Trace:
> >   <IRQ>
> >   __dump_stack lib/dump_stack.c:77 [inline]
> >   dump_stack+0xca/0x13e lib/dump_stack.c:113
> >   print_address_description+0x6a/0x32c mm/kasan/report.c:351
> >   __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
> >   kasan_report+0xe/0x12 mm/kasan/common.c:612
> >   __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
> >   lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
> >   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> >   _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
> >   adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
> >   __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
> >   usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
> >   dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
> >   call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
> >   expire_timers kernel/time/timer.c:1366 [inline]
> >   __run_timers kernel/time/timer.c:1685 [inline]
> >   __run_timers kernel/time/timer.c:1653 [inline]
> >   run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
> >   __do_softirq+0x221/0x912 kernel/softirq.c:292
> >   invoke_softirq kernel/softirq.c:373 [inline]
> >   irq_exit+0x178/0x1a0 kernel/softirq.c:413
> >   exiting_irq arch/x86/include/asm/apic.h:537 [inline]
> >   smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
> >   apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
> >   </IRQ>
> > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
> > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
> > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9
> > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff
> > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
> > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
> > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
> > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
> > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
> > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
> > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
> >   vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
> >   vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
> >   printk+0xba/0xed kernel/printk/printk.c:2046
> >   really_probe.cold+0x81/0x13a drivers/base/dd.c:616
> >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> >   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> >   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> >   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> >   really_probe+0x281/0x650 drivers/base/dd.c:548
> >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> >   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> >   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> >   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> >   port_event drivers/usb/core/hub.c:5359 [inline]
> >   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> >   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> >   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> >   kthread+0x318/0x420 kernel/kthread.c:255
> >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> >
> > Allocated by task 3051:
> >   save_stack+0x1b/0x80 mm/kasan/common.c:69
> >   set_track mm/kasan/common.c:77 [inline]
> >   __kasan_kmalloc mm/kasan/common.c:487 [inline]
> >   __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
> >   kmalloc include/linux/slab.h:552 [inline]
> >   kzalloc include/linux/slab.h:748 [inline]
> >   adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
> >   usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> >   really_probe+0x281/0x650 drivers/base/dd.c:548
> >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> >   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> >   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> >   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> >   really_probe+0x281/0x650 drivers/base/dd.c:548
> >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> >   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> >   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> >   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> >   port_event drivers/usb/core/hub.c:5359 [inline]
> >   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> >   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> >   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> >   kthread+0x318/0x420 kernel/kthread.c:255
> >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> >
> > Freed by task 3051:
> >   save_stack+0x1b/0x80 mm/kasan/common.c:69
> >   set_track mm/kasan/common.c:77 [inline]
> >   __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
> >   slab_free_hook mm/slub.c:1423 [inline]
> >   slab_free_freelist_hook mm/slub.c:1470 [inline]
> >   slab_free mm/slub.c:3012 [inline]
> >   kfree+0xe4/0x2f0 mm/slub.c:3953
> >   adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
> >   usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> >   really_probe+0x281/0x650 drivers/base/dd.c:548
> >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> >   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> >   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> >   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> >   really_probe+0x281/0x650 drivers/base/dd.c:548
> >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> >   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> >   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> >   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> >   port_event drivers/usb/core/hub.c:5359 [inline]
> >   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> >   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> >   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> >   kthread+0x318/0x420 kernel/kthread.c:255
> >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>
> This looks like a separate issue, which should be fixed by a separate
> patch. Not sure how to tell syzbot that. Dmitry?

There is no way, but also no need. There is nothing it can do with that info.
If you think it's a separate one and you fixed the first one, mail the
patch with the first fix.
Optionally, you can fix the second one as well, and then ask it to
test a patch with 2 fixes (but you will need either to squash them or
point to a git tree with both commits).

> There's is indeed another bug in the driver, which could lead to crashes
> in the completion handler after clearing the struct usb_device pointer,
> but possibly also to the above use-after-free if a new device is probed
> immediately after a disconnect.
>
> The below patch addresses both bugs, let's see if that helps.
>
> #syz test: https://github.com/google/kasan.git e96407b4
>
> Johan
>
> From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Thu, 19 Sep 2019 11:48:38 +0200
> Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more
>
> FIXME: separate stopping URBs
>
> The driver was clearing its struct usb_device pointer, which it uses as
> an inverted disconnected flag, before deregistering the character device
> and without serialising against racing release().
>
> This could lead to a use-after-free if a racing release() callback
> observes the cleared pointer and frees the driver data before
> disconnect() is finished with it.
>
> This could also lead to NULL-pointer dereferences in a racing open().
>
> Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> Cc: stable <stable@vger.kernel.org>     # 2.6.24
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/usb/misc/adutux.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index 344d523b0502..a6996772745e 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface)
>
>         dev = usb_get_intfdata(interface);
>
> -       mutex_lock(&dev->mtx);  /* not interruptible */
> -       dev->udev = NULL;       /* poison */
>         usb_deregister_dev(interface, &adu_class);
> -       mutex_unlock(&dev->mtx);
> +
> +       usb_poison_urb(dev->interrupt_in_urb);
> +       usb_poison_urb(dev->interrupt_out_urb);
>
>         mutex_lock(&adutux_mutex);
>         usb_set_intfdata(interface, NULL);
>
> +       mutex_lock(&dev->mtx);  /* not interruptible */
> +       dev->udev = NULL;       /* poison */
> +       mutex_unlock(&dev->mtx);
> +
>         /* if the device is not opened, then we clean up right now */
>         if (!dev->open_count)
>                 adu_delete(dev);
> --
> 2.23.0
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920100233.GP30545%40localhost.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20 10:08         ` Dmitry Vyukov
@ 2019-09-20 10:16           ` Andrey Konovalov
  2019-09-20 14:31           ` Johan Hovold
  1 sibling, 0 replies; 20+ messages in thread
From: Andrey Konovalov @ 2019-09-20 10:16 UTC (permalink / raw)
  To: Dmitry Vyukov
  Cc: Johan Hovold, syzbot, dmg, Greg Kroah-Hartman, LKML, USB list,
	syzkaller-bugs

