linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* general protection fault in usb_set_interface
@ 2019-09-16 13:29 syzbot
  2019-09-16 20:51 ` Alan Stern
  2019-12-13 12:15 ` Andrey Konovalov
  0 siblings, 2 replies; 23+ messages in thread
From: syzbot @ 2019-09-16 13:29 UTC (permalink / raw)
  To: andreyknvl, gregkh, kai.heng.feng, linux-kernel, linux-usb, mans,
	oneukum, stern, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=158b66f1600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=7fa38a608b1075dfd634
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14f57db9600000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=127b61a5600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com

usb 3-1: usbvision_write_reg: failed: error -2
usbvision_set_audio: can't write iopin register for audio switching
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 1 PID: 1955 Comm: v4l_id Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:usb_set_interface+0x34/0xa50 drivers/usb/core/message.c:1362
Code: fc 55 53 48 83 ec 40 89 54 24 18 89 74 24 10 e8 22 1c ef fd 49 8d 7c  
24 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f  
85 fb 08 00 00 49 8b 44 24 48 49 8d 7c 24 18 48 89
RSP: 0018:ffff8881cb19fd50 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000009 RSI: ffffffff834ebe7e RDI: 0000000000000048
RBP: ffff8881cb8e4200 R08: ffffffff88d21878 R09: ffffed103971cb43
R10: ffff8881cb19fdc8 R11: ffff8881cb8e5a17 R12: 0000000000000000
R13: ffff8881cb8e5a10 R14: ffff8881cb8e4cc8 R15: ffff8881cb8e5178
FS:  00007f4f60b6d700(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4f6060c330 CR3: 00000001cc3a8000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  usbvision_radio_close+0x105/0x250  
drivers/media/usb/usbvision/usbvision-video.c:1114
  v4l2_release+0x2e7/0x390 drivers/media/v4l2-core/v4l2-dev.c:455
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f4f6069b2b0
Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 32 08 00 e8 c0  
07 02 00 83 3d 45 a3 2b 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff  
ff 73 31 c3 48 83 ec 08 e8 ce 8a 01 00 48 89 04 24
RSP: 002b:00007ffde2d50ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f4f6069b2b0
RDX: 00007f4f60951df0 RSI: 0000000000000001 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007f4f60951df0 R09: 000000000000000a
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400884
R13: 00007ffde2d51040 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 62bd2b7512ab49ee ]---
RIP: 0010:usb_set_interface+0x34/0xa50 drivers/usb/core/message.c:1362
Code: fc 55 53 48 83 ec 40 89 54 24 18 89 74 24 10 e8 22 1c ef fd 49 8d 7c  
24 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f  
85 fb 08 00 00 49 8b 44 24 48 49 8d 7c 24 18 48 89
RSP: 0018:ffff8881cb19fd50 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000009 RSI: ffffffff834ebe7e RDI: 0000000000000048
RBP: ffff8881cb8e4200 R08: ffffffff88d21878 R09: ffffed103971cb43
R10: ffff8881cb19fdc8 R11: ffff8881cb8e5a17 R12: 0000000000000000
R13: ffff8881cb8e5a10 R14: ffff8881cb8e4cc8 R15: ffff8881cb8e5178
FS:  00007f4f60b6d700(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4f6060c330 CR3: 00000001cc3a8000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: Re: KASAN: use-after-free Read in usbvision_v4l2_open
@ 2019-12-10 20:17 Alan Stern
  2019-12-12 16:52 ` general protection fault in usb_set_interface Alan Stern
  0 siblings, 1 reply; 23+ messages in thread
From: Alan Stern @ 2019-12-10 20:17 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, hverkuil, jrdr.linux, Kernel development list,
	linux-media, USB list, mchehab, rfontana, syzkaller-bugs, tglx

On Tue, 10 Dec 2019, syzbot wrote:

