From: Takashi Iwai <tiwai@suse.de> To: Alan Stern <stern@rowland.harvard.edu> Cc: syzbot <syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com>, alsa-devel@alsa-project.org, andreyknvl@google.com, linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, tiwai@suse.com Subject: Re: KASAN: use-after-free Read in line6_submit_audio_in_all_urbs Date: Fri, 10 Jul 2020 15:59:59 +0200 [thread overview] Message-ID: <s5hlfjr4gio.wl-tiwai@suse.de> (raw) In-Reply-To: <20200626182605.GA305214@rowland.harvard.edu> On Fri, 26 Jun 2020 20:26:05 +0200, Alan Stern wrote: > > On Fri, Jun 26, 2020 at 10:18:12AM -0700, syzbot wrote: > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: fb574682 usbip: tools: fix module name in man page > > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > > console output: https://syzkaller.appspot.com/x/log.txt?x=156560b1100000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=63b40b2ae167bad6 > > dashboard link: https://syzkaller.appspot.com/bug?extid=145012a46658ac00fc9e > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > > > Unfortunately, I don't have any reproducer for this crash yet. > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com > > > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > ================================================================== > > BUG: KASAN: use-after-free in line6_submit_audio_in_all_urbs+0x10b/0x120 sound/usb/line6/capture.c:72 > > Read of size 8 at addr ffff8881cffb1800 by task kworker/1:5/3257 > > > > CPU: 1 PID: 3257 Comm: kworker/1:5 Not tainted 5.8.0-rc1-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > > Workqueue: events line6_startup_work > > Call Trace: > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0xf6/0x16e lib/dump_stack.c:118 > > print_address_description.constprop.0+0x1a/0x210 mm/kasan/report.c:383 > > __kasan_report mm/kasan/report.c:513 [inline] > > kasan_report.cold+0x37/0x7c mm/kasan/report.c:530 > > line6_submit_audio_in_all_urbs+0x10b/0x120 sound/usb/line6/capture.c:72 > > line6_stream_start+0x207/0x230 sound/usb/line6/pcm.c:197 > > line6_pcm_acquire+0x161/0x210 sound/usb/line6/pcm.c:318 > > line6_startup_work+0x42/0x50 sound/usb/line6/driver.c:734 > > process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269 > > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 > > kthread+0x392/0x470 kernel/kthread.c:291 > > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 > > > > Allocated by task 76: > > save_stack+0x1b/0x40 mm/kasan/common.c:48 > > set_track mm/kasan/common.c:56 [inline] > > __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494 > > kmalloc include/linux/slab.h:555 [inline] > > kzalloc include/linux/slab.h:669 [inline] > > line6_init_pcm+0x2a7/0x9e0 sound/usb/line6/pcm.c:533 > > toneport_init+0xdd/0x6b0 sound/usb/line6/toneport.c:419 > > line6_probe+0xaa0/0x1330 sound/usb/line6/driver.c:809 > > It look like the cancel_delayed_work() in line6_disconnect() needs to be > cancel_delayed_work_sync(). Unfortunately we can't test this until syzbot > is able to reproduce the bug. Right, but fixing it now wouldn't be bad. The fix patch below. thanks, Takashi -- 8< -- From: Takashi Iwai <tiwai@suse.de> Subject: [PATCH] ALSA: line6: Sync the pending work cancel at disconnection Recently syzkaller reported a UAF in LINE6 driver, and it's likely because we call cancel_delayed_work() at the disconnect callback instead of cancel_delayed_work_sync(). Let's use the correct one instead. Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com Suggested-by: Alan Stern <stern@rowland.harvard.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> --- sound/usb/line6/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index 7629116f570e..2746d9698180 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -840,7 +840,7 @@ void line6_disconnect(struct usb_interface *interface) if (WARN_ON(usbdev != line6->usbdev)) return; - cancel_delayed_work(&line6->startup_work); + cancel_delayed_work_sync(&line6->startup_work); if (line6->urb_listen != NULL) line6_stop_listen(line6); -- 2.16.4
WARNING: multiple messages have this Message-ID (diff)
