From: syzbot <syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com>
To: andreyknvl@google.com, chunkeey@gmail.com,
chunkeey@googlemail.com, davem@davemloft.net,
kvalo@codeaurora.org, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org, oneukum@suse.com,
stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in p54u_load_firmware_cb
Date: Sat, 18 May 2019 08:50:00 -0700 [thread overview]
Message-ID: <000000000000add98105892b73ec@google.com> (raw)
In-Reply-To: <Pine.LNX.4.44L0.1905181045400.7855-100000@netrider.rowland.org>
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: slab-out-of-bounds Read in p54u_load_firmware_cb
usb 6-1: Direct firmware load for isl3887usb failed with error -2
p54u_load_firmware_cb: priv->udev = ffff88809ad5bb80
usb 6-1: Firmware not found.
==================================================================
BUG: KASAN: slab-out-of-bounds in p54u_load_firmware_cb+0x3c9/0x45f
drivers/net/wireless/intersil/p54/p54usb.c:937
Read of size 8 at addr ffff88809abab588 by task kworker/1:8/5526
CPU: 1 PID: 5526 Comm: kworker/1:8 Not tainted 5.1.0-rc3-g43151d6-dirty #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe8/0x16e lib/dump_stack.c:113
print_address_description+0x6c/0x236 mm/kasan/report.c:187
kasan_report.cold+0x1a/0x3c mm/kasan/report.c:317
p54u_load_firmware_cb+0x3c9/0x45f
drivers/net/wireless/intersil/p54/p54usb.c:937
request_firmware_work_func+0x12d/0x249
drivers/base/firmware_loader/main.c:785
process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
kthread+0x313/0x420 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Allocated by task 5503:
set_track mm/kasan/common.c:87 [inline]
__kasan_kmalloc mm/kasan/common.c:497 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:470
slab_post_alloc_hook mm/slab.h:437 [inline]
slab_alloc_node mm/slub.c:2756 [inline]
__kmalloc_node_track_caller+0xf3/0x320 mm/slub.c:4372
__kmalloc_reserve.isra.0+0x3e/0xf0 net/core/skbuff.c:140
__alloc_skb+0xf4/0x5a0 net/core/skbuff.c:208
alloc_skb include/linux/skbuff.h:1058 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
netlink_sendmsg+0x8db/0xcd0 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xda/0x130 net/socket.c:661
___sys_sendmsg+0x80b/0x930 net/socket.c:2260
__sys_sendmsg+0xf1/0x1b0 net/socket.c:2298
do_syscall_64+0xcf/0x4f0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 5503:
set_track mm/kasan/common.c:87 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:459
slab_free_hook mm/slub.c:1429 [inline]
slab_free_freelist_hook+0x5e/0x140 mm/slub.c:1456
slab_free mm/slub.c:3003 [inline]
kfree+0xce/0x290 mm/slub.c:3958
skb_free_head+0x90/0xb0 net/core/skbuff.c:557
skb_release_data+0x543/0x8b0 net/core/skbuff.c:577
skb_release_all+0x4b/0x60 net/core/skbuff.c:631
__kfree_skb net/core/skbuff.c:645 [inline]
consume_skb net/core/skbuff.c:705 [inline]
consume_skb+0xc5/0x2f0 net/core/skbuff.c:699
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x4e2/0x690 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x810/0xcd0 net/netlink/af_netlink.c:1925
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xda/0x130 net/socket.c:661
___sys_sendmsg+0x80b/0x930 net/socket.c:2260
__sys_sendmsg+0xf1/0x1b0 net/socket.c:2298
do_syscall_64+0xcf/0x4f0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809abab180
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 8 bytes to the right of
1024-byte region [ffff88809abab180, ffff88809abab580)
The buggy address belongs to the page:
page:ffffea00026aea00 count:1 mapcount:0 mapping:ffff88812c3f4a00 index:0x0
compound_mapcount: 0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000200 ffff88812c3f4a00
raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809abab480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809abab500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88809abab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88809abab600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809abab680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: 43151d6c usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=108a0108a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1292f852a00000
next prev parent reply other threads:[~2019-05-18 15:50 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-06 11:16 KASAN: use-after-free Read in p54u_load_firmware_cb syzbot
2019-05-13 10:23 ` syzbot
2019-05-13 13:28 ` Oliver Neukum
2019-05-17 19:21 ` Christian Lamparter
2019-05-17 20:46 ` Alan Stern
2019-05-17 21:01 ` syzbot
2019-05-18 15:13 ` Alan Stern
2019-05-18 15:50 ` syzbot [this message]
2019-05-18 16:32 ` Alan Stern
2019-05-18 16:50 ` syzbot
2019-05-18 17:01 ` Alan Stern
2019-05-18 17:36 ` syzbot
2019-05-18 17:49 ` Alan Stern
2019-05-18 18:31 ` syzbot
2019-05-18 20:11 ` Christian Lamparter
2019-05-20 14:44 ` [PATCH] network: wireless: p54u: Fix race between disconnect and firmware loading Alan Stern
2019-05-24 21:19 ` Christian Lamparter
2019-05-28 12:11 ` Kalle Valo
2019-05-28 14:17 ` Alan Stern
2019-05-28 14:29 ` Kalle Valo
2019-06-25 4:43 ` [PATCH] p54usb: " Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000add98105892b73ec@google.com \
--to=syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com \
--cc=andreyknvl@google.com \
--cc=chunkeey@gmail.com \
--cc=chunkeey@googlemail.com \
--cc=davem@davemloft.net \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.