From: syzbot <syzbot+9a48339b077c5a80b869@syzkaller.appspotmail.com>
To: andreyknvl@google.com, laurent.pinchart@ideasonboard.com,
linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
linux-usb@vger.kernel.org, mchehab@kernel.org, oneukum@suse.de,
syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in uvc_probe
Date: Mon, 10 Feb 2020 07:51:01 -0800 [thread overview]
Message-ID: <000000000000c6fdac059e3ab4c6@google.com> (raw)
In-Reply-To: <1581344006.26936.7.camel@suse.de>
Hello,
syzbot has tested the proposed patch but the reproducer still triggered crash:
KASAN: use-after-free Read in uvc_probe
usb 2-1: string descriptor 0 read error: -71
uvcvideo: Found UVC 0.00 device <unnamed> (0bd3:0555)
==================================================================
BUG: KASAN: use-after-free in uvc_register_terms drivers/media/usb/uvc/uvc_driver.c:2038 [inline]
BUG: KASAN: use-after-free in uvc_register_chains drivers/media/usb/uvc/uvc_driver.c:2071 [inline]
BUG: KASAN: use-after-free in uvc_probe.cold+0x2193/0x29fe drivers/media/usb/uvc/uvc_driver.c:2202
Read of size 2 at addr ffff8881d933182e by task kworker/0:2/95
CPU: 0 PID: 95 Comm: kworker/0:2 Not tainted 5.5.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xef/0x16e lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:374
__kasan_report.cold+0x37/0x85 mm/kasan/report.c:506
kasan_report+0xe/0x20 mm/kasan/common.c:639
uvc_register_terms drivers/media/usb/uvc/uvc_driver.c:2038 [inline]
uvc_register_chains drivers/media/usb/uvc/uvc_driver.c:2071 [inline]
uvc_probe.cold+0x2193/0x29fe drivers/media/usb/uvc/uvc_driver.c:2202
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:361
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_set_configuration+0xe47/0x17d0 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0xaf/0x140 drivers/usb/core/driver.c:266
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2537
hub_port_connect drivers/usb/core/hub.c:5184 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5324 [inline]
port_event drivers/usb/core/hub.c:5470 [inline]
hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5552
process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 95:
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:486
kmalloc include/linux/slab.h:556 [inline]
kzalloc include/linux/slab.h:670 [inline]
uvc_alloc_chain+0x48/0xfa drivers/media/usb/uvc/uvc_driver.c:1692
uvc_scan_device drivers/media/usb/uvc/uvc_driver.c:1818 [inline]
uvc_probe.cold+0x15f0/0x29fe drivers/media/usb/uvc/uvc_driver.c:2198
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:361
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_set_configuration+0xe47/0x17d0 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0xaf/0x140 drivers/usb/core/driver.c:266
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2537
hub_port_connect drivers/usb/core/hub.c:5184 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5324 [inline]
port_event drivers/usb/core/hub.c:5470 [inline]
hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5552
process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 95:
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x117/0x160 mm/kasan/common.c:474
slab_free_hook mm/slub.c:1425 [inline]
slab_free_freelist_hook mm/slub.c:1458 [inline]
slab_free mm/slub.c:3005 [inline]
kfree+0xd5/0x300 mm/slub.c:3957
uvc_scan_device drivers/media/usb/uvc/uvc_driver.c:1825 [inline]
uvc_probe.cold+0x16fd/0x29fe drivers/media/usb/uvc/uvc_driver.c:2198
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:361
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_set_configuration+0xe47/0x17d0 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0xaf/0x140 drivers/usb/core/driver.c:266
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2537
hub_port_connect drivers/usb/core/hub.c:5184 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5324 [inline]
port_event drivers/usb/core/hub.c:5470 [inline]
hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5552
process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881d9331800
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 46 bytes inside of
256-byte region [ffff8881d9331800, ffff8881d9331900)
The buggy address belongs to the page:
page:ffffea000764cc00 refcount:1 mapcount:0 mapping:ffff8881da002780 index:0x0 compound_mapcount: 0
raw: 0200000000010200 ffffea0007648d80 0000000e0000000e ffff8881da002780
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d9331700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881d9331780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881d9331800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d9331880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d9331900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: ae179410 usb: gadget: add raw-gadget interface
git tree: https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13d466e9e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad1d751a3a72ae57
dashboard link: https://syzkaller.appspot.com/bug?extid=9a48339b077c5a80b869
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=16022395e00000
next prev parent reply other threads:[~2020-02-10 15:51 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-13 12:24 KASAN: use-after-free Read in uvc_probe syzbot
2020-02-10 14:13 ` Oliver Neukum
2020-02-10 14:18 ` Laurent Pinchart
2020-02-11 14:31 ` Oliver Neukum
2020-02-11 15:38 ` Laurent Pinchart
2020-02-12 13:58 ` Oliver Neukum
2020-02-10 15:51 ` syzbot [this message]
2020-06-19 16:10 ` Andrey Konovalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000c6fdac059e3ab4c6@google.com \
--to=syzbot+9a48339b077c5a80b869@syzkaller.appspotmail.com \
--cc=andreyknvl@google.com \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=oneukum@suse.de \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.