From: Kalle Valo <kvalo@codeaurora.org>
To: Andrey Konovalov <andreyknvl@google.com>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>,
Prameela Rani Garnepudi <prameela.j04cs@gmail.com>,
Karun Eagalapati <karun256@gmail.com>,
linux-wireless@vger.kernel.org, netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>,
Kostya Serebryany <kcc@google.com>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: usb/wireless/rsi_91x: use-after-free write in __run_timers
Date: Mon, 25 Sep 2017 07:26:43 +0300 [thread overview]
Message-ID: <87lgl3769o.fsf@kamboji.qca.qualcomm.com> (raw)
In-Reply-To: <CAAeHK+wXCaLZ8=enfsmjg-+FJsW1UhSCz8GUmSWhFxB4orLQ6w@mail.gmail.com> (Andrey Konovalov's message of "Fri, 22 Sep 2017 19:04:27 +0200")
Andrey Konovalov <andreyknvl@google.com> writes:
> I've got the following report while fuzzing the kernel with syzkaller.
>
> On commit 6e80ecdddf4ea6f3cd84e83720f3d852e6624a68 (Sep 21).
>
> ==================================================================
> BUG: KASAN: use-after-free in __run_timers+0xc0e/0xd40
> Write of size 8 at addr ffff880069f701b8 by task swapper/0/0
>
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.0-rc1-42311-g6e80ecdddf4e #234
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[...]
> Allocated by task 1845:
> save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
> save_stack+0x43/0xd0 mm/kasan/kasan.c:447
> set_track mm/kasan/kasan.c:459
> kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
> kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772
> kmalloc ./include/linux/slab.h:493
> kzalloc ./include/linux/slab.h:666
> rsi_91x_init+0x98/0x510 drivers/net/wireless/rsi/rsi_91x_main.c:203
> rsi_probe+0xb6/0x13b0 drivers/net/wireless/rsi/rsi_91x_usb.c:665
> usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
I'm curious about your setup. Apparently you are running syzkaller on
QEMU but what I don't understand is how the rsi device comes into the
picture. Did you have a rsi usb device connected to the virtual machine
or what? Or does syzkaller do some kind of magic here?
--
Kalle Valo
next prev parent reply other threads:[~2017-09-25 4:26 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-22 17:04 usb/wireless/rsi_91x: use-after-free write in __run_timers Andrey Konovalov
2017-09-25 4:26 ` Kalle Valo [this message]
2017-09-25 11:20 ` Andrey Konovalov
2017-09-25 12:26 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87lgl3769o.fsf@kamboji.qca.qualcomm.com \
--to=kvalo@codeaurora.org \
--cc=amit.karwar@redpinesignals.com \
--cc=andreyknvl@google.com \
--cc=dvyukov@google.com \
--cc=karun256@gmail.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=prameela.j04cs@gmail.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox