From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45912C432C3 for ; Thu, 28 Nov 2019 17:34:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 11B1B21775 for ; Thu, 28 Nov 2019 17:34:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574962458; bh=OmC78ALb8NVKJnHGWpebLkbwiOHA0whVKLxQlGJeJRc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=FFiIGYtLvaUp3m5TZeTaZwQAOGbgLtymAKyNE464v8st4GCGJgdCpZcrrA11t5dwj 1n/79QidGkMXa6V/5dwDtV+/XEUW1GZ6F2+PLQ0o+eytDJX1N6MDs1C06ulF9OeaFl T+CZ4/WGa/9zqTv0tDT7N4sMWO8gv28/xOm0q6Jw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726754AbfK1ReL (ORCPT ); Thu, 28 Nov 2019 12:34:11 -0500 Received: from mail-lf1-f66.google.com ([209.85.167.66]:36718 "EHLO mail-lf1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726446AbfK1ReL (ORCPT ); Thu, 28 Nov 2019 12:34:11 -0500 Received: by mail-lf1-f66.google.com with SMTP id f16so20621184lfm.3; Thu, 28 Nov 2019 09:34:09 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=qd+Hu2c4exgagTnozdk0fMXd/buCunkm0yqt0cF2r3c=; b=TCh6Ckbzk0bRjPse4cR7XFb3UNd8pt1wW/X6ku4gn89yBfDgD9l6mooacqNfoDV9Fa s1E0kX1bPPY3CzPH5ipN6sneeCfu7sPbifr2hvmwr4ptEGVIe6eYbEoFqrJQyW11N9vx tM1pM599eGYhebeRpQTBuoJlZRsAI3Ov6GQZYtVkVQctGZfCaPIRtTZQtSzRkK712H0+ RMx3CCIfPucD47dTZw14s3opBfR9AOew61+rP9ni4FyFNO5L3ggnXGdWbFytM3bmXJf6 XYC1Z1TKoA+QA85mHP6zrKGfGID1k0d4jzzm/ox1pylAj1bxr4cCslaC3fogGapR1b0H rccA== X-Gm-Message-State: APjAAAVx7W2Ocgu889uyT5f0x7v2jdHxNadRoUS9OXXVQ0CpDzQAFI+X G8FxladmZQHixVOP2H5mVJw= X-Google-Smtp-Source: APXvYqwoyp+WAoMje5kdDDSgpJ/V/dwYpyFaFtGbMcrALjMOri0CA3WxVe/KnPmG0LoifRIHhO4gPg== X-Received: by 2002:a19:5509:: with SMTP id n9mr32292940lfe.27.1574962448284; Thu, 28 Nov 2019 09:34:08 -0800 (PST) Received: from xi.terra (c-14b8e655.07-184-6d6c6d4.bbcust.telenor.se. [85.230.184.20]) by smtp.gmail.com with ESMTPSA id d15sm3827152ljc.104.2019.11.28.09.34.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 Nov 2019 09:34:07 -0800 (PST) Received: from johan by xi.terra with local (Exim 4.92.3) (envelope-from ) id 1iaNg7-000724-LY; Thu, 28 Nov 2019 18:34:07 +0100 Date: Thu, 28 Nov 2019 18:34:07 +0100 From: Johan Hovold To: syzbot Cc: amitkarwar@gmail.com, andreyknvl@google.com, davem@davemloft.net, kvalo@codeaurora.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, siva8118@gmail.com, syzkaller-bugs@googlegroups.com Subject: Re: WARNING: ODEBUG bug in rsi_probe Message-ID: <20191128173407.GD29518@localhost> References: <00000000000024bbd7058682eda1@google.com> <00000000000080e9260586ead5b5@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <00000000000080e9260586ead5b5@google.com> User-Agent: Mutt/1.12.2 (2019-09-21) Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org On Fri, Apr 19, 2019 at 04:54:06PM -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: d34f9519 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan/tree/usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=13431e7b200000 > kernel config: https://syzkaller.appspot.com/x/.config?x=c73d1bb5aeaeae20 > dashboard link: https://syzkaller.appspot.com/bug?extid=1d1597a5aa3679c65b9f > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12534fdd200000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=147c9247200000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com > > rsi_91x: rsi_load_firmware: REGOUT read failed > rsi_91x: rsi_hal_device_init: Failed to load TA instructions > rsi_91x: rsi_probe: Failed in device init > ------------[ cut here ]------------ > ODEBUG: free active (active state 0) object type: timer_list hint: > bl_cmd_timeout+0x0/0x50 drivers/net/wireless/rsi/rsi_91x_hal.c:577 > WARNING: CPU: 0 PID: 563 at lib/debugobjects.c:325 > debug_print_object+0x162/0x250 lib/debugobjects.c:325 > Kernel panic - not syncing: panic_on_warn set ... > CPU: 0 PID: 563 Comm: kworker/0:2 Not tainted 5.1.0-rc5-319617-gd34f951 #4 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Workqueue: usb_hub_wq hub_event > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0xe8/0x16e lib/dump_stack.c:113 > panic+0x29d/0x5f2 kernel/panic.c:214 > __warn.cold+0x20/0x48 kernel/panic.c:571 > report_bug+0x262/0x2a0 lib/bug.c:186 > fixup_bug arch/x86/kernel/traps.c:179 [inline] > fixup_bug arch/x86/kernel/traps.c:174 [inline] > do_error_trap+0x130/0x1f0 arch/x86/kernel/traps.c:272 > do_invalid_op+0x37/0x40 arch/x86/kernel/traps.c:291 > invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 > RIP: 0010:debug_print_object+0x162/0x250 lib/debugobjects.c:325 > Code: dd c0 a8 b3 8e 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 bf 00 00 00 48 > 8b 14 dd c0 a8 b3 8e 48 c7 c7 40 9d b3 8e e8 8e c3 d2 fd <0f> 0b 83 05 f9 > 0f 5a 10 01 48 83 c4 20 5b 5d 41 5c 41 5d c3 48 89 > RSP: 0018:ffff88809e1ef110 EFLAGS: 00010086 > RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: ffffffff815b1d22 RDI: ffffed1013c3de14 > RBP: 0000000000000001 R08: ffff88809e1cb100 R09: ffffed1015a03edb > R10: ffffed1015a03eda R11: ffff8880ad01f6d7 R12: ffffffff917e77c0 > R13: ffffffff8161e740 R14: ffffffff96d3ea28 R15: ffff8880a5a75f60 > __debug_check_no_obj_freed lib/debugobjects.c:785 [inline] > debug_check_no_obj_freed+0x2a3/0x42e lib/debugobjects.c:817 > slab_free_hook mm/slub.c:1426 [inline] > slab_free_freelist_hook+0xfb/0x140 mm/slub.c:1456 > slab_free mm/slub.c:3003 [inline] > kfree+0xce/0x280 mm/slub.c:3958 > rsi_probe+0xdf3/0x140d drivers/net/wireless/rsi/rsi_91x_sdio.c:1178 > usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 > really_probe+0x2da/0xb10 drivers/base/dd.c:509 > driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 > __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 > bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 > __device_attach+0x223/0x3a0 drivers/base/dd.c:844 > bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 > device_add+0xad2/0x16e0 drivers/base/core.c:2106 > usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 > generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 > usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 > really_probe+0x2da/0xb10 drivers/base/dd.c:509 > driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 > __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 > bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 > __device_attach+0x223/0x3a0 drivers/base/dd.c:844 > bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 > device_add+0xad2/0x16e0 drivers/base/core.c:2106 > usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 > hub_port_connect drivers/usb/core/hub.c:5089 [inline] > hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] > port_event drivers/usb/core/hub.c:5350 [inline] > hub_event+0x1398/0x3b00 drivers/usb/core/hub.c:5432 > process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 > worker_thread+0x9b/0xe20 kernel/workqueue.c:2415 > kthread+0x313/0x420 kernel/kthread.c:253 > ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 > > ====================================================== Let's try to test the below combined patch which fixes both the above use-after-free issue and a second one which syzbot is likely to hit once the first one is fixed. #syz test: https://github.com/google/kasan.git master Johan >From 0fff9e8be7d92c37c0a03b8f58db415eb042c325 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 28 Nov 2019 16:07:57 +0100 Subject: [PATCH] rsi: fix use-after-free on failed probe and unbind Make sure to stop both URBs before returning after failed probe as well as on disconnect to avoid use-after-free in the completion handler. Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint") Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Cc: stable # 3.15 Cc: Siva Rebbagondla Cc: Prameela Rani Garnepudi Cc: Amitkumar Karwar Cc: Fariya Fatima rsi: fix use-after-free on probe errors The driver would fail to stop the command timer in most error paths, something which specifically could lead to the timer being freed while still active on I/O errors during probe. Fix this by making sure that each function starting the timer also stops it in all relevant error paths. Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com Fixes: b78e91bcfb33 ("rsi: Add new firmware loading method") Cc: stable # 4.12 Cc: Prameela Rani Garnepudi Cc: Amitkumar Karwar Signed-off-by: Johan Hovold --- drivers/net/wireless/rsi/rsi_91x_hal.c | 12 ++++++------ drivers/net/wireless/rsi/rsi_91x_usb.c | 18 +++++++++++++++++- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c index f84250bdb8cf..6f8d5f9a9f7e 100644 --- a/drivers/net/wireless/rsi/rsi_91x_hal.c +++ b/drivers/net/wireless/rsi/rsi_91x_hal.c @@ -622,6 +622,7 @@ static int bl_cmd(struct rsi_hw *adapter, u8 cmd, u8 exp_resp, char *str) bl_start_cmd_timer(adapter, timeout); status = bl_write_cmd(adapter, cmd, exp_resp, ®out_val); if (status < 0) { + bl_stop_cmd_timer(adapter); rsi_dbg(ERR_ZONE, "%s: Command %s (%0x) writing failed..\n", __func__, str, cmd); @@ -737,10 +738,9 @@ static int ping_pong_write(struct rsi_hw *adapter, u8 cmd, u8 *addr, u32 size) } status = bl_cmd(adapter, cmd_req, cmd_resp, str); - if (status) { - bl_stop_cmd_timer(adapter); + if (status) return status; - } + return 0; } @@ -828,10 +828,9 @@ static int auto_fw_upgrade(struct rsi_hw *adapter, u8 *flash_content, status = bl_cmd(adapter, EOF_REACHED, FW_LOADING_SUCCESSFUL, "EOF_REACHED"); - if (status) { - bl_stop_cmd_timer(adapter); + if (status) return status; - } + rsi_dbg(INFO_ZONE, "FW loading is done and FW is running..\n"); return 0; } @@ -849,6 +848,7 @@ static int rsi_hal_prepare_fwload(struct rsi_hw *adapter) ®out_val, RSI_COMMON_REG_SIZE); if (status < 0) { + bl_stop_cmd_timer(adapter); rsi_dbg(ERR_ZONE, "%s: REGOUT read failed\n", __func__); return status; diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c index 53f41fc2cadf..30bed719486e 100644 --- a/drivers/net/wireless/rsi/rsi_91x_usb.c +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c @@ -292,6 +292,15 @@ static void rsi_rx_done_handler(struct urb *urb) dev_kfree_skb(rx_cb->rx_skb); } +static void rsi_rx_urb_kill(struct rsi_hw *adapter, u8 ep_num) +{ + struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev; + struct rx_usb_ctrl_block *rx_cb = &dev->rx_cb[ep_num - 1]; + struct urb *urb = rx_cb->rx_urb; + + usb_kill_urb(urb); +} + /** * rsi_rx_urb_submit() - This function submits the given URB to the USB stack. * @adapter: Pointer to the adapter structure. @@ -823,10 +832,13 @@ static int rsi_probe(struct usb_interface *pfunction, if (adapter->priv->coex_mode > 1) { status = rsi_rx_urb_submit(adapter, BT_EP); if (status) - goto err1; + goto err_kill_wlan_urb; } return 0; + +err_kill_wlan_urb: + rsi_rx_urb_kill(adapter, WLAN_EP); err1: rsi_deinit_usb_interface(adapter); err: @@ -857,6 +869,10 @@ static void rsi_disconnect(struct usb_interface *pfunction) adapter->priv->bt_adapter = NULL; } + if (adapter->priv->coex_mode > 1) + rsi_rx_urb_kill(adapter, BT_EP); + rsi_rx_urb_kill(adapter, WLAN_EP); + rsi_reset_card(adapter); rsi_deinit_usb_interface(adapter); rsi_91x_deinit(adapter); -- 2.24.0