LKML Archive on lore.kernel.org
 help / color / Atom feed
* WARNING in __alloc_pages_nodemask
@ 2019-09-16 18:49 syzbot
  2019-09-16 20:00 ` David Rientjes
  0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2019-09-16 18:49 UTC (permalink / raw)
  To: aarcange, akpm, andreyknvl, linux-kernel, linux-mm, linux-usb,
	mhocko, rientjes, syzkaller-bugs, vbabka, yang.shi, zhongjiang

Hello,

syzbot found the following crash on:

HEAD commit:    f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com

WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696  
__alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 1720 Comm: syz-executor388 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  panic+0x2a3/0x6da kernel/panic.c:219
  __warn.cold+0x20/0x4a kernel/panic.c:576
  report_bug+0x262/0x2a0 lib/bug.c:186
  fixup_bug arch/x86/kernel/traps.c:179 [inline]
  fixup_bug arch/x86/kernel/traps.c:174 [inline]
  do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
  do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
  invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:__alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
Code: fe ff ff 65 48 8b 04 25 00 ef 01 00 48 05 60 10 00 00 41 be 01 00 00  
00 48 89 44 24 58 e9 ee fd ff ff 81 e5 00 20 00 00 75 02 <0f> 0b 45 31 f6  
e9 6b ff ff ff 8b 44 24 68 89 04 24 65 8b 2d e9 7e
RSP: 0018:ffff8881d320f9d8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff1103a641f3f RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000040a20
RBP: 0000000000000000 R08: ffff8881d3bcc800 R09: ffffed103a541d19
R10: ffffed103a541d18 R11: ffff8881d2a0e8c7 R12: 0000000000000012
R13: 0000000000000012 R14: 0000000000000000 R15: ffff8881d2a0e8c0
  alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
  alloc_pages include/linux/gfp.h:509 [inline]
  kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
  kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
  __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
  usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
  usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
  hid_hw_request include/linux/hid.h:1053 [inline]
  hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
  vfs_ioctl fs/ioctl.c:46 [inline]
  file_ioctl fs/ioctl.c:509 [inline]
  do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
  ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
  __do_sys_ioctl fs/ioctl.c:720 [inline]
  __se_sys_ioctl fs/ioctl.c:718 [inline]
  __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
  do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x444949
Code: e8 bc af 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 1b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffed614ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444949
RDX: 0000000020000080 RSI: 00000000400c4808 RDI: 0000000000000004
RBP: 00000000006cf018 R08: 18c1180b508ac6d9 R09: 00000000004002e0
R10: 000000000000000f R11: 0000000000000246 R12: 00000000004025f0
R13: 0000000000402680 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: WARNING in __alloc_pages_nodemask
  2019-09-16 18:49 WARNING in __alloc_pages_nodemask syzbot
@ 2019-09-16 20:00 ` David Rientjes
  2019-09-16 20:57   ` Matthew Wilcox
  0 siblings, 1 reply; 6+ messages in thread
From: David Rientjes @ 2019-09-16 20:00 UTC (permalink / raw)
  To: syzbot, Jiri Kosina, Benjamin Tissoires
  Cc: Andrea Arcangeli, Andrew Morton, andreyknvl, linux-kernel,
	linux-mm, linux-usb, mhocko, syzkaller-bugs, vbabka, yang.shi,
	zhongjiang

On Mon, 16 Sep 2019, syzbot wrote:

> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
> 
> WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
> __alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 0 PID: 1720 Comm: syz-executor388 Not tainted 5.3.0-rc7+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
> 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> panic+0x2a3/0x6da kernel/panic.c:219
> __warn.cold+0x20/0x4a kernel/panic.c:576
> report_bug+0x262/0x2a0 lib/bug.c:186
> fixup_bug arch/x86/kernel/traps.c:179 [inline]
> fixup_bug arch/x86/kernel/traps.c:174 [inline]
> do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
> do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
> invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
> RIP: 0010:__alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> Code: fe ff ff 65 48 8b 04 25 00 ef 01 00 48 05 60 10 00 00 41 be 01 00 00 00
> 48 89 44 24 58 e9 ee fd ff ff 81 e5 00 20 00 00 75 02 <0f> 0b 45 31 f6 e9 6b
> ff ff ff 8b 44 24 68 89 04 24 65 8b 2d e9 7e
> RSP: 0018:ffff8881d320f9d8 EFLAGS: 00010046
> RAX: 0000000000000000 RBX: 1ffff1103a641f3f RCX: 0000000000000000
> RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000040a20
> RBP: 0000000000000000 R08: ffff8881d3bcc800 R09: ffffed103a541d19
> R10: ffffed103a541d18 R11: ffff8881d2a0e8c7 R12: 0000000000000012
> R13: 0000000000000012 R14: 0000000000000000 R15: ffff8881d2a0e8c0
> alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
> alloc_pages include/linux/gfp.h:509 [inline]
> kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
> kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
> __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
> usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
> usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
> hid_hw_request include/linux/hid.h:1053 [inline]
> hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
> vfs_ioctl fs/ioctl.c:46 [inline]
> file_ioctl fs/ioctl.c:509 [inline]
> do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
> ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
> __do_sys_ioctl fs/ioctl.c:720 [inline]
> __se_sys_ioctl fs/ioctl.c:718 [inline]
> __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
> do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
> entry_SYSCALL_64_after_hwframe+0x49/0xbe

