* KASAN: use-after-free Read in adu_disconnect
@ 2019-08-05 11:58 syzbot
2019-08-09 20:24 ` syzbot
0 siblings, 1 reply; 20+ messages in thread
From: syzbot @ 2019-08-05 11:58 UTC (permalink / raw)
To: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=148af1b2600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
usb 4-1: USB disconnect, device number 59
==================================================================
BUG: KASAN: use-after-free in atomic64_read
include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read
include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670
kernel/locking/mutex.c:1211
Read of size 8 at addr ffff8881d67b0c80 by task kworker/1:1/22
CPU: 1 PID: 22 Comm: kworker/1:1 Not tainted 5.3.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x128/0x190 mm/kasan/generic.c:192
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
__mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211
adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768
usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:1120 [inline]
device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
device_del+0x420/0xb10 drivers/base/core.c:2288
usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
hub_port_connect drivers/usb/core/hub.c:4949 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 2764:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 11056:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881d67b0c80
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
512-byte region [ffff8881d67b0c80, ffff8881d67b0e80)
The buggy address belongs to the page:
page:ffffea000759ec00 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea00074eca80 0000000200000002 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d67b0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d67b0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881d67b0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d67b0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d67b0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: KASAN: use-after-free Read in adu_disconnect 2019-08-05 11:58 KASAN: use-after-free Read in adu_disconnect syzbot @ 2019-08-09 20:24 ` syzbot 2019-09-19 10:35 ` Johan Hovold ` (2 more replies) 0 siblings, 3 replies; 20+ messages in thread From: syzbot @ 2019-08-09 20:24 UTC (permalink / raw) To: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs syzbot has found a reproducer for the following crash on: HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com usb 1-1: USB disconnect, device number 4 ================================================================== BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline] BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline] BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211 Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x128/0x190 mm/kasan/generic.c:192 atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline] atomic_long_read include/asm-generic/atomic-long.h:28 [inline] __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211 adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768 usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423 __device_release_driver drivers/base/dd.c:1120 [inline] device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151 bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556 device_del+0x420/0xb10 drivers/base/core.c:2288 usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237 usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199 hub_port_connect drivers/usb/core/hub.c:4949 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 22: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 1733: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881d1d0aa00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff8881d1d0aa00, ffff8881d1d0ac00) The buggy address belongs to the page: page:ffffea0007474280 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 ffffea000748c280 0000000500000005 ffff8881da002500 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d1d0a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d1d0a980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8881d1d0aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881d1d0aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d1d0ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-08-09 20:24 ` syzbot @ 2019-09-19 10:35 ` Johan Hovold 2019-09-19 10:53 ` syzbot 2019-09-20 8:26 ` Johan Hovold 2019-09-20 9:08 ` Johan Hovold 2019-09-20 14:38 ` Johan Hovold 2 siblings, 2 replies; 20+ messages in thread From: Johan Hovold @ 2019-09-19 10:35 UTC (permalink / raw) To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > usb 1-1: USB disconnect, device number 4 > ================================================================== > BUG: KASAN: use-after-free in atomic64_read > include/asm-generic/atomic-instrumented.h:836 [inline] > BUG: KASAN: use-after-free in atomic_long_read > include/asm-generic/atomic-long.h:28 [inline] > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > kernel/locking/mutex.c:1211 > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 Should be fixed by the below patch. #syz test: https://github.com/google/kasan.git f0df5c1b Johan From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@kernel.org> Date: Thu, 19 Sep 2019 11:48:38 +0200 Subject: [PATCH] USB: adutux: fix use-after-free on disconnect The driver was clearing its struct usb_device pointer, which it uses as an inverted disconnected flag, before deregistering the character device and without serialising against racing release(). This could lead to a use-after-free if a racing release() callback observes the cleared pointer and frees the driver data before disconnect() is finished with it. This could also lead to NULL-pointer dereferences in a racing open(). Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> # 2.6.24 Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/usb/misc/adutux.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c index 344d523b0502..bcc138990e2f 100644 --- a/drivers/usb/misc/adutux.c +++ b/drivers/usb/misc/adutux.c @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface) dev = usb_get_intfdata(interface); - mutex_lock(&dev->mtx); /* not interruptible */ - dev->udev = NULL; /* poison */ usb_deregister_dev(interface, &adu_class); - mutex_unlock(&dev->mtx); mutex_lock(&adutux_mutex); usb_set_intfdata(interface, NULL); + mutex_lock(&dev->mtx); /* not interruptible */ + dev->udev = NULL; /* poison */ + mutex_unlock(&dev->mtx); + /* if the device is not opened, then we clean up right now */ if (!dev->open_count) adu_delete(dev); -- 2.23.0 ^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-19 10:35 ` Johan Hovold @ 2019-09-19 10:53 ` syzbot 2019-09-20 8:26 ` Johan Hovold 1 sibling, 0 replies; 20+ messages in thread From: syzbot @ 2019-09-19 10:53 UTC (permalink / raw) To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger crash: Reported-and-tested-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com Tested on: commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5 dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc compiler: gcc (GCC) 9.0.0 20181231 (experimental) patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-19 10:35 ` Johan Hovold 2019-09-19 10:53 ` syzbot @ 2019-09-20 8:26 ` Johan Hovold 2019-09-20 9:02 ` syzbot 1 sibling, 1 reply; 20+ messages in thread From: Johan Hovold @ 2019-09-20 8:26 UTC (permalink / raw) To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs On Thu, Sep 19, 2019 at 12:35:04PM +0200, Johan Hovold wrote: > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > > syzbot has found a reproducer for the following crash on: > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > > git tree: https://github.com/google/kasan.git usb-fuzzer > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > > > usb 1-1: USB disconnect, device number 4 > > ================================================================== > > BUG: KASAN: use-after-free in atomic64_read > > include/asm-generic/atomic-instrumented.h:836 [inline] > > BUG: KASAN: use-after-free in atomic_long_read > > include/asm-generic/atomic-long.h:28 [inline] > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > > kernel/locking/mutex.c:1211 > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 > > Should be fixed by the below patch. > > #syz test: https://github.com/google/kasan.git f0df5c1b Hmm. Let's try that again with the commit id from the report... #syz test: https://github.com/google/kasan.git e96407b4 Johan > From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001 > From: Johan Hovold <johan@kernel.org> > Date: Thu, 19 Sep 2019 11:48:38 +0200 > Subject: [PATCH] USB: adutux: fix use-after-free on disconnect > > The driver was clearing its struct usb_device pointer, which it uses as > an inverted disconnected flag, before deregistering the character device > and without serialising against racing release(). > > This could lead to a use-after-free if a racing release() callback > observes the cleared pointer and frees the driver data before > disconnect() is finished with it. > > This could also lead to NULL-pointer dereferences in a racing open(). > > Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > Cc: stable <stable@vger.kernel.org> # 2.6.24 > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > > drivers/usb/misc/adutux.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c > index 344d523b0502..bcc138990e2f 100644 > --- a/drivers/usb/misc/adutux.c > +++ b/drivers/usb/misc/adutux.c > @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface) > > dev = usb_get_intfdata(interface); > > - mutex_lock(&dev->mtx); /* not interruptible */ > - dev->udev = NULL; /* poison */ > usb_deregister_dev(interface, &adu_class); > - mutex_unlock(&dev->mtx); > > mutex_lock(&adutux_mutex); > usb_set_intfdata(interface, NULL); > > + mutex_lock(&dev->mtx); /* not interruptible */ > + dev->udev = NULL; /* poison */ > + mutex_unlock(&dev->mtx); > + > /* if the device is not opened, then we clean up right now */ > if (!dev->open_count) > adu_delete(dev); ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 8:26 ` Johan Hovold @ 2019-09-20 9:02 ` syzbot 0 siblings, 0 replies; 20+ messages in thread From: syzbot @ 2019-09-20 9:02 UTC (permalink / raw) To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: KASAN: use-after-free Read in adu_disconnect usb 5-1: config 0 descriptor?? adutux 5-1:0.22: ADU130 now attached to /dev/usb/adutux5 usb 2-1: USB disconnect, device number 4 ================================================================== BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline] BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline] BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211 Read of size 8 at addr ffff8881d22b0280 by task kworker/1:4/2860 CPU: 1 PID: 2860 Comm: kworker/1:4 Not tainted 5.3.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x128/0x190 mm/kasan/generic.c:192 atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline] atomic_long_read include/asm-generic/atomic-long.h:28 [inline] __mutex_unlock_slowpath+0x96/0x670 kernel/locking/mutex.c:1211 adu_disconnect+0x83/0x150 drivers/usb/misc/adutux.c:768 usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423 __device_release_driver drivers/base/dd.c:1120 [inline] device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151 bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556 device_del+0x420/0xb10 drivers/base/core.c:2288 usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237 usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199 hub_port_connect drivers/usb/core/hub.c:4949 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 5: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 2895: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 adu_release+0x3cc/0x590 drivers/usb/misc/adutux.c:332 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881d22b0280 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff8881d22b0280, ffff8881d22b0480) The buggy address belongs to the page: page:ffffea000748ac00 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 ffffea00074fbc00 0000000200000002 ffff8881da002500 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d22b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d22b0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8881d22b0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881d22b0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d22b0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Tested on: commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git console output: https://syzkaller.appspot.com/x/log.txt?x=15d8afb5600000 kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc compiler: gcc (GCC) 9.0.0 20181231 (experimental) ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-08-09 20:24 ` syzbot 2019-09-19 10:35 ` Johan Hovold @ 2019-09-20 9:08 ` Johan Hovold 2019-09-20 9:13 ` Dmitry Vyukov 2019-09-20 9:20 ` syzbot 2019-09-20 14:38 ` Johan Hovold 2 siblings, 2 replies; 20+ messages in thread From: Johan Hovold @ 2019-09-20 9:08 UTC (permalink / raw) To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > usb 1-1: USB disconnect, device number 4 > ================================================================== > BUG: KASAN: use-after-free in atomic64_read > include/asm-generic/atomic-instrumented.h:836 [inline] > BUG: KASAN: use-after-free in atomic_long_read > include/asm-generic/atomic-long.h:28 [inline] > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > kernel/locking/mutex.c:1211 > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 Let's resend and retest with commit id from latest report to make sure the patch was actually applied during the last run: #syz test: https://github.com/google/kasan.git e96407b4 Johan From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@kernel.org> Date: Thu, 19 Sep 2019 11:48:38 +0200 Subject: [PATCH] USB: adutux: fix use-after-free on disconnect The driver was clearing its struct usb_device pointer, which it uses as an inverted disconnected flag, before deregistering the character device and without serialising against racing release(). This could lead to a use-after-free if a racing release() callback observes the cleared pointer and frees the driver data before disconnect() is finished with it. This could also lead to NULL-pointer dereferences in a racing open(). Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> # 2.6.24 Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/usb/misc/adutux.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c index 344d523b0502..bcc138990e2f 100644 --- a/drivers/usb/misc/adutux.c +++ b/drivers/usb/misc/adutux.c @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface) dev = usb_get_intfdata(interface); - mutex_lock(&dev->mtx); /* not interruptible */ - dev->udev = NULL; /* poison */ usb_deregister_dev(interface, &adu_class); - mutex_unlock(&dev->mtx); mutex_lock(&adutux_mutex); usb_set_intfdata(interface, NULL); + mutex_lock(&dev->mtx); /* not interruptible */ + dev->udev = NULL; /* poison */ + mutex_unlock(&dev->mtx); + /* if the device is not opened, then we clean up right now */ if (!dev->open_count) adu_delete(dev); -- 2.23.0 ^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:08 ` Johan Hovold @ 2019-09-20 9:13 ` Dmitry Vyukov 2019-09-20 9:21 ` Johan Hovold 2019-09-20 9:20 ` syzbot 1 sibling, 1 reply; 20+ messages in thread From: Dmitry Vyukov @ 2019-09-20 9:13 UTC (permalink / raw) To: Johan Hovold Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote: > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > > syzbot has found a reproducer for the following crash on: > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > > git tree: https://github.com/google/kasan.git usb-fuzzer > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > > > usb 1-1: USB disconnect, device