KASAN: global-out-of-bounds Read in precalculate_color

Status: fixed on 2020/11/16 12:12
Subsystems: media
[Documentation on labels]
Reported-by: syzbot+02d9172bf4c43104cd70@syzkaller.appspotmail.com
Fix commit: e3158a5e7e66 media: vivid: Fix global-out-of-bounds read in precalculate_color()
First crash: 2435d, last: 2142d
Cause bisection: introduced by (bisect log) :
commit 7594bf37ae9ffc434da425120c576909eb33b0bc
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Mon Jul 17 02:53:08 2017 +0000

  9p: untangle ->poll() mess

Crash: no output from test machine (log)
Repro: syz .config
  
Fix bisection: fixed by (bisect log) :
commit dfd402a4c4baae42398ce9180ff424d589b8bffc
Author: Marco Elver <elver@google.com>
Date: Thu Nov 14 18:02:54 2019 +0000

  kcsan: Add Kernel Concurrency Sanitizer infrastructure

  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH 5.9 000/757] 5.9.2-rc1 review 766 (766) 2020/10/30 08:32
[PATCH 5.8 000/633] 5.8.17-rc1 review 638 (638) 2020/10/28 22:08
[Linux-kernel-mentees] [PATCH] v4l2-tpg: Fix global-out-of-bounds read in precalculate_color() 7 (7) 2020/08/21 12:46
KASAN: global-out-of-bounds Read in precalculate_color 0 (4) 2020/08/12 01:07
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2020/08/21 11:01 16m yepeilin.cs@gmail.com patch upstream OK
2020/08/09 22:55 16m yepeilin.cs@gmail.com patch upstream OK
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2020/08/11 19:09 5h56m bisect fix upstream OK (1) job log
2020/04/08 20:25 19m bisect fix upstream OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: global-out-of-bounds in precalculate_color+0x2154/0x2480 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:942
Read of size 1 at addr ffffffff88b3d3f9 by task vivid-000-vid-c/10205

CPU: 0 PID: 10205 Comm: vivid-000-vid-c Not tainted 5.5.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:639
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 precalculate_color+0x2154/0x2480 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:942
 tpg_precalculate_colors drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:1093 [inline]
 tpg_recalc+0x561/0x2850 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2118
 tpg_calc_text_basep+0xa1/0x290 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2136
 vivid_fillbuff+0x1a5f/0x3af0 drivers/media/platform/vivid/vivid-kthread-cap.c:466
 vivid_thread_vid_cap_tick+0x8cf/0x2210 drivers/media/platform/vivid/vivid-kthread-cap.c:727
 vivid_thread_vid_cap+0x5d8/0xa60 drivers/media/platform/vivid/vivid-kthread-cap.c:866
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the variable:
 kbd_keycodes+0x119/0x760

Memory state around the buggy address:
 ffffffff88b3d280: fa fa fa fa 00 00 04 fa fa fa fa fa 00 00 00 00
 ffffffff88b3d300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff88b3d380: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
                                                                ^
 ffffffff88b3d400: 00 00 00 00 07 fa fa fa fa fa fa fa 00 00 00 00
 ffffffff88b3d480: 00 fa fa fa fa fa fa fa 02 fa fa fa fa fa fa fa
==================================================================