Adding Jiri and Benjamin.  The hid report length is simply too large for 
the page allocator to allocate: this is triggering because the resulting 
allocation order is > MAX_ORDER-1.  Any way to make this allocate less 
physically contiguous memory?

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: WARNING in __alloc_pages_nodemask
  2019-09-16 20:00 ` David Rientjes
@ 2019-09-16 20:57   ` Matthew Wilcox
  2019-09-19 18:29     ` Andrey Konovalov
  0 siblings, 1 reply; 6+ messages in thread
From: Matthew Wilcox @ 2019-09-16 20:57 UTC (permalink / raw)
  To: David Rientjes
  Cc: syzbot, Jiri Kosina, Benjamin Tissoires, Andrea Arcangeli,
	Andrew Morton, andreyknvl, linux-kernel, linux-mm, linux-usb,
	mhocko, syzkaller-bugs, vbabka, yang.shi, zhongjiang

On Mon, Sep 16, 2019 at 01:00:11PM -0700, David Rientjes wrote:
> On Mon, 16 Sep 2019, syzbot wrote:
> > HEAD commit:    f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> > dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
> > 
> > WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
> > __alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> > Kernel panic - not syncing: panic_on_warn set ...

> > alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
> > alloc_pages include/linux/gfp.h:509 [inline]
> > kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
> > kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
> > __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
> > usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
> > usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
> > hid_hw_request include/linux/hid.h:1053 [inline]
> > hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
> Adding Jiri and Benjamin.  The hid report length is simply too large for 
> the page allocator to allocate: this is triggering because the resulting 
> allocation order is > MAX_ORDER-1.  Any way to make this allocate less 
> physically contiguous memory?

The HID code should, presumably, reject reports which are larger than
PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER.  Particularly since it's using
GFP_ATOMIC.


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: WARNING in __alloc_pages_nodemask
  2019-09-16 20:57   ` Matthew Wilcox
@ 2019-09-19 18:29     ` Andrey Konovalov
  0 siblings, 0 replies; 6+ messages in thread
From: Andrey Konovalov @ 2019-09-19 18:29 UTC (permalink / raw)
  To: Matthew Wilcox
  Cc: David Rientjes, syzbot, Jiri Kosina, Benjamin Tissoires,
	Andrea Arcangeli, Andrew Morton, LKML,
	Linux Memory Management List, USB list, Michal Hocko,
	syzkaller-bugs, Vlastimil Babka, yang.shi, zhongjiang

On Mon, Sep 16, 2019 at 10:58 PM Matthew Wilcox <willy@infradead.org> wrote:
>
> On Mon, Sep 16, 2019 at 01:00:11PM -0700, David Rientjes wrote:
> > On Mon, 16 Sep 2019, syzbot wrote:
> > > HEAD commit:    f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> > > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
> > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
> > >
> > > WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
> > > __alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> > > Kernel panic - not syncing: panic_on_warn set ...
>
> > > alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
> > > alloc_pages include/linux/gfp.h:509 [inline]
> > > kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
> > > kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
> > > __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
> > > usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
> > > usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
> > > hid_hw_request include/linux/hid.h:1053 [inline]
> > > hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
> > Adding Jiri and Benjamin.  The hid report length is simply too large for
> > the page allocator to allocate: this is triggering because the resulting
> > allocation order is > MAX_ORDER-1.  Any way to make this allocate less
> > physically contiguous memory?
>
> The HID code should, presumably, reject reports which are larger than
> PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER.  Particularly since it's using
> GFP_ATOMIC.

