From: syzbot <syzbot+80899a8a8efe8968cde7@syzkaller.appspotmail.com>
To: Larry.Finger@lwfinger.net, andreyknvl@google.com,
devel@driverdev.osuosl.org, florian.c.schilhabel@googlemail.com,
gregkh@linuxfoundation.org, himadri18.07@gmail.com,
kai.heng.feng@canonical.com, linux-usb@vger.kernel.org,
linux.dkm@gmail.com, oneukum@suse.com, straube.linux@gmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: WARNING in r871xu_dev_remove
Date: Thu, 22 Aug 2019 07:52:01 -0700 [thread overview]
Message-ID: <0000000000001145b10590b5d5bc@google.com> (raw)
In-Reply-To: <1566484884.8347.53.camel@suse.com>
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: use-after-free Read in device_release_driver_internal
==================================================================
BUG: KASAN: use-after-free in __mutex_lock_common
kernel/locking/mutex.c:912 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0xf23/0x1360
kernel/locking/mutex.c:1077
Read of size 8 at addr ffff8881d644bd78 by task kworker/0:4/2855
CPU: 0 PID: 2855 Comm: kworker/0:4 Not tainted 5.3.0-rc5+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
__mutex_lock_common kernel/locking/mutex.c:912 [inline]
__mutex_lock+0xf23/0x1360 kernel/locking/mutex.c:1077
device_release_driver_internal+0x23/0x500 drivers/base/dd.c:1162
bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
device_del+0x420/0xb10 drivers/base/core.c:2339
usb_disconnect+0x4c3/0x8d0 drivers/usb/core/hub.c:2225
hub_port_connect drivers/usb/core/hub.c:4949 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 12:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
usb_alloc_dev+0x51/0xf95 drivers/usb/core/usb.c:583
hub_port_connect drivers/usb/core/hub.c:5004 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x15c0/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 2855:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1474 [inline]
slab_free mm/slub.c:3016 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3957
device_release+0x71/0x200 drivers/base/core.c:1064
kobject_cleanup lib/kobject.c:693 [inline]
kobject_release lib/kobject.c:722 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x171/0x280 lib/kobject.c:739
put_device+0x1b/0x30 drivers/base/core.c:2264
klist_put+0xce/0x170 lib/klist.c:221
bus_remove_device+0x3a4/0x4a0 drivers/base/bus.c:552
device_del+0x420/0xb10 drivers/base/core.c:2339
usb_disconnect+0x4c3/0x8d0 drivers/usb/core/hub.c:2225
hub_port_connect drivers/usb/core/hub.c:4949 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881d644bb80
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 504 bytes inside of
2048-byte region [ffff8881d644bb80, ffff8881d644c380)
The buggy address belongs to the page:
page:ffffea0007591200 refcount:1 mapcount:0 mapping:ffff8881da00c000
index:0xffff8881d6448000 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea000760ac00 0000000200000002 ffff8881da00c000
raw: ffff8881d6448000 00000000800f000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d644bc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d644bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881d644bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d644bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d644be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: eea39f24 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1018661e600000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0c62209eedfd54e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1425bc2e600000
prev parent reply other threads:[~2019-08-22 14:52 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-22 14:28 WARNING in r871xu_dev_remove syzbot
2019-08-22 14:41 ` Oliver Neukum
2019-08-22 14:52 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000001145b10590b5d5bc@google.com \
--to=syzbot+80899a8a8efe8968cde7@syzkaller.appspotmail.com \
--cc=Larry.Finger@lwfinger.net \
--cc=andreyknvl@google.com \
--cc=devel@driverdev.osuosl.org \
--cc=florian.c.schilhabel@googlemail.com \
--cc=gregkh@linuxfoundation.org \
--cc=himadri18.07@gmail.com \
--cc=kai.heng.feng@canonical.com \
--cc=linux-usb@vger.kernel.org \
--cc=linux.dkm@gmail.com \
--cc=oneukum@suse.com \
--cc=straube.linux@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.