Crashes (170):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/26 19:46 upstream 46cf053efec6 be5c2c81 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/26 19:29 upstream 46cf053efec6 be5c2c81 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/26 18:59 upstream 46cf053efec6 be5c2c81 .config console log report syz C ci-upstream-kasan-gce
2019/12/26 19:37 upstream 46cf053efec6 be5c2c81 .config console log report syz C ci-upstream-kasan-gce-386
2020/01/02 13:26 linux-next 7ddd09fc4b74 25a0186e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/11/28 09:58 upstream d76886972823 0d63f89c .config console log report syz ci-upstream-kasan-gce-root
2019/12/12 21:18 linux-next 78adcacd4edb 08003f64 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/09/16 19:07 upstream fc4f28bb3daf 18d7d030 .config console log report info ci-upstream-kasan-gce
2020/09/16 05:43 upstream fc4f28bb3daf 18d7d030 .config console log report info ci-upstream-kasan-gce
2020/09/15 21:37 upstream fc4f28bb3daf 6989d6f6 .config console log report info ci-upstream-kasan-gce
2020/09/14 01:51 upstream e4c26faa426c 2d3cdd63 .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/13 02:47 upstream 729e3d091984 ce441f06 .config console log report ci-upstream-kasan-gce
2020/09/12 15:05 upstream 729e3d091984 ce441f06 .config console log report ci-upstream-kasan-gce
2020/09/12 13:19 upstream 729e3d091984 79fb24e2 .config console log report ci-upstream-kasan-gce
2020/09/11 20:55 upstream e8878ab82545 79fb24e2 .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/11 07:34 upstream 581cb3a26baf adfb8b4e .config console log report ci-upstream-kasan-gce-root
2020/09/10 12:12 upstream 34d4ddd359db 409809d8 .config console log report ci-upstream-kasan-gce-root
2020/09/08 14:57 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce
2020/09/08 10:28 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/07 17:01 upstream a8205e310011 abf9ba4f .config console log report ci-upstream-kasan-gce
2020/09/05 06:50 upstream c70672d8d316 abf9ba4f .config console log report ci-upstream-kasan-gce-root
2020/09/04 16:53 upstream 59126901f200 abf9ba4f .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/04 01:40 upstream e28f0104343d abf9ba4f .config console log report ci-upstream-kasan-gce
2020/09/03 23:15 upstream e28f0104343d abf9ba4f .config console log report ci-upstream-kasan-gce-root
2020/09/02 14:59 upstream 9c7d619be5a0 abf9ba4f .config console log report ci-upstream-kasan-gce-root
2020/09/01 10:42 upstream b51594df17d0 d5a3ae1f .config console log report ci-upstream-kasan-gce
2020/09/01 08:41 upstream b51594df17d0 d5a3ae1f .config console log report ci-upstream-kasan-gce-root
2020/08/31 20:02 upstream f75aef392f86 d5a3ae1f .config console log report ci-upstream-kasan-gce
2020/08/29 13:07 upstream 4d41ead6ead9 d5a3ae1f .config console log report ci-upstream-kasan-gce-root
2020/08/28 23:39 upstream 96d454cd2c16 d5a3ae1f .config console log report ci-upstream-kasan-gce-root
2020/08/27 18:12 upstream 15bc20c6af4c 816e0689 .config console log report ci-upstream-kasan-gce
2020/08/27 02:43 upstream 15bc20c6af4c 318430cb .config console log report ci-upstream-kasan-gce-root
2020/08/25 09:31 upstream 6a9dc5fd6170 344da168 .config console log report ci-upstream-kasan-gce-root
2020/08/23 14:21 upstream c3d8f220d012 cef5ae68 .config console log report ci-upstream-kasan-gce
2020/08/23 13:10 upstream c3d8f220d012 cef5ae68 .config console log report ci-upstream-kasan-gce
2020/08/22 22:11 upstream c3d8f220d012 1da71ab0 .config console log report ci-upstream-kasan-gce
2020/08/22 11:12 upstream f873db9acd3c 6436ce4b .config console log report ci-upstream-kasan-gce
2020/08/20 04:10 upstream 18445bf405cb ed282a3a .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/12 18:59 upstream 0aea6d5c5be3 115e1930 .config console log report ci-upstream-kasan-gce
2020/07/08 19:26 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/08 18:21 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/08 15:24 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/08 09:48 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/08 08:24 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/08 07:10 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/08 02:07 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 21:12 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 20:02 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 19:01 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 17:46 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 14:52 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 12:58 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/07/07 08:50 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce
2020/09/10 10:56 upstream 34d4ddd359db 409809d8 .config console log report ci-upstream-kasan-gce-386
2020/09/09 15:09 upstream 34d4ddd359db 0ea7a887 .config console log report ci-upstream-kasan-gce-386
2020/09/08 18:21 upstream f4d51dffc6c0 abf9ba4f .config console log report ci-upstream-kasan-gce-386
2020/08/29 11:30 upstream 4d41ead6ead9 d5a3ae1f .config console log report ci-qemu-upstream-386
2020/08/27 22:56 upstream 15bc20c6af4c 816e0689 .config console log report ci-upstream-kasan-gce-386
2020/08/22 13:10 upstream f873db9acd3c 6436ce4b .config console log report ci-upstream-kasan-gce-386
2020/08/25 13:02 linux-next 3a00d3dfd4b6 344da168 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/08/25 01:55 linux-next d8be0e12a522 344da168 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.