From: syzbot <syzbot+3de312463756f656b47d@syzkaller.appspotmail.com>
To: allison@lohutok.net, andreyknvl@google.com, cai@lca.pw,
gregkh@linuxfoundation.org, keescook@chromium.org,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tglx@linutronix.de
Subject: BUG: bad usercopy in hidraw_ioctl
Date: Wed, 07 Aug 2019 12:28:06 -0700 [thread overview]
Message-ID: <000000000000ce6527058f8bf0d0@google.com> (raw)
Hello,
syzbot found the following crash on:
HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=151b2926600000
kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
dashboard link: https://syzkaller.appspot.com/bug?extid=3de312463756f656b47d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3de312463756f656b47d@syzkaller.appspotmail.com
usercopy: Kernel memory exposure attempt detected from wrapped address
(offset 0, size 0)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:98!
invalid opcode: 0000 [#1] SMP KASAN
CPU: 1 PID: 2968 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:usercopy_abort+0xb9/0xbb mm/usercopy.c:98
Code: e8 c1 f7 d6 ff 49 89 d9 4d 89 e8 4c 89 e1 41 56 48 89 ee 48 c7 c7 e0
f3 cd 85 ff 74 24 08 41 57 48 8b 54 24 20 e8 15 98 c1 ff <0f> 0b e8 95 f7
d6 ff e8 80 9f fd ff 8b 54 24 04 49 89 d8 4c 89 e1
RSP: 0018:ffff8881b0f37be8 EFLAGS: 00010282
RAX: 000000000000005a RBX: ffffffff85cdf100 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8128a0fd RDI: ffffed10361e6f6f
RBP: ffffffff85cdf2c0 R08: 000000000000005a R09: ffffed103b665d58
R10: ffffed103b665d57 R11: ffff8881db32eabf R12: ffffffff85cdf460
R13: ffffffff85cdf100 R14: 0000000000000000 R15: ffffffff85cdf100
FS: 00007f539a2a9700(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000021237d0 CR3: 00000001d6ac6000 CR4: 00000000001406e0
Call Trace:
check_bogus_address mm/usercopy.c:151 [inline]
__check_object_size mm/usercopy.c:260 [inline]
__check_object_size.cold+0xb2/0xba mm/usercopy.c:250
check_object_size include/linux/thread_info.h:119 [inline]
check_copy_size include/linux/thread_info.h:150 [inline]
copy_to_user include/linux/uaccess.h:151 [inline]
hidraw_ioctl+0x38c/0xae0 drivers/hid/hidraw.c:392
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f539a2a8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829
RDX: 0000000020000800 RSI: 0000000090044802 RDI: 0000000000000004
RBP: 000000000075c268 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f539a2a96d4
R13: 00000000004c21f3 R14: 00000000004d55b8 R15: 00000000ffffffff
Modules linked in:
---[ end trace 24b9968555bf4653 ]---
RIP: 0010:usercopy_abort+0xb9/0xbb mm/usercopy.c:98
Code: e8 c1 f7 d6 ff 49 89 d9 4d 89 e8 4c 89 e1 41 56 48 89 ee 48 c7 c7 e0
f3 cd 85 ff 74 24 08 41 57 48 8b 54 24 20 e8 15 98 c1 ff <0f> 0b e8 95 f7
d6 ff e8 80 9f fd ff 8b 54 24 04 49 89 d8 4c 89 e1
RSP: 0018:ffff8881b0f37be8 EFLAGS: 00010282
RAX: 000000000000005a RBX: ffffffff85cdf100 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8128a0fd RDI: ffffed10361e6f6f
RBP: ffffffff85cdf2c0 R08: 000000000000005a R09: ffffed103b665d58
R10: ffffed103b665d57 R11: ffff8881db32eabf R12: ffffffff85cdf460
R13: ffffffff85cdf100 R14: 0000000000000000 R15: ffffffff85cdf100
FS: 00007f539a2a9700(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000021237d0 CR3: 00000001d6ac6000 CR4: 00000000001406e0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
next reply other threads:[~2019-08-07 19:28 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-07 19:28 syzbot [this message]
2019-08-07 19:58 ` BUG: bad usercopy in hidraw_ioctl Matthew Wilcox
2019-08-08 1:49 ` Al Viro
2019-08-08 20:41 ` Kees Cook
2019-08-08 20:27 ` Kees Cook
2019-08-21 17:00 ` Andrey Konovalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000ce6527058f8bf0d0@google.com \
--to=syzbot+3de312463756f656b47d@syzkaller.appspotmail.com \
--cc=allison@lohutok.net \
--cc=andreyknvl@google.com \
--cc=cai@lca.pw \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.