number 4 > > ================================================================== > > BUG: KASAN: use-after-free in atomic64_read > > include/asm-generic/atomic-instrumented.h:836 [inline] > > BUG: KASAN: use-after-free in atomic_long_read > > include/asm-generic/atomic-long.h:28 [inline] > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > > kernel/locking/mutex.c:1211 > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 > > Let's resend and retest with commit id from latest report to make sure > the patch was actually applied during the last run: The reply contains: patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000 that's what's being parsed and applied during testing. > #syz test: https://github.com/google/kasan.git e96407b4 > > Johan > > > From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001 > From: Johan Hovold <johan@kernel.org> > Date: Thu, 19 Sep 2019 11:48:38 +0200 > Subject: [PATCH] USB: adutux: fix use-after-free on disconnect > > The driver was clearing its struct usb_device pointer, which it uses as > an inverted disconnected flag, before deregistering the character device > and without serialising against racing release(). > > This could lead to a use-after-free if a racing release() callback > observes the cleared pointer and frees the driver data before > disconnect() is finished with it. > > This could also lead to NULL-pointer dereferences in a racing open(). > > Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > Cc: stable <stable@vger.kernel.org> # 2.6.24 > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > > drivers/usb/misc/adutux.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c > index 344d523b0502..bcc138990e2f 100644 > --- a/drivers/usb/misc/adutux.c > +++ b/drivers/usb/misc/adutux.c > @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface) > > dev = usb_get_intfdata(interface); > > - mutex_lock(&dev->mtx); /* not interruptible */ > - dev->udev = NULL; /* poison */ > usb_deregister_dev(interface, &adu_class); > - mutex_unlock(&dev->mtx); > > mutex_lock(&adutux_mutex); > usb_set_intfdata(interface, NULL); > > + mutex_lock(&dev->mtx); /* not interruptible */ > + dev->udev = NULL; /* poison */ > + mutex_unlock(&dev->mtx); > + > /* if the device is not opened, then we clean up right now */ > if (!dev->open_count) > adu_delete(dev); > -- > 2.23.0 > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920090803.GM30545%40localhost. ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:13 ` Dmitry Vyukov @ 2019-09-20 9:21 ` Johan Hovold 2019-09-20 9:28 ` Dmitry Vyukov 0 siblings, 1 reply; 20+ messages in thread From: Johan Hovold @ 2019-09-20 9:21 UTC (permalink / raw) To: Dmitry Vyukov Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote: > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote: > > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > > > syzbot has found a reproducer for the following crash on: > > > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > > > git tree: https://github.com/google/kasan.git usb-fuzzer > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > > > > > usb 1-1: USB disconnect, device number 4 > > > ================================================================== > > > BUG: KASAN: use-after-free in atomic64_read > > > include/asm-generic/atomic-instrumented.h:836 [inline] > > > BUG: KASAN: use-after-free in atomic_long_read > > > include/asm-generic/atomic-long.h:28 [inline] > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > > > kernel/locking/mutex.c:1211 > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 > > > > Let's resend and retest with commit id from latest report to make sure > > the patch was actually applied during the last run: > > The reply contains: > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000 > that's what's being parsed and applied during testing. Thanks for confirming, but I can't seem to find that link in the report from syzbot: https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com Is it supposed to be there? Johan ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:21 ` Johan Hovold @ 2019-09-20 9:28 ` Dmitry Vyukov 2019-09-20 9:35 ` Johan Hovold 0 siblings, 1 reply; 20+ messages in thread From: Dmitry Vyukov @ 2019-09-20 9:28 UTC (permalink / raw) To: Johan Hovold Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote: > > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote: > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote: > > > > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > > > > syzbot has found a reproducer for the following crash on: > > > > > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > > > > git tree: https://github.com/google/kasan.git usb-fuzzer > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > > > > > > > usb 1-1: USB disconnect, device number 4 > > > > ================================================================== > > > > BUG: KASAN: use-after-free in atomic64_read > > > > include/asm-generic/atomic-instrumented.h:836 [inline] > > > > BUG: KASAN: use-after-free in atomic_long_read > > > > include/asm-generic/atomic-long.h:28 [inline] > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > > > > kernel/locking/mutex.c:1211 > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 > > > > > > Let's resend and retest with commit id from latest report to make sure > > > the patch was actually applied during the last run: > > > > The reply contains: > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000 > > that's what's being parsed and applied during testing. > > Thanks for confirming, but I can't seem to find that link in the report > from syzbot: > > https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com > > Is it supposed to be there? I meant the previous one: https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/ The one that you pointed to indeed does not have a patch (was tested without any patches). But you did not include any in the request, so this WAI. ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:28 ` Dmitry Vyukov @ 2019-09-20 9:35 ` Johan Hovold 2019-09-20 10:05 ` Dmitry Vyukov 0 siblings, 1 reply; 20+ messages in thread From: Johan Hovold @ 2019-09-20 9:35 UTC (permalink / raw) To: Dmitry Vyukov Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 11:28:22AM +0200, Dmitry Vyukov wrote: > On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote: > > > > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote: > > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote: > > > > > > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > > > > > syzbot has found a reproducer for the following crash on: > > > > > > > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > > > > > git tree: https://github.com/google/kasan.git usb-fuzzer > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > > > > > > > > > usb 1-1: USB disconnect, device number 4 > > > > > ================================================================== > > > > > BUG: KASAN: use-after-free in atomic64_read > > > > > include/asm-generic/atomic-instrumented.h:836 [inline] > > > > > BUG: KASAN: use-after-free in atomic_long_read > > > > > include/asm-generic/atomic-long.h:28 [inline] > > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > > > > > kernel/locking/mutex.c:1211 > > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 > > > > > > > > Let's resend and retest with commit id from latest report to make sure > > > > the patch was actually applied during the last run: > > > > > > The reply contains: > > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000 > > > that's what's being parsed and applied during testing. > > > > Thanks for confirming, but I can't seem to find that link in the report > > from syzbot: > > > > https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com > > > > Is it supposed to be there? > > I meant the previous one: > https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/ > > The one that you pointed to indeed