From: Takashi Iwai <tiwai@suse.de> To: Alan Stern <stern@rowland.harvard.edu> Cc: alsa-devel@alsa-project.org, syzbot <syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com>, andreyknvl@google.com, linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, tiwai@suse.com Subject: Re: KASAN: use-after-free Read in line6_submit_audio_in_all_urbs Date: Fri, 10 Jul 2020 15:59:59 +0200 [thread overview] Message-ID: <s5hlfjr4gio.wl-tiwai@suse.de> (raw) In-Reply-To: <20200626182605.GA305214@rowland.harvard.edu> On Fri, 26 Jun 2020 20:26:05 +0200, Alan Stern wrote: > > On Fri, Jun 26, 2020 at 10:18:12AM -0700, syzbot wrote: > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: fb574682 usbip: tools: fix module name in man page > > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > > console output: https://syzkaller.appspot.com/x/log.txt?x=156560b1100000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=63b40b2ae167bad6 > > dashboard link: https://syzkaller.appspot.com/bug?extid=145012a46658ac00fc9e > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > > > Unfortunately, I don't have any reproducer for this crash yet. > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com > > > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > > ================================================================== > > BUG: KASAN: use-after-free in line6_submit_audio_in_all_urbs+0x10b/0x120 sound/usb/line6/capture.c:72 > > Read of size 8 at addr ffff8881cffb1800 by task kworker/1:5/3257 > > > > CPU: 1 PID: 3257 Comm: kworker/1:5 Not tainted 5.8.0-rc1-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > > Workqueue: events line6_startup_work > > Call Trace: > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0xf6/0x16e lib/dump_stack.c:118 > > print_address_description.constprop.0+0x1a/0x210 mm/kasan/report.c:383 > > __kasan_report mm/kasan/report.c:513 [inline] > > kasan_report.cold+0x37/0x7c mm/kasan/report.c:530 > > line6_submit_audio_in_all_urbs+0x10b/0x120 sound/usb/line6/capture.c:72 > > line6_stream_start+0x207/0x230 sound/usb/line6/pcm.c:197 > > line6_pcm_acquire+0x161/0x210 sound/usb/line6/pcm.c:318 > > line6_startup_work+0x42/0x50 sound/usb/line6/driver.c:734 > > process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269 > > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 > > kthread+0x392/0x470 kernel/kthread.c:291 > > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 > > > > Allocated by task 76: > > save_stack+0x1b/0x40 mm/kasan/common.c:48 > > set_track mm/kasan/common.c:56 [inline] > > __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494 > > kmalloc include/linux/slab.h:555 [inline] > > kzalloc include/linux/slab.h:669 [inline] > > line6_init_pcm+0x2a7/0x9e0 sound/usb/line6/pcm.c:533 > > toneport_init+0xdd/0x6b0 sound/usb/line6/toneport.c:419 > > line6_probe+0xaa0/0x1330 sound/usb/line6/driver.c:809 > > It look like the cancel_delayed_work() in line6_disconnect() needs to be > cancel_delayed_work_sync(). Unfortunately we can't test this until syzbot > is able to reproduce the bug. Right, but fixing it now wouldn't be bad. The fix patch below. thanks, Takashi -- 8< -- From: Takashi Iwai <tiwai@suse.de> Subject: [PATCH] ALSA: line6: Sync the pending work cancel at disconnection Recently syzkaller reported a UAF in LINE6 driver, and it's likely because we call cancel_delayed_work() at the disconnect callback instead of cancel_delayed_work_sync(). Let's use the correct one instead. Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com Suggested-by: Alan Stern <stern@rowland.harvard.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> --- sound/usb/line6/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index 7629116f570e..2746d9698180 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -840,7 +840,7 @@ void line6_disconnect(struct usb_interface *interface) if (WARN_ON(usbdev != line6->usbdev)) return; - cancel_delayed_work(&line6->startup_work); + cancel_delayed_work_sync(&line6->startup_work); if (line6->urb_listen != NULL) line6_stop_listen(line6); -- 2.16.4
next prev parent reply other threads:[~2020-07-10 14:00 UTC|newest] Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-26 17:18 KASAN: use-after-free Read in line6_submit_audio_in_all_urbs syzbot 2020-06-26 18:26 ` Alan Stern 2020-06-26 18:26 ` Alan Stern 2020-07-10 13:59 ` Takashi Iwai [this message] 2020-07-10 13:59 ` Takashi Iwai
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=s5hlfjr4gio.wl-tiwai@suse.de \ --to=tiwai@suse.de \ --cc=alsa-devel@alsa-project.org \ --cc=andreyknvl@google.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-usb@vger.kernel.org \ --cc=stern@rowland.harvard.edu \ --cc=syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=tiwai@suse.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.