From: syzbot <syzbot+b05dabaed0b1f0b0a5e4@syzkaller.appspotmail.com>
To: ath9k-devel@qca.qualcomm.com, davem@davemloft.net,
kuba@kernel.org, kvalo@kernel.org, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in ath9k_hif_usb_reg_in_cb (3)
Date: Mon, 14 Feb 2022 22:57:20 -0800 [thread overview]
Message-ID: <00000000000064956605d8090bd5@google.com> (raw)
In-Reply-To: <00000000000006b92e05d6ee4fce@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 4378e427f705 usbip: vudc: Make use of the helper macro LIS..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=1565305a700000
kernel config: https://syzkaller.appspot.com/x/.config?x=83e40899a8923e35
dashboard link: https://syzkaller.appspot.com/bug?extid=b05dabaed0b1f0b0a5e4
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13a352f2700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162e878c700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b05dabaed0b1f0b0a5e4@syzkaller.appspotmail.com
usb 1-1: ath: unknown panic pattern!
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:147 [inline]
BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:1098 [inline]
BUG: KASAN: use-after-free in kfree_skb_reason+0x33/0x400 net/core/skbuff.c:772
Read of size 4 at addr ffff888118b6be9c by task syz-executor056/1278
CPU: 1 PID: 1278 Comm: syz-executor056 Not tainted 5.17.0-rc4-syzkaller-00061-g4378e427f705 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:71 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
refcount_read include/linux/refcount.h:147 [inline]
skb_unref include/linux/skbuff.h:1098 [inline]
kfree_skb_reason+0x33/0x400 net/core/skbuff.c:772
kfree_skb include/linux/skbuff.h:1114 [inline]
ath9k_hif_usb_reg_in_cb+0x4c2/0x630 drivers/net/wireless/ath/ath9k/hif_usb.c:771
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
__run_timers kernel/time/timer.c:1715 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
__do_softirq+0x288/0x9a5 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0033:0x7f65f5afb6ca
Code: 83 ff 03 74 3b 48 83 ec 28 b8 fa ff ff ff 83 ff 02 49 89 ca 0f 44 f8 64 8b 04 25 18 00 00 00 85 c0 75 2d b8 e6 00 00 00 0f 05 <89> c2 f7 da 3d 00 f0 ff ff b8 00 00 00 00 0f 47 c2 48 83 c4 28 c3
RSP: 002b:00007ffd489cd250 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000000000002e7e7 RCX: 00007f65f5afb6ca
RDX: 00007ffd489cd290 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000008 R08: 00000000000000c0 R09: 00007ffd489f0080
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd489cd2e0
R13: 00007ffd489cd340 R14: 0000000000000002 R15: 431bde82d7b634db
</TASK>
Allocated by task 69:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:260 [inline]
slab_post_alloc_hook mm/slab.h:732 [inline]
slab_alloc_node mm/slub.c:3230 [inline]
kmem_cache_alloc_node+0x25e/0x4b0 mm/slub.c:3266
__alloc_skb+0x215/0x340 net/core/skbuff.c:414
alloc_skb include/linux/skbuff.h:1158 [inline]
ath9k_hif_usb_alloc_reg_in_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:964 [inline]
ath9k_hif_usb_alloc_urbs+0x91d/0x1040 drivers/net/wireless/ath/ath9k/hif_usb.c:1023
ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline]
ath9k_hif_usb_firmware_cb+0x148/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242
request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1022
process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
worker_thread+0x657/0x1110 kernel/workqueue.c:2454
kthread+0x2ef/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Freed by task 1278:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x102/0x150 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:236 [inline]
slab_free_hook mm/slub.c:1728 [inline]
slab_free_freelist_hook mm/slub.c:1754 [inline]
slab_free mm/slub.c:3509 [inline]
kmem_cache_free+0xd5/0x400 mm/slub.c:3526
kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:700
__kfree_skb net/core/skbuff.c:757 [inline]
kfree_skb_reason net/core/skbuff.c:776 [inline]
kfree_skb_reason+0x145/0x400 net/core/skbuff.c:770
kfree_skb include/linux/skbuff.h:1114 [inline]
ath9k_htc_rx_msg+0x1ed/0xb70 drivers/net/wireless/ath/ath9k/htc_hst.c:451
ath9k_hif_usb_reg_in_cb+0x1ac/0x630 drivers/net/wireless/ath/ath9k/hif_usb.c:740
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
__run_timers kernel/time/timer.c:1715 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
__do_softirq+0x288/0x9a5 kernel/softirq.c:558
The buggy address belongs to the object at ffff888118b6bdc0
which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 220 bytes inside of
232-byte region [ffff888118b6bdc0, ffff888118b6bea8)
The buggy address belongs to the page:
page:ffffea000462dac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118b6b
flags: 0x200000000000200(slab|node=0|zone=2)
raw: 0200000000000200 0000000000000000 dead000000000001 ffff8881003d3640
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1170, ts 8677100351, free_ts 0
prep_new_page mm/page_alloc.c:2434 [inline]
get_page_from_freelist+0x122d/0x2940 mm/page_alloc.c:4165
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2271
alloc_slab_page mm/slub.c:1799 [inline]
allocate_slab+0x27f/0x3e0 mm/slub.c:1944
new_slab mm/slub.c:2004 [inline]
___slab_alloc+0xc12/0x1450 mm/slub.c:3018
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105
slab_alloc_node mm/slub.c:3196 [inline]
kmem_cache_alloc_node+0x397/0x4b0 mm/slub.c:3266
__alloc_skb+0x215/0x340 net/core/skbuff.c:414
alloc_skb include/linux/skbuff.h:1158 [inline]
alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:290
uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:409 [inline]
kobject_uevent_env+0xadf/0x1600 lib/kobject_uevent.c:593
kobject_synth_uevent+0x701/0x850 lib/kobject_uevent.c:208
store_uevent+0x12/0x20 kernel/module.c:1166
module_attr_store+0x50/0x80 kernel/params.c:919
sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x3f8/0x610 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2074 [inline]
new_sync_write+0x431/0x660 fs/read_write.c:503
page_owner free stack trace missing
Memory state around the buggy address:
ffff888118b6bd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff888118b6be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888118b6be80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
^
ffff888118b6bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888118b6bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
next prev parent reply other threads:[~2022-02-15 6:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-01 5:38 [syzbot] KASAN: use-after-free Read in ath9k_hif_usb_reg_in_cb (3) syzbot
2022-02-15 6:57 ` syzbot [this message]
2022-06-17 10:22 ` syzbot
[not found] <20220617123413.2734-1-hdanton@sina.com>
2022-06-17 14:09 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00000000000064956605d8090bd5@google.com \
--to=syzbot+b05dabaed0b1f0b0a5e4@syzkaller.appspotmail.com \
--cc=ath9k-devel@qca.qualcomm.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.