This is an int underflow when doing report buffer size calculation, see here:

https://groups.google.com/d/msg/syzkaller-bugs/X0zVbh8aFEM/NsPcshjxBgAJ

#syz dup: KMSAN: kernel-usb-infoleak in hid_submit_ctrl

https://syzkaller.appspot.com/bug?extid=401d71a99cfca9fceb77

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: WARNING in __alloc_pages_nodemask
  2019-10-16  9:21 zzoru
@ 2019-10-16 12:59 ` Greg KH
  0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2019-10-16 12:59 UTC (permalink / raw)
  To: zzoru; +Cc: stern, linux-usb, usb-storage, LKML, dokyungs, syzkaller

On Wed, Oct 16, 2019 at 02:21:59AM -0700, zzoru wrote:
> We found the following crash on Linux 5.4-rc1 (Not patched in current
> HEAD commit 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442)
> with our customized syzkaller.

<snip>

For this, and the other report, can you make up a patch to fix the issue
and submit it?

Also, 5.4-rc3 is out, you might want to update to a newer kernel as lots
and lots of USB-specific syzkaller-found issues have been fixed since
-rc1.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 6+ messages in thread

* WARNING in __alloc_pages_nodemask
@ 2019-10-16  9:21 zzoru
  2019-10-16 12:59 ` Greg KH
  0 siblings, 1 reply; 6+ messages in thread
From: zzoru @ 2019-10-16  9:21 UTC (permalink / raw)
  To: stern, gregkh, linux-usb, usb-storage, LKML; +Cc: dokyungs, syzkaller

We found the following crash on Linux 5.4-rc1 (Not patched in current
HEAD commit 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442)
with our customized syzkaller.

WARNING: CPU: 0 PID: 12 at linux/mm/page_alloc.c:4727
__alloc_pages_nodemask+0x333/0x760 linux/mm/page_alloc.c:4727
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.4.0-rc1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack linux/lib/dump_stack.c:77 [inline]
 dump_stack+0x7c/0xbb linux/lib/dump_stack.c:113
 panic+0x205/0x48e linux/kernel/panic.c:220
 __warn+0x19c/0x1c0 linux/kernel/panic.c:581
 report_bug+0x1a9/0x2b0 linux/lib/bug.c:195
 fixup_bug.part.11+0x32/0x80 linux/arch/x86/kernel/traps.c:179
 fixup_bug linux/arch/x86/include/asm/irqflags.h:54 [inline]
 do_error_trap+0xf5/0x160 linux/arch/x86/kernel/traps.c:272
 do_invalid_op+0x31/0x40 linux/arch/x86/kernel/traps.c:291
 invalid_op+0x23/0x30 linux/arch/x86/entry/entry_64.S:1028
RIP: 0010:__alloc_pages_nodemask+0x333/0x760 linux/mm/page_alloc.c:4727
Code: fe ff ff 65 48 8b 04 25 00 ef 01 00 48 05 68 10 00 00 41 bc 01
00 00 00 48 89 44 24 40 e9 2a fe ff ff 81 e7 00 20 00 00 75 02 <0f> 0b
45 31 e4 e9 6e ff ff ff 41 f7 c6 00 00 40 00 0f 84 2c ff ff
RSP: 0018:ffff88801a1a6f60 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff11003434def RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000034 RDI: 0000000000000000
RBP: ffffffffffffff5e R08: ffffed1002d261a2 R09: dffffc0000000000
R10: 0000000000000001 R11: ffffed1002d261a1 R12: ffffffffffffff5e
R13: 0000000000000dc0 R14: ffff888017140000 R15: 0000000000000034
 alloc_pages linux/include/linux/gfp.h:509 [inline]
 kmalloc_order+0x16/0x50 linux/mm/slab_common.c:1294
 kmalloc_order_trace+0x18/0x110 linux/mm/slab_common.c:1306
 kmalloc linux/include/linux/slab.h:557 [inline]
 kzalloc linux/include/linux/slab.h:686 [inline]
 init_realtek_cr+0x2ec/0x1440 linux/drivers/usb/storage/realtek_cr.c:990
 usb_stor_acquire_resources linux/drivers/usb/storage/usb.c:784 [inline]
 usb_stor_probe2+0x738/0xbb0 linux/drivers/usb/storage/usb.c:1047
 realtek_cr_probe+0x9b/0xe0 linux/drivers/usb/storage/realtek_cr.c:1048
 usb_probe_interface+0x2b9/0x870 linux/drivers/usb/core/driver.c:361
 really_probe+0x444/0x830 linux/drivers/base/dd.c:548
 driver_probe_device+0xe3/0x250 linux/drivers/base/dd.c:721
 __device_attach_driver+0x17a/0x1e0 linux/drivers/base/dd.c:828
 bus_for_each_drv+0x143/0x1e0 linux/drivers/base/bus.c:430
 __device_attach+0x1f1/0x310 linux/drivers/base/dd.c:894
 bus_probe_device+0x1d7/0x280 linux/drivers/base/bus.c:490
 device_add+0xb72/0x1660 linux/drivers/base/core.c:2201
 usb_set_configuration+0xaca/0x1840 linux/drivers/usb/core/message.c:2023
 generic_probe+0x63/0xd0 linux/drivers/usb/core/generic.c:210
 usb_probe_device+0x89/0xd0 linux/drivers/usb/core/driver.c:266
 really_probe+0x444/0x830 linux/drivers/base/dd.c:548
 driver_probe_device+0xe3/0x250 linux/drivers/base/dd.c:721
 __device_attach_driver+0x17a/0x1e0 linux/drivers/base/dd.c:828
 bus_for_each_drv+0x143/0x1e0 linux/drivers/base/bus.c:430
 __device_attach+0x1f1/0x310 linux/drivers/base/dd.c:894
 bus_probe_device+0x1d7/0x280 linux/drivers/base/bus.c:490
 device_add+0xb72/0x1660 linux/drivers/base/core.c:2201
 usb_new_device+0x784/0x10d0 linux/drivers/usb/core/hub.c:2536
 hub_port_connect linux/drivers/usb/core/hub.c:5098 [inline]
 hub_port_connect_change linux/drivers/usb/core/hub.c:5213 [inline]
 port_event linux/drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x18ed/0x3610 linux/drivers/usb/core/hub.c:5441
 process_one_work+0x8b5/0x17c0 linux/kernel/workqueue.c:2269
 worker_thread+0x82/0xb80 linux/kernel/workqueue.c:2415
 kthread+0x325/0x3e0 linux/kernel/kthread.c:255
 ret_from_fork+0x24/0x30 linux/arch/x86/entry/entry_64.S:352
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled

Following is my analysis of this bug. (Just add some comments in source code):

realtek_cr.c:
struct rts51x_chip {
    u16 vendor_id;
    u16 product_id;
    char max_lun; // char -> signed 1byte
    ...
}

static int init_realtek_cr(struct us_data *us)
{
    int size, i, retval;
    ...
    us->max_lun = chip->max_lun = rts51x_get_max_lun(us); // From USB
device (-127~126) Malicious usb device can manipulate this value.

    size = (chip->max_lun + 1) * sizeof(struct rts51x_status); // Can
be negative integer or 0 (-1+1).

    chip->status = kzalloc(size, GFP_KERNEL); //  kzalloc(0) ==
ZERO_SIZE_PTR or kzalloc(negative integer) -> Warning

    ...

    for (i = 0; i <= (int)(chip->max_lun); i++) {
        retval = rts51x_check_status(us, (u8) i);
        ...
    }
}

tatic int rts51x_check_status(struct us_data *us, u8 lun)
{
    struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
    int retval;
    u8 buf[16];

    retval = rts51x_read_status(us, lun, buf, 16, &(chip->status_len));
    if (retval != STATUS_SUCCESS)
        return -EIO;

    usb_stor_dbg(us, "chip->status_len = %d\n", chip->status_len);

    chip->status[lun].vid = ((u16) buf[0] << 8) | buf[1]; //
ZERO_SIZE_PTR DEREFERENCE :(
    chip->status[lun].pid = ((u16) buf[2] << 8) | buf[3];
    chip->status[lun].cur_lun = buf[4];
    chip->status[lun].card_type = buf[5];
    chip->status[lun].total_lun = buf[6];
    chip->status[lun].fw_ver = ((u16) buf[7] << 8) | buf[8];
    chip->status[lun].phy_exist = buf[9];
    chip->status[lun].multi_flag = buf[10];
    chip->status[lun].multi_card = buf[11];
    chip->status[lun].log_exist = buf[12];
    if (chip->status_len == 16) {
        chip->status[lun].detailed_type.detailed_type1 = buf[13];
        chip->status[lun].function[0] = buf[14];
        chip->status[lun].function[1] = buf[15];
    }
    return 0;
}

Need to change a declaration of max_lun. (u8)

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, back to index

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-16 18:49 WARNING in __alloc_pages_nodemask syzbot
2019-09-16 20:00 ` David Rientjes
2019-09-16 20:57   ` Matthew Wilcox
2019-09-19 18:29     ` Andrey Konovalov
2019-10-16  9:21 zzoru
2019-10-16 12:59 ` Greg KH

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git