On Fri, Sep 20, 2019 at 12:08 PM Dmitry Vyukov <dvyukov@google.com> wrote:
>
> On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot has tested the proposed patch but the reproducer still triggered
> > > crash:
> > > KASAN: use-after-free Read in adu_interrupt_in_callback
> > >
> > > ==================================================================
> > > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
> > > kernel/locking/lockdep.c:3753
> > > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051
> > >
> > > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > > Google 01/01/2011
> > > Workqueue: usb_hub_wq hub_event
> > > Call Trace:
> > >   <IRQ>
> > >   __dump_stack lib/dump_stack.c:77 [inline]
> > >   dump_stack+0xca/0x13e lib/dump_stack.c:113
> > >   print_address_description+0x6a/0x32c mm/kasan/report.c:351
> > >   __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
> > >   kasan_report+0xe/0x12 mm/kasan/common.c:612
> > >   __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
> > >   lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
> > >   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> > >   _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
> > >   adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163
> > >   __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757
> > >   usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822
> > >   dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
> > >   call_timer_fn+0x179/0x650 kernel/time/timer.c:1322
> > >   expire_timers kernel/time/timer.c:1366 [inline]
> > >   __run_timers kernel/time/timer.c:1685 [inline]
> > >   __run_timers kernel/time/timer.c:1653 [inline]
> > >   run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698
> > >   __do_softirq+0x221/0x912 kernel/softirq.c:292
> > >   invoke_softirq kernel/softirq.c:373 [inline]
> > >   irq_exit+0x178/0x1a0 kernel/softirq.c:413
> > >   exiting_irq arch/x86/include/asm/apic.h:537 [inline]
> > >   smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095
> > >   apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828
> > >   </IRQ>
> > > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
> > > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471
> > > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9
> > > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff
> > > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42
> > > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
> > > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006
> > > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044
> > > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91
> > > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047
> > > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190
> > >   vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986
> > >   vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386
> > >   printk+0xba/0xed kernel/printk/printk.c:2046
> > >   really_probe.cold+0x81/0x13a drivers/base/dd.c:616
> > >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> > >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > >   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > >   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > >   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > >   really_probe+0x281/0x650 drivers/base/dd.c:548
> > >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> > >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > >   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > >   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > >   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > >   port_event drivers/usb/core/hub.c:5359 [inline]
> > >   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > >   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > >   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > >   kthread+0x318/0x420 kernel/kthread.c:255
> > >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> > >
> > > Allocated by task 3051:
> > >   save_stack+0x1b/0x80 mm/kasan/common.c:69
> > >   set_track mm/kasan/common.c:77 [inline]
> > >   __kasan_kmalloc mm/kasan/common.c:487 [inline]
> > >   __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
> > >   kmalloc include/linux/slab.h:552 [inline]
> > >   kzalloc include/linux/slab.h:748 [inline]
> > >   adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
> > >   usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> > >   really_probe+0x281/0x650 drivers/base/dd.c:548
> > >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> > >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > >   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > >   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > >   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > >   really_probe+0x281/0x650 drivers/base/dd.c:548
> > >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> > >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > >   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > >   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > >   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > >   port_event drivers/usb/core/hub.c:5359 [inline]
> > >   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > >   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > >   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > >   kthread+0x318/0x420 kernel/kthread.c:255
> > >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> > >
> > > Freed by task 3051:
> > >   save_stack+0x1b/0x80 mm/kasan/common.c:69
> > >   set_track mm/kasan/common.c:77 [inline]
> > >   __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
> > >   slab_free_hook mm/slub.c:1423 [inline]
> > >   slab_free_freelist_hook mm/slub.c:1470 [inline]
> > >   slab_free mm/slub.c:3012 [inline]
> > >   kfree+0xe4/0x2f0 mm/slub.c:3953
> > >   adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
> > >   usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
> > >   really_probe+0x281/0x650 drivers/base/dd.c:548
> > >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> > >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > >   usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
> > >   generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
> > >   usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
> > >   really_probe+0x281/0x650 drivers/base/dd.c:548
> > >   driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
> > >   __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
> > >   bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
> > >   __device_attach+0x217/0x360 drivers/base/dd.c:882
> > >   bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
> > >   device_add+0xae6/0x16f0 drivers/base/core.c:2114
> > >   usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
> > >   hub_port_connect drivers/usb/core/hub.c:5098 [inline]
> > >   hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> > >   port_event drivers/usb/core/hub.c:5359 [inline]
> > >   hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
> > >   process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> > >   worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> > >   kthread+0x318/0x420 kernel/kthread.c:255
> > >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> >
> > This looks like a separate issue, which should be fixed by a separate
> > patch. Not sure how to tell syzbot that. Dmitry?
>
> There is no way, but also no need. There is nothing it can do with that info.
> If you think it's a separate one and you fixed the first one, mail the
> patch with the first fix.
> Optionally, you can fix the second one as well, and then ask it to
> test a patch with 2 fixes (but you will need either to squash them or
> point to a git tree with both commits).

(Pointing to a git tree doesn't work with the USB fuzzing instance
though, so you'll need to squash).

>
> > There's is indeed another bug in the driver, which could lead to crashes
> > in the completion handler after clearing the struct usb_device pointer,
> > but possibly also to the above use-after-free if a new device is probed
> > immediately after a disconnect.
> >
> > The below patch addresses both bugs, let's see if that helps.
> >
> > #syz test: https://github.com/google/kasan.git e96407b4
> >
> > Johan
> >
> > From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001
> > From: Johan Hovold <johan@kernel.org>
> > Date: Thu, 19 Sep 2019 11:48:38 +0200
> > Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more
> >
> > FIXME: separate stopping URBs
> >
> > The driver was clearing its struct usb_device pointer, which it uses as
> > an inverted disconnected flag, before deregistering the character device
> > and without serialising against racing release().
> >
> > This could lead to a use-after-free if a racing release() callback
> > observes the cleared pointer and frees the driver data before
> > disconnect() is finished with it.
> >
> > This could also lead to NULL-pointer dereferences in a racing open().
> >
> > Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
> > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> > Cc: stable <stable@vger.kernel.org>     # 2.6.24
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> > ---
> >  drivers/usb/misc/adutux.c | 10 +++++++---
> >  1 file changed, 7 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> > index 344d523b0502..a6996772745e 100644
> > --- a/drivers/usb/misc/adutux.c
> > +++ b/drivers/usb/misc/adutux.c
> > @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface)
> >
> >         dev = usb_get_intfdata(interface);
> >
> > -       mutex_lock(&dev->mtx);  /* not interruptible */
> > -       dev->udev = NULL;       /* poison */
> >         usb_deregister_dev(interface, &adu_class);
> > -       mutex_unlock(&dev->mtx);
> > +
> > +       usb_poison_urb(dev->interrupt_in_urb);
> > +       usb_poison_urb(dev->interrupt_out_urb);
> >
> >         mutex_lock(&adutux_mutex);
> >         usb_set_intfdata(interface, NULL);
> >
> > +       mutex_lock(&dev->mtx);  /* not interruptible */
> > +       dev->udev = NULL;       /* poison */
> > +       mutex_unlock(&dev->mtx);
> > +
> >         /* if the device is not opened, then we clean up right now */
> >         if (!dev->open_count)
> >                 adu_delete(dev);
> > --
> > 2.23.0
> >
> > --
> > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920100233.GP30545%40localhost.