does not have a patch (was tested > without any patches). But you did not include any in the request, so > this WAI. Ok, that was what I thought. I first tried retriggering the test by responding to the mail with the patch and a new test directive, but when that test failed, I figured the patch had not been applied and that I had to include it directly in the mail when retesting. Apparently misremembered someone from google responding to a patch with a test directive, but perhaps they also included the patch in that mail. Johan ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:35 ` Johan Hovold @ 2019-09-20 10:05 ` Dmitry Vyukov 0 siblings, 0 replies; 20+ messages in thread From: Dmitry Vyukov @ 2019-09-20 10:05 UTC (permalink / raw) To: Johan Hovold Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 11:35 AM Johan Hovold <johan@kernel.org> wrote: > > On Fri, Sep 20, 2019 at 11:28:22AM +0200, Dmitry Vyukov wrote: > > On Fri, Sep 20, 2019 at 11:21 AM Johan Hovold <johan@kernel.org> wrote: > > > > > > On Fri, Sep 20, 2019 at 11:13:14AM +0200, Dmitry Vyukov wrote: > > > > On Fri, Sep 20, 2019 at 11:08 AM Johan Hovold <johan@kernel.org> wrote: > > > > > > > > > > On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > > > > > > syzbot has found a reproducer for the following crash on: > > > > > > > > > > > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > > > > > > git tree: https://github.com/google/kasan.git usb-fuzzer > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > > > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > > > > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > > > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > > > > > > > > > > > usb 1-1: USB disconnect, device number 4 > > > > > > ================================================================== > > > > > > BUG: KASAN: use-after-free in atomic64_read > > > > > > include/asm-generic/atomic-instrumented.h:836 [inline] > > > > > > BUG: KASAN: use-after-free in atomic_long_read > > > > > > include/asm-generic/atomic-long.h:28 [inline] > > > > > > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > > > > > > kernel/locking/mutex.c:1211 > > > > > > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 > > > > > > > > > > Let's resend and retest with commit id from latest report to make sure > > > > > the patch was actually applied during the last run: > > > > > > > > The reply contains: > > > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1440268d600000 > > > > that's what's being parsed and applied during testing. > > > > > > Thanks for confirming, but I can't seem to find that link in the report > > > from syzbot: > > > > > > https://lkml.kernel.org/r/000000000000b05ce40592f8521a@google.com > > > > > > Is it supposed to be there? > > > > I meant the previous one: > > https://lore.kernel.org/linux-usb/000000000000d290e00592e5c17d@google.com/ > > > > The one that you pointed to indeed does not have a patch (was tested > > without any patches). But you did not include any in the request, so > > this WAI. > > Ok, that was what I thought. I first tried retriggering the test by > responding to the mail with the patch and a new test directive, but when > that test failed, I figured the patch had not been applied and that I > had to include it directly in the mail when retesting. > > Apparently misremembered someone from google responding to a patch with > a test directive, but perhaps they also included the patch in that mail. Yes, they probably included. But some developers point to own git tree/branch with the fix (e.g. on github), and then they don't need to attach patch separately. Note the first time you included the patch inline in the email. syzbot understands that too: you can either include inline or attach. So it tested with your patch. ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:08 ` Johan Hovold 2019-09-20 9:13 ` Dmitry Vyukov @ 2019-09-20 9:20 ` syzbot 2019-09-20 10:02 ` Johan Hovold 1 sibling, 1 reply; 20+ messages in thread From: syzbot @ 2019-09-20 9:20 UTC (permalink / raw) To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: KASAN: use-after-free Read in adu_interrupt_in_callback ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051 CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159 adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163 __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822 dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x179/0x650 kernel/time/timer.c:1322 expire_timers kernel/time/timer.c:1366 [inline] __run_timers kernel/time/timer.c:1685 [inline] __run_timers kernel/time/timer.c:1653 [inline] run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698 __do_softirq+0x221/0x912 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x178/0x1a0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:537 [inline] smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828 </IRQ> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline] RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471 Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9 db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044 RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91 R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047 R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190 vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986 vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386 printk+0xba/0xed kernel/printk/printk.c:2046 really_probe.cold+0x81/0x13a drivers/base/dd.c:616 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 3051: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 3051: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8881cd4d0280 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 216 bytes inside of 512-byte region [ffff8881cd4d0280, ffff8881cd4d0480) The buggy address belongs to the page: page:ffffea0007353400 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cd4d0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881cd4d0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff8881cd4d0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881cd4d0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881cd4d0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Tested on: commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git console output: https://syzkaller.appspot.com/x/log.txt?x=159037c9600000 kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc compiler: gcc (GCC) 9.0.0 20181231 (experimental) patch: https://syzkaller.appspot.com/x/patch.diff?x=15217e45600000 ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 9:20 ` syzbot @ 2019-09-20 10:02 ` Johan Hovold 2019-09-20 10:08 ` Dmitry Vyukov 2019-09-20 10:21 ` syzbot 0 siblings, 2 replies; 20+ messages in thread From: Johan Hovold @ 2019-09-20 10:02 UTC (permalink / raw) To: syzbot Cc: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered > crash: > KASAN: use-after-free Read in adu_interrupt_in_callback > > ================================================================== > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50 > kernel/locking/lockdep.c:3753 > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051 > > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Workqueue: usb_hub_wq hub_event > Call Trace: > <IRQ> > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0xca/0x13e lib/dump_stack.c:113 > print_address_description+0x6a/0x32c mm/kasan/report.c:351 > __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 > kasan_report+0xe/0x12 mm/kasan/common.c:612 > __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 > lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412 > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] > _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159 > adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163 > __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757 > usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822 > dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965 > call_timer_fn+0x179/0x650 kernel/time/timer.c:1322 > expire_timers kernel/time/timer.c:1366 [inline] > __run_timers kernel/time/timer.c:1685 [inline] > __run_timers kernel/time/timer.c:1653 [inline] > run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698 > __do_softirq+0x221/0x912 kernel/softirq.c:292 > invoke_softirq kernel/softirq.c:373 [inline] > irq_exit+0x178/0x1a0 kernel/softirq.c:413 > exiting_irq arch/x86/include/asm/apic.h:537 [inline] > smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095 > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828 > </IRQ> > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline] > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471 > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9 > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006 > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044 > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91 > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047 > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190 > vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986 > vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386 > printk+0xba/0xed kernel/printk/printk.c:2046 > really_probe.cold+0x81/0x13a drivers/base/dd.c:616 > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > __device_attach+0x217/0x360 drivers/base/dd.c:882 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > really_probe+0x281/0x650 drivers/base/dd.c:548 > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > __device_attach+0x217/0x360 drivers/base/dd.c:882 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > port_event drivers/usb/core/hub.c:5359 [inline] > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > kthread+0x318/0x420 kernel/kthread.c:255 > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > Allocated by task 3051: > save_stack+0x1b/0x80 mm/kasan/common.c:69 > set_track mm/kasan/common.c:77 [inline] > __kasan_kmalloc mm/kasan/common.c:487 [inline] > __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 > kmalloc include/linux/slab.h:552 [inline] > kzalloc include/linux/slab.h:748 [inline] > adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > really_probe+0x281/0x650 drivers/base/dd.c:548 > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > __device_attach+0x217/0x360 drivers/base/dd.c:882 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > really_probe+0x281/0x650 drivers/base/dd.c:548 > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > __device_attach+0x217/0x360 drivers/base/dd.c:882 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > port_event drivers/usb/core/hub.c:5359 [inline] > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > kthread+0x318/0x420 kernel/kthread.c:255 > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > Freed by task 3051: > save_stack+0x1b/0x80 mm/kasan/common.c:69 > set_track mm/kasan/common.c:77 [inline] > __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 > slab_free_hook mm/slub.c:1423 [inline] > slab_free_freelist_hook mm/slub.c:1470 [inline] > slab_free mm/slub.c:3012 [inline] > kfree+0xe4/0x2f0 mm/slub.c:3953 > adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750 > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > really_probe+0x281/0x650 drivers/base/dd.c:548 > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > __device_attach+0x217/0x360 drivers/base/dd.c:882 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > really_probe+0x281/0x650 drivers/base/dd.c:548 > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > __device_attach+0x217/0x360 drivers/base/dd.c:882 > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > port_event drivers/usb/core/hub.c:5359 [inline] > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > kthread+0x318/0x420 kernel/kthread.c:255 > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 This looks like a separate issue, which should be fixed by a separate patch. Not sure how to tell syzbot that. Dmitry? There's is indeed another bug in the driver, which could lead to crashes in the completion handler after clearing the struct usb_device pointer, but possibly also to the above use-after-free if a new device is probed immediately after a disconnect. The below patch addresses both bugs, let's see if that helps. #syz test: https://github.com/google/kasan.git e96407b4 Johan From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@kernel.org> Date: Thu, 19 Sep 2019 11:48:38 +0200 Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more FIXME: separate stopping URBs The driver was clearing its struct usb_device pointer, which it uses as an inverted disconnected flag, before deregistering the character device and without serialising against racing release(). This could lead to a use-after-free if a racing release() callback observes the cleared pointer and frees the driver data before disconnect() is finished with it. This could also lead to NULL-pointer dereferences in a racing open(). Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> # 2.6.24 Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/usb/misc/adutux.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c index 344d523b0502..a6996772745e 100644 --- a/drivers/usb/misc/adutux.c +++ b/drivers/usb/misc/adutux.c @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface) dev = usb_get_intfdata(interface); - mutex_lock(&dev->mtx); /* not interruptible */ - dev->udev = NULL; /* poison */ usb_deregister_dev(interface, &adu_class); - mutex_unlock(&dev->mtx); + + usb_poison_urb(dev->interrupt_in_urb); + usb_poison_urb(dev->interrupt_out_urb); mutex_lock(&adutux_mutex); usb_set_intfdata(interface, NULL); + mutex_lock(&dev->mtx); /* not interruptible */ + dev->udev = NULL; /* poison */ + mutex_unlock(&dev->mtx); + /* if the device is not opened, then we clean up right now */ if (!dev->open_count) adu_delete(dev); -- 2.23.0 ^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 10:02 ` Johan Hovold @ 2019-09-20 10:08 ` Dmitry Vyukov 2019-09-20 10:16 ` Andrey Konovalov 2019-09-20 14:31 ` Johan Hovold 2019-09-20 10:21 ` syzbot 1 sibling, 2 replies; 20+ messages in thread From: Dmitry Vyukov @ 2019-09-20 10:08 UTC (permalink / raw) To: Johan Hovold Cc: syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote: > > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote: > > Hello, > > > > syzbot has tested the proposed patch but the reproducer still triggered > > crash: > > KASAN: use-after-free Read in adu_interrupt_in_callback > > > > ================================================================== > > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50 > > kernel/locking/lockdep.c:3753 > > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051 > > > > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > Workqueue: usb_hub_wq hub_event > > Call Trace: > > <IRQ> > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0xca/0x13e lib/dump_stack.c:113 > > print_address_description+0x6a/0x32c mm/kasan/report.c:351 > > __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 > > kasan_report+0xe/0x12 mm/kasan/common.c:612 > > __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 > > lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412 > > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] > > _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159 > > adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163 > > __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757 > > usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822 > > dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965 > > call_timer_fn+0x179/0x650 kernel/time/timer.c:1322 > > expire_timers kernel/time/timer.c:1366 [inline] > > __run_timers kernel/time/timer.c:1685 [inline] > > __run_timers kernel/time/timer.c:1653 [inline] > > run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698 > > __do_softirq+0x221/0x912 kernel/softirq.c:292 > > invoke_softirq kernel/softirq.c:373 [inline] > > irq_exit+0x178/0x1a0 kernel/softirq.c:413 > > exiting_irq arch/x86/include/asm/apic.h:537 [inline] > > smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095 > > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828 > > </IRQ> > > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline] > > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471 > > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9 > > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff > > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 > > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 > > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006 > > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044 > > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91 > > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047 > > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190 > > vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986 > > vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386 > > printk+0xba/0xed kernel/printk/printk.c:2046 > > really_probe.cold+0x81/0x13a drivers/base/dd.c:616 > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > > port_event drivers/usb/core/hub.c:5359 [inline] > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > > kthread+0x318/0x420 kernel/kthread.c:255 > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > Allocated by task 3051: > > save_stack+0x1b/0x80 mm/kasan/common.c:69 > > set_track mm/kasan/common.c:77 [inline] > > __kasan_kmalloc mm/kasan/common.c:487 [inline] > > __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 > > kmalloc include/linux/slab.h:552 [inline] > > kzalloc include/linux/slab.h:748 [inline] > > adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 > > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > > port_event drivers/usb/core/hub.c:5359 [inline] > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > > kthread+0x318/0x420 kernel/kthread.c:255 > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > Freed by task 3051: > > save_stack+0x1b/0x80 mm/kasan/common.c:69 > > set_track mm/kasan/common.c:77 [inline] > > __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 > > slab_free_hook mm/slub.c:1423 [inline] > > slab_free_freelist_hook mm/slub.c:1470 [inline] > > slab_free mm/slub.c:3012 [inline] > > kfree+0xe4/0x2f0 mm/slub.c:3953 > > adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750 > > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > > port_event drivers/usb/core/hub.c:5359 [inline] > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > > kthread+0x318/0x420 kernel/kthread.c:255 > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > This looks like a separate issue, which should be fixed by a separate > patch. Not sure how to tell syzbot that. Dmitry? There is no way, but also no need. There is nothing it can do with that info. If you think it's a separate one and you fixed the first one, mail the patch with the first fix. Optionally, you can fix the second one as well, and then ask it to test a patch with 2 fixes (but you will need either to squash them or point to a git tree with both commits). > There's is indeed another bug in the driver, which could lead to crashes > in the completion handler after clearing the struct usb_device pointer, > but possibly also to the above use-after-free if a new device is probed > immediately after a disconnect. > > The below patch addresses both bugs, let's see if that helps. > > #syz test: https://github.com/google/kasan.git e96407b4 > > Johan > > From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001 > From: Johan Hovold <johan@kernel.org> > Date: Thu, 19 Sep 2019 11:48:38 +0200 > Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more > > FIXME: separate stopping URBs > > The driver was clearing its struct usb_device pointer, which it uses as > an inverted disconnected flag, before deregistering the character device > and without serialising against racing release(). > > This could lead to a use-after-free if a racing release() callback > observes the cleared pointer and frees the driver data before > disconnect() is finished with it. > > This could also lead to NULL-pointer dereferences in a racing open(). > > Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > Cc: stable <stable@vger.kernel.org> # 2.6.24 > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > drivers/usb/misc/adutux.c | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c > index 344d523b0502..a6996772745e 100644 > --- a/drivers/usb/misc/adutux.c > +++ b/drivers/usb/misc/adutux.c > @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface) > > dev = usb_get_intfdata(interface); > > - mutex_lock(&dev->mtx); /* not interruptible */ > - dev->udev = NULL; /* poison */ > usb_deregister_dev(interface, &adu_class); > - mutex_unlock(&dev->mtx); > + > + usb_poison_urb(dev->interrupt_in_urb); > + usb_poison_urb(dev->interrupt_out_urb); > > mutex_lock(&adutux_mutex); > usb_set_intfdata(interface, NULL); > > + mutex_lock(&dev->mtx); /* not interruptible */ > + dev->udev = NULL; /* poison */ > + mutex_unlock(&dev->mtx); > + > /* if the device is not opened, then we clean up right now */ > if (!dev->open_count) > adu_delete(dev); > -- > 2.23.0 > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920100233.GP30545%40localhost. ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 10:08 ` Dmitry Vyukov @ 2019-09-20 10:16 ` Andrey Konovalov 2019-09-20 14:31 ` Johan Hovold 1 sibling, 0 replies; 20+ messages in thread From: Andrey Konovalov @ 2019-09-20 10:16 UTC (permalink / raw) To: Dmitry Vyukov Cc: Johan Hovold, syzbot, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 12:08 PM Dmitry Vyukov <dvyukov@google.com> wrote: > > On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote: > > > > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote: > > > Hello, > > > > > > syzbot has tested the proposed patch but the reproducer still triggered > > > crash: > > > KASAN: use-after-free Read in adu_interrupt_in_callback > > > > > > ================================================================== > > > BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50 > > > kernel/locking/lockdep.c:3753 > > > Read of size 8 at addr ffff8881cd4d0358 by task kworker/0:6/3051 > > > > > > CPU: 0 PID: 3051 Comm: kworker/0:6 Not tainted 5.3.0-rc2+ #0 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > Google 01/01/2011 > > > Workqueue: usb_hub_wq hub_event > > > Call Trace: > > > <IRQ> > > > __dump_stack lib/dump_stack.c:77 [inline] > > > dump_stack+0xca/0x13e lib/dump_stack.c:113 > > > print_address_description+0x6a/0x32c mm/kasan/report.c:351 > > > __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 > > > kasan_report+0xe/0x12 mm/kasan/common.c:612 > > > __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 > > > lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412 > > > __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] > > > _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159 > > > adu_interrupt_in_callback+0x77/0x380 drivers/usb/misc/adutux.c:163 > > > __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1757 > > > usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1822 > > > dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965 > > > call_timer_fn+0x179/0x650 kernel/time/timer.c:1322 > > > expire_timers kernel/time/timer.c:1366 [inline] > > > __run_timers kernel/time/timer.c:1685 [inline] > > > __run_timers kernel/time/timer.c:1653 [inline] > > > run_timer_softirq+0x5cc/0x14b0 kernel/time/timer.c:1698 > > > __do_softirq+0x221/0x912 kernel/softirq.c:292 > > > invoke_softirq kernel/softirq.c:373 [inline] > > > irq_exit+0x178/0x1a0 kernel/softirq.c:413 > > > exiting_irq arch/x86/include/asm/apic.h:537 [inline] > > > smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1095 > > > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:828 > > > </IRQ> > > > RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline] > > > RIP: 0010:console_unlock+0xa2a/0xc40 kernel/printk/printk.c:2471 > > > Code: 00 89 ee 48 c7 c7 20 88 d3 86 e8 81 ad 03 00 65 ff 0d 72 a1 d9 7e e9 > > > db f9 ff ff e8 70 a1 15 00 e8 1b cb 1a 00 ff 74 24 30 9d <e9> 18 fe ff ff > > > e8 5c a1 15 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 > > > RSP: 0018:ffff8881cd20f200 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 > > > RAX: 0000000000000007 RBX: 0000000000000200 RCX: 0000000000000006 > > > RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ccd8d044 > > > RBP: 0000000000000000 R08: ffff8881ccd8c800 R09: fffffbfff11acd91 > > > R10: fffffbfff11acd90 R11: ffffffff88d66c87 R12: 0000000000000047 > > > R13: dffffc0000000000 R14: ffffffff82909100 R15: ffffffff87077190 > > > vprintk_emit+0x171/0x3e0 kernel/printk/printk.c:1986 > > > vprintk_func+0x75/0x113 kernel/printk/printk_safe.c:386 > > > printk+0xba/0xed kernel/printk/printk.c:2046 > > > really_probe.cold+0x81/0x13a drivers/base/dd.c:616 > > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > > > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > > > port_event drivers/usb/core/hub.c:5359 [inline] > > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > > > kthread+0x318/0x420 kernel/kthread.c:255 > > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > > > Allocated by task 3051: > > > save_stack+0x1b/0x80 mm/kasan/common.c:69 > > > set_track mm/kasan/common.c:77 [inline] > > > __kasan_kmalloc mm/kasan/common.c:487 [inline] > > > __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 > > > kmalloc include/linux/slab.h:552 [inline] > > > kzalloc include/linux/slab.h:748 [inline] > > > adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 > > > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > > > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > > > port_event drivers/usb/core/hub.c:5359 [inline] > > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > > > kthread+0x318/0x420 kernel/kthread.c:255 > > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > > > Freed by task 3051: > > > save_stack+0x1b/0x80 mm/kasan/common.c:69 > > > set_track mm/kasan/common.c:77 [inline] > > > __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 > > > slab_free_hook mm/slub.c:1423 [inline] > > > slab_free_freelist_hook mm/slub.c:1470 [inline] > > > slab_free mm/slub.c:3012 [inline] > > > kfree+0xe4/0x2f0 mm/slub.c:3953 > > > adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750 > > > usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 > > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > > usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 > > > generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 > > > usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 > > > really_probe+0x281/0x650 drivers/base/dd.c:548 > > > driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 > > > __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 > > > bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 > > > __device_attach+0x217/0x360 drivers/base/dd.c:882 > > > bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 > > > device_add+0xae6/0x16f0 drivers/base/core.c:2114 > > > usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 > > > hub_port_connect drivers/usb/core/hub.c:5098 [inline] > > > hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] > > > port_event drivers/usb/core/hub.c:5359 [inline] > > > hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 > > > process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 > > > worker_thread+0x96/0xe20 kernel/workqueue.c:2415 > > > kthread+0x318/0x420 kernel/kthread.c:255 > > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > This looks like a separate issue, which should be fixed by a separate > > patch. Not sure how to tell syzbot that. Dmitry? > > There is no way, but also no need. There is nothing it can do with that info. > If you think it's a separate one and you fixed the first one, mail the > patch with the first fix. > Optionally, you can fix the second one as well, and then ask it to > test a patch with 2 fixes (but you will need either to squash them or > point to a git tree with both commits). (Pointing to a git tree doesn't work with the USB fuzzing instance though, so you'll need to squash). > > > There's is indeed another bug in the driver, which could lead to crashes > > in the completion handler after clearing the struct usb_device pointer, > > but possibly also to the above use-after-free if a new device is probed > > immediately after a disconnect. > > > > The below patch addresses both bugs, let's see if that helps. > > > > #syz test: https://github.com/google/kasan.git e96407b4 > > > > Johan > > > > From c68eda0c6aae5b233fbd583afbfd3ea15acbc62f Mon Sep 17 00:00:00 2001 > > From: Johan Hovold <johan@kernel.org> > > Date: Thu, 19 Sep 2019 11:48:38 +0200 > > Subject: [PATCH] USB: adutux: fix use-after-free on disconnect + more > > > > FIXME: separate stopping URBs > > > > The driver was clearing its struct usb_device pointer, which it uses as > > an inverted disconnected flag, before deregistering the character device > > and without serialising against racing release(). > > > > This could lead to a use-after-free if a racing release() callback > > observes the cleared pointer and frees the driver data before > > disconnect() is finished with it. > > > > This could also lead to NULL-pointer dereferences in a racing open(). > > > > Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") > > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > Cc: stable <stable@vger.kernel.org> # 2.6.24 > > Signed-off-by: Johan Hovold <johan@kernel.org> > > --- > > drivers/usb/misc/adutux.c | 10 +++++++--- > > 1 file changed, 7 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c > > index 344d523b0502..a6996772745e 100644 > > --- a/drivers/usb/misc/adutux.c > > +++ b/drivers/usb/misc/adutux.c > > @@ -762,14 +762,18 @@ static void adu_disconnect(struct usb_interface *interface) > > > > dev = usb_get_intfdata(interface); > > > > - mutex_lock(&dev->mtx); /* not interruptible */ > > - dev->udev = NULL; /* poison */ > > usb_deregister_dev(interface, &adu_class); > > - mutex_unlock(&dev->mtx); > > + > > + usb_poison_urb(dev->interrupt_in_urb); > > + usb_poison_urb(dev->interrupt_out_urb); > > > > mutex_lock(&adutux_mutex); > > usb_set_intfdata(interface, NULL); > > > > + mutex_lock(&dev->mtx); /* not interruptible */ > > + dev->udev = NULL; /* poison */ > > + mutex_unlock(&dev->mtx); > > + > > /* if the device is not opened, then we clean up right now */ > > if (!dev->open_count) > > adu_delete(dev); > > -- > > 2.23.0 > > > > -- > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190920100233.GP30545%40localhost. ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 10:08 ` Dmitry Vyukov 2019-09-20 10:16 ` Andrey Konovalov @ 2019-09-20 14:31 ` Johan Hovold 1 sibling, 0 replies; 20+ messages in thread From: Johan Hovold @ 2019-09-20 14:31 UTC (permalink / raw) To: Dmitry Vyukov Cc: Johan Hovold, syzbot, Andrey Konovalov, dmg, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs On Fri, Sep 20, 2019 at 12:08:30PM +0200, Dmitry Vyukov wrote: > On Fri, Sep 20, 2019 at 12:02 PM Johan Hovold <johan@kernel.org> wrote: > > > > On Fri, Sep 20, 2019 at 02:20:00AM -0700, syzbot wrote: > > > Hello, > > > > > > syzbot has tested the proposed patch but the reproducer still triggered > > > crash: > > > KASAN: use-after-free Read in adu_interrupt_in_callback > > This looks like a separate issue, which should be fixed by a separate > > patch. Not sure how to tell syzbot that. Dmitry? > > There is no way, but also no need. There is nothing it can do with that info. > If you think it's a separate one and you fixed the first one, mail the > patch with the first fix. > Optionally, you can fix the second one as well, and then ask it to > test a patch with 2 fixes (but you will need either to squash them or > point