From: syzbot <syzbot+ce750e124675d4599449@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [pvrusb2?] KASAN: slab-use-after-free Read in pvr2_context_set_notify (2)
Date: Thu, 15 Feb 2024 20:58:03 -0800 [thread overview]
Message-ID: <000000000000c43ecc06117896ab@google.com> (raw)
In-Reply-To: <20240216004250.1196-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in pvr2_context_set_notify
pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
==================================================================
BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2ba/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:48
Read of size 4 at addr ffff88810fb02ed8 by task pvrusb2-context/902
CPU: 0 PID: 902 Comm: pvrusb2-context Not tainted 6.8.0-rc4-syzkaller-00180-g4f5e5092fdbf-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:488
kasan_report+0xda/0x110 mm/kasan/report.c:601
pvr2_context_set_notify+0x2ba/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:48
pvr2_context_thread_func+0x10d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:157
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
Allocated by task 724:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0x87/0x90 mm/kasan/common.c:389
kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]
pvr2_context_create+0x53/0x2a0 drivers/media/usb/pvrusb2/pvrusb2-context.c:207
pvr_probe+0x25/0xe0 drivers/media/usb/pvrusb2/pvrusb2-main.c:54
usb_probe_interface+0x307/0x930 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532
device_add+0x117e/0x1aa0 drivers/base/core.c:3625
usb_set_configuration+0x10cb/0x1c40 drivers/usb/core/message.c:2207
usb_generic_driver_probe+0xad/0x110 drivers/usb/core/generic.c:254
usb_probe_device+0xec/0x350 drivers/usb/core/driver.c:294
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532
device_add+0x117e/0x1aa0 drivers/base/core.c:3625
usb_new_device+0xd90/0x1a10 drivers/usb/core/hub.c:2614
hub_port_connect drivers/usb/core/hub.c:5483 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
port_event drivers/usb/core/hub.c:5783 [inline]
hub_event+0x2e62/0x4f40 drivers/usb/core/hub.c:5865
process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
Freed by task 724:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
poison_slab_object mm/kasan/common.c:241 [inline]
__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x105/0x340 mm/slub.c:4409
pvr_disconnect+0x80/0xf0 drivers/media/usb/pvrusb2/pvrusb2-main.c:79
usb_unbind_interface+0x1dd/0x8d0 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:569 [inline]
device_remove+0x11f/0x170 drivers/base/dd.c:561
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1295
bus_remove_device+0x22c/0x420 drivers/base/bus.c:574
device_del+0x39a/0xa50 drivers/base/core.c:3814
usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1416
usb_disconnect+0x2e1/0x910 drivers/usb/core/hub.c:2267
hub_port_connect drivers/usb/core/hub.c:5323 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
port_event drivers/usb/core/hub.c:5783 [inline]
hub_event+0x1be0/0x4f40 drivers/usb/core/hub.c:5865
process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
The buggy address belongs to the object at ffff88810fb02e00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 216 bytes inside of
freed 256-byte region [ffff88810fb02e00, ffff88810fb02f00)
The buggy address belongs to the physical page:
page:ffffea00043ec080 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fb02
head:ffffea00043ec080 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000840(slab|head|node=0|zone=2)
page_type: 0xffffffff()
raw: 0200000000000840 ffff888100041b40 ffffea00041ef600 0000000000000002
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5358, tgid 5358 (kworker/1:4), ts 131458586273, free_ts 131438325014
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x139c/0x3470 mm/page_alloc.c:3311
__alloc_pages+0x228/0x2250 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2190 [inline]
allocate_slab mm/slub.c:2354 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2407
___slab_alloc+0x4b0/0x1860 mm/slub.c:3540
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
kmalloc_trace+0x2ce/0x300 mm/slub.c:4007
kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]
pvr2_context_create+0x53/0x2a0 drivers/media/usb/pvrusb2/pvrusb2-context.c:207
pvr_probe+0x25/0xe0 drivers/media/usb/pvrusb2/pvrusb2-main.c:54
usb_probe_interface+0x307/0x930 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x234/0xc90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x4b0 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1d4/0x300 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1d0 drivers/base/bus.c:457
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
page last free pid 5341 tgid 5341 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x504/0xae0 mm/page_alloc.c:2346
free_unref_page+0x33/0x2d0 mm/page_alloc.c:2486
qlink_free mm/kasan/quarantine.c:160 [inline]
qlist_free_all+0x58/0x150 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x4a/0x70 mm/kasan/common.c:324
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3813 [inline]
slab_alloc_node mm/slub.c:3860 [inline]
kmem_cache_alloc+0x131/0x2e0 mm/slub.c:3867
getname_flags.part.0+0x50/0x4e0 fs/namei.c:140
getname_flags+0x9c/0xf0 include/linux/audit.h:322
vfs_fstatat+0x9a/0x140 fs/stat.c:303
__do_sys_newfstatat+0x98/0x110 fs/stat.c:468
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Memory state around the buggy address:
ffff88810fb02d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88810fb02e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88810fb02e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88810fb02f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88810fb02f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 4f5e5092 Merge tag 'net-6.8-rc5' of git://git.kernel.o..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=17133c1c180000
kernel config: https://syzkaller.appspot.com/x/.config?x=4f5e432f25b85a97
dashboard link: https://syzkaller.appspot.com/bug?extid=ce750e124675d4599449
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=12c58494180000
next prev parent reply other threads:[~2024-02-16 4:58 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <mailman.217.1706634262.2961.pvrusb2@isely.net>
2024-01-31 10:22 ` [syzbot] [pvrusb2?] KASAN: slab-use-after-free Read in pvr2_context_set_notify (2) syzbot
2024-02-16 0:42 ` Hillf Danton
2024-02-16 4:58 ` syzbot [this message]
2024-02-16 3:03 ` Edward Adam Davis
2024-02-16 5:09 ` syzbot
2024-02-16 7:30 ` [PATCH usb] media/pvrusb2: fix uaf in pvr2_context_set_notify Edward Adam Davis
2024-02-17 7:41 ` Greg KH
2024-02-18 6:22 ` Edward Adam Davis
2024-03-02 2:08 ` [PATCH usb V2] " Edward Adam Davis
2024-02-15 16:26 ` [syzbot] syzbot
2024-04-14 4:26 [syzbot] [pvrusb2?] [usb?] KASAN: slab-use-after-free Read in pvr2_context_set_notify (3) syzbot
2024-04-14 9:37 ` [syzbot] [pvrusb2?] KASAN: slab-use-after-free Read in pvr2_context_set_notify (2) Edward Adam Davis
2024-04-14 12:58 ` Edward Adam Davis
[not found] <CZ5SKT22SUPI.1CKVD5QORTT2B@getstate.dev>
2024-02-15 16:37 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2024-01-30 17:04 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000c43ecc06117896ab@google.com \
--to=syzbot+ce750e124675d4599449@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.