Linux-USB Archive on lore.kernel.org
 help / color / Atom feed
From: Andrey Konovalov <andreyknvl@google.com>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Jiri Kosina <jikos@kernel.org>,
	"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
	Hillf Danton <hdanton@sina.com>,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
	linux-input@vger.kernel.org, USB list <linux-usb@vger.kernel.org>
Subject: Re: [PATCH] HID: USB: Fix general protection fault caused by Logitech driver
Date: Thu, 22 Aug 2019 20:25:54 +0200
Message-ID: <CAAeHK+yt=YMvEpvuj2KfA4vnN=ZRFesRCEQJ6450M5JYmFWuDA@mail.gmail.com> (raw)
In-Reply-To: <Pine.LNX.4.44L0.1908221253180.1311-100000@iolanthe.rowland.org>

On Thu, Aug 22, 2019 at 7:11 PM Alan Stern <stern@rowland.harvard.edu> wrote:
>
> On Thu, 22 Aug 2019, Andrey Konovalov wrote:
>
> > Hi Alan,
> >
> > I've ran the fuzzer with your patches applied overnight and noticed
> > another fallout of similar bugs. I think they are caused by a similar
> > issue in the sony HID driver. There's no hid_hw_stop() call in the "if
> > (!(hdev->claimed & HID_CLAIMED_INPUT))" case in sony_probe(). Does it
> > look like a bug to you?
>
> It looks like the relevant hid_hw_stop() call is the one at the end of
> sony_configure_input().  But I can't tell if doing that way is valid or
> not -- in practice the code would end up calling hid_disconnect() while
> hid_connect() was still running, which doesn't seem like a good idea.
>
> There's a comment about this near the end of sony_probe().  I suspect
> it would be better to call hid_hw_stop() in the conditional code
> following that comment rather than in sony_configure_input().
>
> Either way, these are all things Jiri should know about or check up on.
>
> Have you gotten any test results from syzbot exercising these pathways?
> You ought to be able to tell which HID driver is involved by looking
> through the console output.

Yes, a typical crash is below, that's why I thought it's the sony
driver. Adding hid_hw_stop() in sony_probe() stops the issue from
happening, but I don't know whether it's the right fix.

usb 1-1: new high-speed USB device number 3 using dummy_hcd
usb 1-1: Using ep0 maxpacket: 8
usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an
invalid bInterval 0, changing7
usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor,
different from the inte9
usb 1-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: config 0 descriptor??
sony 0003:054C:024B.0002: unknown main item tag 0x0
sony 0003:054C:024B.0002: unknown main item tag 0x2
sony 0003:054C:024B.0002: unknown main item tag 0x0
sony 0003:054C:024B.0002: unknown main item tag 0x0
...
sony 0003:054C:024B.0002: unknown main item tag 0x0
==================================================================
BUG: KASAN: use-after-free in usbhid_power+0xca/0xe0
Read of size 8 at addr ffff88805d590008 by task syz-executor/1808

CPU: 1 PID: 1808 Comm: syz-executor Not tainted 5.3.0-rc5+ #203
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 print_address_description+0x6a/0x32c mm/kasan/report.c:351
 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
 kasan_report+0xe/0x12 mm/kasan/common.c:612
 usbhid_power+0xca/0xe0 drivers/hid/usbhid/hid-core.c:1234
 hid_hw_power ./include/linux/hid.h:1038
 hidraw_open+0x20d/0x740 drivers/hid/hidraw.c:282
 chrdev_open+0x219/0x5c0 fs/char_dev.c:414
 do_dentry_open+0x494/0x1120 fs/open.c:797
 do_last fs/namei.c:3416
 path_openat+0x1430/0x3f50 fs/namei.c:3533
 do_filp_open+0x1a1/0x280 fs/namei.c:3563
 do_sys_open+0x3c0/0x580 fs/open.c:1089
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe arch/x86/entry/entry_64.S:175
RIP: 0033:0x413a0e
Code: 89 54 24 08 e8 a3 f9 ff ff 8b 74 24 0c 48 8b 3c 24 41 89 c0 44
8b 54 24 08 b8 01 01 00 4
RSP: 002b:00007f7bf0a66730 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 0000000000413a0e
RDX: 0000000000000200 RSI: 00007f7bf0a66840 RDI: 00000000ffffff9c
RBP: 00007f7bf0a66840 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000004a521c
R13: 00000000004ef7d0 R14: 00000000004ae881 R15: 00007f7bf0a676bc