> > On Mon, 9 Dec 2019, syzbot wrote:
> 
> >> Hello,
> 
> >> syzbot found the following crash on:
> 
> >> HEAD commit:    1f22d15c usb: gadget: add raw-gadget interface
> >> git tree:       https://github.com/google/kasan.git usb-fuzzer
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=1296f42ae00000
> >> kernel config:   
> >> https://syzkaller.appspot.com/x/.config?x=8ccee2968018adcb
> >> dashboard link:  
> >> https://syzkaller.appspot.com/bug?extid=c7b0ec009a216143df30
> >> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> 
> >> Unfortunately, I don't have any reproducer for this crash yet.
> 
> >> IMPORTANT: if you fix the bug, please add the following tag to the  
> >> commit:
> >> Reported-by: syzbot+c7b0ec009a216143df30@syzkaller.appspotmail.com
> 
> >> ==================================================================
> >> BUG: KASAN: use-after-free in __mutex_lock_common
> >> kernel/locking/mutex.c:1043 [inline]
> >> BUG: KASAN: use-after-free in __mutex_lock+0x124d/0x1360
> >> kernel/locking/mutex.c:1106
> >> Read of size 8 at addr ffff8881cad4d8b8 by task v4l_id/4526
> 
> >> CPU: 0 PID: 4526 Comm: v4l_id Not tainted 5.4.0-syzkaller #0
> >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> >> Google 01/01/2011
> >> Call Trace:
> >>    __dump_stack lib/dump_stack.c:77 [inline]
> >>    dump_stack+0xef/0x16e lib/dump_stack.c:118
> >>    print_address_description.constprop.0+0x36/0x50 mm/kasan/report.c:374
> >>    __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:506
> >>    kasan_report+0xe/0x20 mm/kasan/common.c:638
> >>    __mutex_lock_common kernel/locking/mutex.c:1043 [inline]
> >>    __mutex_lock+0x124d/0x1360 kernel/locking/mutex.c:1106
> >>    usbvision_v4l2_open+0x77/0x340
> >> drivers/media/usb/usbvision/usbvision-video.c:314
> >>    v4l2_open+0x20f/0x3d0 drivers/media/v4l2-core/v4l2-dev.c:423
> >>    chrdev_open+0x219/0x5c0 fs/char_dev.c:414
> >>    do_dentry_open+0x494/0x1120 fs/open.c:797
> >>    do_last fs/namei.c:3412 [inline]
> >>    path_openat+0x142b/0x4030 fs/namei.c:3529
> >>    do_filp_open+0x1a1/0x280 fs/namei.c:3559
> >>    do_sys_open+0x3c0/0x580 fs/open.c:1097
> >>    do_syscall_64+0xb7/0x5b0 arch/x86/entry/common.c:294
> >>    entry_SYSCALL_64_after_hwframe+0x49/0xbe
> 
> > This looks like a race in v4l2_open(): The function drops the
> > videodev_lock mutex before calling the video driver's open routine, and
> > the device can be unregistered during the short time between.
> 
> > This patch tries to make the race much more likely to happen, for
> > testing and verification.
> 
> > Andrey, will syzbot run the same test with this patch, even though it
> > says it doesn't have a reproducer?
> 
> > Alan Stern
> 
> > #syz test: https://github.com/google/kasan.git 1f22d15c
> 
> This crash does not have a reproducer. I cannot test it.

Let's try the same patch with a different bug report -- one that has a
reproducer.  I assume that syzbot gets the bug identity from the
email's From: line (which has been updated acoordingly) rather than the 
Subject: line.

#syz test: https://github.com/google/kasan.git 1f22d15c

Index: usb-devel/drivers/media/usb/usbvision/usbvision-video.c
===================================================================
--- usb-devel.orig/drivers/media/usb/usbvision/usbvision-video.c
+++ usb-devel/drivers/media/usb/usbvision/usbvision-video.c
@@ -1585,6 +1585,7 @@ static void usbvision_disconnect(struct
 		wake_up_interruptible(&usbvision->wait_frame);
 		wake_up_interruptible(&usbvision->wait_stream);
 	} else {
+		msleep(100);
 		usbvision_release(usbvision);
 	}
 
Index: usb-devel/drivers/media/v4l2-core/v4l2-dev.c
===================================================================
--- usb-devel.orig/drivers/media/v4l2-core/v4l2-dev.c
+++ usb-devel/drivers/media/v4l2-core/v4l2-dev.c
@@ -419,9 +419,10 @@ static int v4l2_open(struct inode *inode
 	video_get(vdev);
 	mutex_unlock(&videodev_lock);
 	if (vdev->fops->open) {
-		if (video_is_registered(vdev))
+		if (video_is_registered(vdev)) {
+			msleep(200);
 			ret = vdev->fops->open(filp);
-		else
+		} else
 			ret = -ENODEV;
 	}
 


^ permalink raw reply	[flat|nested] 23+ messages in thread
end of thread, other threads:[~2019-12-17 13:17 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-16 13:29 general protection fault in usb_set_interface syzbot
2019-09-16 20:51 ` Alan Stern
2019-09-16 21:03   ` syzbot
2019-09-17 15:16     ` Alan Stern
2019-09-17 15:28       ` syzbot
2019-09-17 15:53         ` Alan Stern
2019-09-17 16:06           ` syzbot
2019-09-17 17:36             ` Alan Stern
2019-09-17 18:08               ` Alan Stern
2019-09-17 18:15                 ` syzbot
2019-09-17 18:31                   ` Alan Stern
2019-09-17 18:43                     ` syzbot
2019-09-18 18:57                       ` Alan Stern
2019-09-19 15:19                         ` Andrey Konovalov
2019-12-13 12:15 ` Andrey Konovalov
2019-12-13 12:16   ` syzbot
2019-12-13 12:19     ` Andrey Konovalov
2019-12-13 19:51       ` Alan Stern
2019-12-16 14:59         ` Andrey Konovalov
2019-12-16 15:05           ` Alan Stern
2019-12-16 15:24             ` Andrey Konovalov
2019-12-17 13:17             ` Dmitry Vyukov
2019-12-10 20:17 Re: KASAN: use-after-free Read in usbvision_v4l2_open Alan Stern
2019-12-12 16:52 ` general protection fault in usb_set_interface Alan Stern

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).