to a git tree with both commits). > > > There's is indeed another bug in the driver, which could lead to crashes > > in the completion handler after clearing the struct usb_device pointer, > > but possibly also to the above use-after-free if a new device is probed > > immediately after a disconnect. > > > > The below patch addresses both bugs, let's see if that helps. > > > > #syz test: https://github.com/google/kasan.git e96407b4 Ok, so I was using an old syzbot kernel from when this was first reported and apparently hit a second issue which had since been fixed by Alan. I was starring at usb-next and couldn't see how it was possible to trigger this, but that code had Alan's fix 303911cfc5b9 ("USB: core: Fix races in character device registration and deregistraion"). Guess I had to bitten by this to learn the syzbot interface. ;) Johan ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 10:02 ` Johan Hovold 2019-09-20 10:08 ` Dmitry Vyukov @ 2019-09-20 10:21 ` syzbot 1 sibling, 0 replies; 20+ messages in thread From: syzbot @ 2019-09-20 10:21 UTC (permalink / raw) To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: KASAN: use-after-free Read in adu_release ================================================================== BUG: KASAN: use-after-free in adu_release+0x4dc/0x590 drivers/usb/misc/adutux.c:322 Read of size 4 at addr ffff8881d4ec4d1c by task syz-executor.5/3225 CPU: 1 PID: 3225 Comm: syz-executor.5 Not tainted 5.3.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 adu_release+0x4dc/0x590 drivers/usb/misc/adutux.c:322 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413511 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffddbaa5fc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413511 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000760130 R09: ffffffffffffffff R10: 00007ffddbaa5ee0 R11: 0000000000000293 R12: 0000000000000001 R13: 00007ffddbaa6000 R14: 0000000000000000 R15: 00007ffddbaa6010 Allocated by task 2885: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] adu_probe+0x7d/0x6e0 drivers/usb/misc/adutux.c:660 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 2885: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 adu_probe+0x5de/0x6e0 drivers/usb/misc/adutux.c:750 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8881d4ec4c80 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 156 bytes inside of 512-byte region [ffff8881d4ec4c80, ffff8881d4ec4e80) The buggy address belongs to the page: page:ffffea000753b100 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0xffff8881d4ec4f00 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 ffffea00074fea80 0000000400000004 ffff8881da002500 raw: ffff8881d4ec4f00 00000000800c0008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d4ec4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881d4ec4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff8881d4ec4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881d4ec4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d4ec4e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Tested on: commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git console output: https://syzkaller.appspot.com/x/log.txt?x=1251ee8d600000 kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc compiler: gcc (GCC) 9.0.0 20181231 (experimental) patch: https://syzkaller.appspot.com/x/patch.diff?x=16ddc075600000 ^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-08-09 20:24 ` syzbot 2019-09-19 10:35 ` Johan Hovold 2019-09-20 9:08 ` Johan Hovold @ 2019-09-20 14:38 ` Johan Hovold 2019-09-20 14:58 ` syzbot 2 siblings, 1 reply; 20+ messages in thread From: Johan Hovold @ 2019-09-20 14:38 UTC (permalink / raw) To: syzbot; +Cc: andreyknvl, dmg, gregkh, linux-kernel, linux-usb, syzkaller-bugs On Fri, Aug 09, 2019 at 01:24:04PM -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=13871a4a600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e > dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c4c8e2600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d80d2c600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com > > usb 1-1: USB disconnect, device number 4 > ================================================================== > BUG: KASAN: use-after-free in atomic64_read > include/asm-generic/atomic-instrumented.h:836 [inline] > BUG: KASAN: use-after-free in atomic_long_read > include/asm-generic/atomic-long.h:28 [inline] > BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x96/0x670 > kernel/locking/mutex.c:1211 > Read of size 8 at addr ffff8881d1d0aa00 by task kworker/0:1/12 Let's resend and retest using the latest usb-fuzzer kernel, which includes the fix for a couple char dev races that we were now hitting: #syz test: https://github.com/google/kasan.git e0bd8d79 I'll fix the failure to stop I/O at disconnect separately. Johan From 6f09430ae18085a1552fc641e53d3a3e678db6f3 Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@kernel.org> Date: Thu, 19 Sep 2019 11:48:38 +0200 Subject: [PATCH] USB: adutux: fix use-after-free on disconnect The driver was clearing its struct usb_device pointer, which it uses as an inverted disconnected flag, before deregistering the character device and without serialising against racing release(). This could lead to a use-after-free if a racing release() callback observes the cleared pointer and frees the driver data before disconnect() is finished with it. This could also lead to NULL-pointer dereferences in a racing open(). Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)") Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> # 2.6.24 Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/usb/misc/adutux.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c index 344d523b0502..bcc138990e2f 100644 --- a/drivers/usb/misc/adutux.c +++ b/drivers/usb/misc/adutux.c @@ -762,14 +762,15 @@ static void adu_disconnect(struct usb_interface *interface) dev = usb_get_intfdata(interface); - mutex_lock(&dev->mtx); /* not interruptible */ - dev->udev = NULL; /* poison */ usb_deregister_dev(interface, &adu_class); - mutex_unlock(&dev->mtx); mutex_lock(&adutux_mutex); usb_set_intfdata(interface, NULL); + mutex_lock(&dev->mtx); /* not interruptible */ + dev->udev = NULL; /* poison */ + mutex_unlock(&dev->mtx); + /* if the device is not opened, then we clean up right now */ if (!dev->open_count) adu_delete(dev); -- 2.23.0 ^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: KASAN: use-after-free Read in adu_disconnect 2019-09-20 14:38 ` Johan Hovold @ 2019-09-20 14:58 ` syzbot 0 siblings, 0 replies; 20+ messages in thread From: syzbot @ 2019-09-20 14:58 UTC (permalink / raw) To: andreyknvl, dmg, gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger crash: Reported-and-tested-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com Tested on: commit: e0bd8d79 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git kernel config: https://syzkaller.appspot.com/x/.config?x=8847e5384a16f66a dashboard link: https://syzkaller.appspot.com/bug?extid=0243cb250a51eeefb8cc compiler: gcc (GCC) 9.0.0 20181231 (experimental) patch: https://syzkaller.appspot.com/x/patch.diff?x=122eb075600000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2019-09-20 14:58 UTC | newest] Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-08-05 11:58 KASAN: use-after-free Read in adu_disconnect syzbot 2019-08-09 20:24 ` syzbot 2019-09-19 10:35 ` Johan Hovold 2019-09-19 10:53 ` syzbot 2019-09-20 8:26 ` Johan Hovold 2019-09-20 9:02 ` syzbot 2019-09-20 9:08 ` Johan Hovold 2019-09-20 9:13 ` Dmitry Vyukov 2019-09-20 9:21 ` Johan Hovold 2019-09-20 9:28 ` Dmitry Vyukov 2019-09-20 9:35 ` Johan Hovold 2019-09-20 10:05 ` Dmitry Vyukov 2019-09-20 9:20 ` syzbot 2019-09-20 10:02 ` Johan Hovold 2019-09-20 10:08 ` Dmitry Vyukov 2019-09-20 10:16 ` Andrey Konovalov 2019-09-20 14:31 ` Johan Hovold 2019-09-20 10:21 ` syzbot 2019-09-20 14:38 ` Johan Hovold 2019-09-20 14:58 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).