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20 10:02       ` Johan Hovold
  2019-09-20 10:08         ` Dmitry Vyukov
@ 2019-09-20 10:21         ` syzbot
  1 sibling, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-20 10:21 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: use-after-free Read in adu_release

==================================================================
BUG: KASAN: use-after-free in adu_release+0x4dc/0x590  
drivers/usb/misc/adutux.c:322
Read of size 4 at addr ffff8881d4ec4d1c by task syz-executor.5/3225

CPU: 1 PID: 3225 Comm: syz-executor.5 Not tainted 5.3.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  adu_release+0x4dc/0x590 drivers/usb/misc/adutux.c:322
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x413511
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48  
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48  
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffddbaa5fc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413511
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000760130 R09: ffffffffffffffff
R10: 00007ffddbaa5ee0 R11: 0000000000000293 R12: 0000000000000001
R13: 00007ffddbaa6000 R14: 0000000000000000 R15: 00007ffddbaa6010

Allocated by task 2885:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 2885:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff8881d4ec4c80
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 156 bytes inside of
  512-byte region [ffff8881d4ec4c80, ffff8881d4ec4e80)
The buggy address belongs to the page:
page:ffffea000753b100 refcount:1 mapcount:0 mapping:ffff8881da002500  
index:0xffff8881d4ec4f00 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074fea80 0000000400000004 ffff8881da002500
raw: ffff8881d4ec4f00 00000000800c0008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881d4ec4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff8881d4ec4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881d4ec4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                             ^
  ffff8881d4ec4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881d4ec4e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1251ee8d600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16ddc075600000


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20 10:08         ` Dmitry Vyukov
  2019-09-20 10:16           ` Andrey Konovalov
@ 2019-09-20 14:31           ` Johan Hovold
  1 sibling, 0 replies; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 14:31 UTC (permalink / raw)
  To: Dmitry Vyukov
  Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman,
	LKML, USB list, syzkaller-bugs

On Fri, Sep 20, 2019 at 12:08:30PM +0200, Dmitry Vyukov wrote:
> On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot has tested the proposed patch but the reproducer still triggered
> > > crash:
> > > KASAN: use-after-free Read in adu_interrupt_in_callback

> > This looks like a separate issue, which should be fixed by a separate
> > patch. Not sure how to tell syzbot that. Dmitry?
> 
> There is no way, but also no need. There is nothing it can do with that info.
> If you think it's a separate one and you fixed the first one, mail the
> patch with the first fix.
> Optionally, you can fix the second one as well, and then ask it to
> test a patch with 2 fixes (but you will need either to squash them or
> point to a git tree with both commits).
> 
> > There's is indeed another bug in the driver, which could lead to crashes
> > in the completion handler after clearing the struct usb_device pointer,
> > but possibly also to the above use-after-free if a new device is probed
> > immediately after a disconnect.
> >
> > The below patch addresses both bugs, let's see if that helps.
> >
> > #syz test: https://github.com/google/kasan.git e96407b4

Ok, so I was using an old syzbot kernel from when this was first
reported and apparently hit a second issue which had since been fixed by
Alan.

I was starring at usb-next and couldn't see how it was possible to
trigger this, but that code had Alan's fix 303911cfc5b9 ("USB: core: Fix
races in character device registration and deregistraion").