Allocated by task 78:
 save_stack+0x1b/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77
 __kasan_kmalloc mm/kasan/common.c:487
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
 slab_post_alloc_hook mm/slab.h:520
 slab_alloc_node mm/slub.c:2770
 __kmalloc_node_track_caller+0xfc/0x380 mm/slub.c:4365
 __kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:141
 __alloc_skb+0xef/0x5a0 net/core/skbuff.c:209
 alloc_skb ./include/linux/skbuff.h:1055
 alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:289
 uevent_net_broadcast_untagged lib/kobject_uevent.c:325
 kobject_uevent_net_broadcast lib/kobject_uevent.c:408
 kobject_uevent_env+0x8ee/0x1160 lib/kobject_uevent.c:592
 device_del+0x6b2/0xb10 drivers/base/core.c:2349
 usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
 usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
 hub_port_connect drivers/usb/core/hub.c:4949
 hub_port_connect_change drivers/usb/core/hub.c:5213
 port_event drivers/usb/core/hub.c:5359
 hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
 worker_thread+0x96/0xe20 kernel/workqueue.c:2415
 kthread+0x318/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 242:
 save_stack+0x1b/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77
 __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
 slab_free_hook mm/slub.c:1423
 slab_free_freelist_hook mm/slub.c:1474
 slab_free mm/slub.c:3016
 kfree+0xe4/0x2f0 mm/slub.c:3957
 skb_free_head+0x8b/0xa0 net/core/skbuff.c:591
 skb_release_data+0x41f/0x7c0 net/core/skbuff.c:611
 skb_release_all+0x46/0x60 net/core/skbuff.c:665
 __kfree_skb net/core/skbuff.c:679
 consume_skb net/core/skbuff.c:838
 consume_skb+0xd9/0x320 net/core/skbuff.c:832
 skb_free_datagram+0x16/0xf0 net/core/datagram.c:328
 netlink_recvmsg+0x65e/0xee0 net/netlink/af_netlink.c:1996
 sock_recvmsg_nosec net/socket.c:871
 sock_recvmsg net/socket.c:889
 sock_recvmsg+0xca/0x110 net/socket.c:885
 ___sys_recvmsg+0x271/0x5a0 net/socket.c:2480
 __sys_recvmsg+0xe9/0x1b0 net/socket.c:2537
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe arch/x86/entry/entry_64.S:175

The buggy address belongs to the object at ffff88805d590000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 8 bytes inside of
 1024-byte region [ffff88805d590000, ffff88805d590400)
The buggy address belongs to the page:
page:ffffea0001756400 refcount:1 mapcount:0 mapping:ffff88806c402280
index:0x0 compound_mapco0
flags: 0x100000000010200(slab|head)
raw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c402280
raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88805d58ff00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 ffff88805d58ff80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff88805d590000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88805d590080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88805d590100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

  reply index

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-29 11:48 WARNING in usbhid_raw_request/usb_submit_urb syzbot
2019-07-30 14:10 ` Alan Stern
2019-07-30 14:12   ` Andrey Konovalov
2019-07-30 14:24     ` Oliver Neukum
2019-07-30 16:58 ` syzbot
2019-08-12 12:46   ` Andrey Konovalov
2019-08-12 13:03     ` syzbot
2019-08-12 14:23       ` Andrey Konovalov
2019-08-13 20:13       ` Alan Stern
2019-08-21 12:51         ` Andrey Konovalov
2019-08-21 13:09           ` syzbot
2019-08-21 14:08             ` Andrey Konovalov
     [not found]     ` <20190812144720.1980-1-hdanton@sina.com>
2019-08-12 14:55       ` Andrey Konovalov
2019-08-12 15:06       ` general protection fault in __pm_runtime_resume syzbot
2019-08-15 17:43         ` Alan Stern
2019-08-20 20:00           ` [PATCH] HID: USB: Fix general protection fault caused by Logitech driver Alan Stern
2019-08-21 14:11             ` Andrey Konovalov
2019-08-22  7:53             ` Jiri Kosina
2019-08-22 12:32             ` Andrey Konovalov
2019-08-22 17:11               ` Alan Stern
2019-08-22 18:25                 ` Andrey Konovalov [this message]
2019-08-22 20:21                   ` Alan Stern
2019-08-23  9:29                     ` Jiri Kosina
2019-08-24  0:41                       ` Roderick.Colenbrander
2019-09-03 10:46                         ` Andrey Konovalov
2019-09-03 20:00                           ` Roderick.Colenbrander
     [not found]     ` <20190813042649.888-1-hdanton@sina.com>
2019-08-13  7:35       ` WARNING in usbhid_raw_request/usb_submit_urb Dmitry Vyukov
2019-08-13  8:14       ` Oliver Neukum

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAAeHK+yt=YMvEpvuj2KfA4vnN=ZRFesRCEQJ6450M5JYmFWuDA@mail.gmail.com' \
    --to=andreyknvl@google.com \
    --cc=gustavo@embeddedor.com \
    --cc=hdanton@sina.com \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=stern@rowland.harvard.edu \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-USB Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-usb/0 linux-usb/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-usb linux-usb/ https://lore.kernel.org/linux-usb \
		linux-usb@vger.kernel.org
	public-inbox-index linux-usb

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-usb


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git