Guess I had to bitten by this to learn the syzbot interface. ;)

Johan

^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-08-09 20:24 ` syzbot
  2019-09-19 10:35   ` Johan Hovold
  2019-09-20  9:08   ` Johan Hovold
@ 2019-09-20 14:38   ` Johan Hovold
  2019-09-20 14:58     ` syzbot
  2 siblings, 1 reply; 20+ messages in thread
From: Johan Hovold @ 2019-09-20 14:38 UTC (permalink / raw)
  To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs

On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
> 
> HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
> 
> usb 1-1: USB disconnect, device number 4
> ==================================================================
> BUG: KASAN: use-after-free in atomic64_read  
> include/asm-generic/atomic-instrumented.h:836 [inline]
> BUG: KASAN: use-after-free in atomic_long_read  
> include/asm-generic/atomic-long.h:28 [inline]
> BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670  
> kernel/locking/mutex.c:1211
> Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12

Let's resend and retest using the latest usb-fuzzer kernel, which
includes the fix for a couple char dev races that we were now hitting:

#syz test: https://github.com/google/kasan.git e0bd8d79

I'll fix the failure to stop I/O at disconnect separately.

Johan


From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 19 Sep 2019 11:48:38 +0200
Subject: [PATCH] USB: adutux: fix use-after-free on disconnect

The driver was clearing its struct usb_device pointer, which it uses as
an inverted disconnected flag, before deregistering the character device
and without serialising against racing release().

This could lead to a use-after-free if a racing release() callback
observes the cleared pointer and frees the driver data before
disconnect() is finished with it.

This could also lead to NULL-pointer dereferences in a racing open().

Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>     # 2.6.24
Signed-off-by: Johan Hovold <johan@kernel.org>
---

 drivers/usb/misc/adutux.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 344d523b0502..bcc138990e2f 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface)
 
 	dev = usb_get_intfdata(interface);
 
-	mutex_lock(&dev->mtx);	/* not interruptible */
-	dev->udev = NULL;	/* poison */
 	usb_deregister_dev(interface, &adu_class);
-	mutex_unlock(&dev->mtx);
 
 	mutex_lock(&adutux_mutex);
 	usb_set_intfdata(interface, NULL);
 
+	mutex_lock(&dev->mtx);	/* not interruptible */
+	dev->udev = NULL;	/* poison */
+	mutex_unlock(&dev->mtx);
+
 	/* if the device is not opened, then we clean up right now */
 	if (!dev->open_count)
 		adu_delete(dev);
-- 
2.23.0


^ permalink raw reply	[flat|nested] 20+ messages in thread

* Re: KASAN: use-after-free Read in adu_disconnect
  2019-09-20 14:38   ` Johan Hovold
@ 2019-09-20 14:58     ` syzbot
  0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2019-09-20 14:58 UTC (permalink / raw)
  To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger  
crash:

Reported-and-tested-by:  
syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com

Tested on:

commit:         e0bd8d79 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=8847e5384a16f66a
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=122eb075600000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 20+ messages in thread

end of thread, back to index

Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-05 11:58 KASAN: use-after-free Read in adu_disconnect syzbot
2019-08-09 20:24 ` syzbot
2019-09-19 10:35   ` Johan Hovold
2019-09-19 10:53     ` syzbot
2019-09-20  8:26     ` Johan Hovold
2019-09-20  9:02       ` syzbot
2019-09-20  9:08   ` Johan Hovold
2019-09-20  9:13     ` Dmitry Vyukov
2019-09-20  9:21       ` Johan Hovold
2019-09-20  9:28         ` Dmitry Vyukov
2019-09-20  9:35           ` Johan Hovold
2019-09-20 10:05             ` Dmitry Vyukov
2019-09-20  9:20     ` syzbot
2019-09-20 10:02       ` Johan Hovold
2019-09-20 10:08         ` Dmitry Vyukov
2019-09-20 10:16           ` Andrey Konovalov
2019-09-20 14:31           ` Johan Hovold
2019-09-20 10:21         ` syzbot
2019-09-20 14:38   ` Johan Hovold
2019-09-20 14:58     ` syzbot

Linux-USB Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-usb/0 linux-usb/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-usb linux-usb/ https://lore.kernel.org/linux-usb \
		linux-usb@vger.kernel.org linux-usb@archiver.kernel.org
	public-inbox-index linux-usb


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-usb


AGPL code for this site: git clone https://public-inbox.org/ public-inbox