KMSAN: uninit-value in iowarrior_disconnect

Status: fixed on 2019/10/27 22:28
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+0761012cebf7bdb38137@syzkaller.appspotmail.com
Fix commit: bc0e4f16c44e USB: iowarrior: fix use-after-free on disconnect
First crash: 2520d, last: 2489d
▶ ▼ Discussions (10)
Title Replies (including bot) Last reply
[PATCH 4.19 00/81] 4.19.80-stable review 104 (104) 2020/09/24 13:54
[PATCH 3.16 00/72] 3.16.79-rc1 review 87 (87) 2019/12/14 18:44
KMSAN: uninit-value in iowarrior_disconnect 1 (2) 2019/11/19 14:50
[PATCH 5.3 000/112] 5.3.7-stable review 130 (130) 2019/10/18 10:12
[PATCH 4.14 00/65] 4.14.150-stable review 73 (73) 2019/10/18 09:59
[PATCH 4.9 00/92] 4.9.197-stable review 98 (98) 2019/10/18 07:56
[PATCH 4.4 00/79] 4.4.197-stable review 86 (86) 2019/10/18 07:55
[PATCH 0/6] USB: iowarrior: disconnect fixes and locking cleanups 8 (8) 2019/10/10 10:45
[PATCH] usb: iowarrior: fix access to freed data structure 2 (2) 2019/10/09 07:36
Reminder: 67 active syzbot reports in usb subsystem 1 (1) 2019/10/04 03:38

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __mutex_lock_slowpath+0x2c/0x30 kernel/locking/mutex.c:1364
CPU: 0 PID: 11323 Comm: kworker/0:4 Not tainted 5.4.0-rc2+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x153/0x2c0 mm/kmsan/kmsan_report.c:113
 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250
 mutex_can_spin_on_owner kernel/locking/mutex.c:605 [inline]
 mutex_optimistic_spin kernel/locking/mutex.c:649 [inline]
 __mutex_lock_common kernel/locking/mutex.c:959 [inline]
 __mutex_lock+0x6a3/0x19c0 kernel/locking/mutex.c:1103
 __mutex_lock_slowpath+0x2c/0x30 kernel/locking/mutex.c:1364
 mutex_lock+0x5d/0x80 kernel/locking/mutex.c:284
 iowarrior_disconnect+0x133/0x3e0 drivers/usb/misc/iowarrior.c:878
 usb_unbind_interface+0x3a2/0xdd0 drivers/usb/core/driver.c:423
 __device_release_driver drivers/base/dd.c:1134 [inline]
 device_release_driver_internal+0x96f/0xd80 drivers/base/dd.c:1165
 device_release_driver+0x4b/0x60 drivers/base/dd.c:1188
 bus_remove_device+0x4bf/0x670 drivers/base/bus.c:532
 device_del+0xcd5/0x1cb0 drivers/base/core.c:2375
 usb_disable_device+0x567/0x1150 drivers/usb/core/message.c:1241
 usb_disconnect+0x51e/0xd60 drivers/usb/core/hub.c:2199
 hub_port_connect drivers/usb/core/hub.c:4949 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
 port_event drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x3fd0/0x72f0 drivers/usb/core/hub.c:5441
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
 kmsan_save_stack_with_flags+0x3f/0x90 mm/kmsan/kmsan.c:154
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:364 [inline]
 kmsan_alloc_page+0x153/0x360 mm/kmsan/kmsan_shadow.c:400
 __alloc_pages_nodemask+0x149d/0x60c0 mm/page_alloc.c:4788
 alloc_pages_current+0x68d/0x9a0 mm/mempolicy.c:2188
 alloc_pages include/linux/gfp.h:511 [inline]
 alloc_slab_page+0x10e/0x12c0 mm/slub.c:1536
 allocate_slab mm/slub.c:1681 [inline]
 new_slab+0x2ca/0x1990 mm/slub.c:1747
 new_slab_objects mm/slub.c:2498 [inline]
 ___slab_alloc+0x1423/0x1fb0 mm/slub.c:2649
 __slab_alloc mm/slub.c:2689 [inline]
 slab_alloc_node mm/slub.c:2752 [inline]
 slab_alloc mm/slub.c:2801 [inline]
 kmem_cache_alloc_trace+0xae5/0xd20 mm/slub.c:2818
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:686 [inline]
 device_private_init drivers/base/core.c:2061 [inline]
 device_add+0x147/0x2df0 drivers/base/core.c:2111
 device_create_groups_vargs drivers/base/core.c:2845 [inline]
 device_create_vargs+0x4dc/0x560 drivers/base/core.c:2885
 device_create+0x294/0x2e0 drivers/base/core.c:2921
 usb_register_dev+0x76c/0xb20 drivers/usb/core/file.c:203
 iowarrior_probe+0x1712/0x1a50 drivers/usb/misc/iowarrior.c:835
 usb_probe_interface+0xd19/0x1310 drivers/usb/core/driver.c:361
 really_probe+0xd91/0x1f90 drivers/base/dd.c:552
 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
 __device_attach+0x489/0x750 drivers/base/dd.c:894
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
 bus_probe_device+0x131/0x390 drivers/base/bus.c:490
 device_add+0x25b5/0x2df0 drivers/base/core.c:2201
 usb_set_configuration+0x309f/0x3710 drivers/usb/core/message.c:2027
 generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210
 usb_probe_device+0x146/0x200 drivers/usb/core/driver.c:266
 really_probe+0xd91/0x1f90 drivers/base/dd.c:552
 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
 __device_attach+0x489/0x750 drivers/base/dd.c:894
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
 bus_probe_device+0x131/0x390 drivers/base/bus.c:490
 device_add+0x25b5/0x2df0 drivers/base/core.c:2201
 usb_new_device+0x23e5/0x2fb0 drivers/usb/core/hub.c:2536
 hub_port_connect drivers/usb/core/hub.c:5098 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
 port_event drivers/usb/core/hub.c:5359 [inline]
 hub_event+0x581d/0x72f0 drivers/usb/core/hub.c:5441
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
=====================================================

Crashes (18):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/10 06:06 https://github.com/google/kmsan.git master dc327ecad3b0 c4b9981b .config console log report syz C ci-upstream-kmsan-gce
2019/10/07 03:33 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report syz C ci-upstream-kmsan-gce
2019/10/06 11:36 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report syz C ci-upstream-kmsan-gce
2019/10/04 09:46 https://github.com/google/kmsan.git master 1e76a3e537c3 fc17ba49 .config console log report syz C ci-upstream-kmsan-gce
2019/09/30 09:20 https://github.com/google/kmsan.git master 124037e07586 c1ad5441 .config console log report syz C ci-upstream-kmsan-gce
2019/09/25 08:16 https://github.com/google/kmsan.git master cebbfdbcf2b7 e38a6630 .config console log report syz C ci-upstream-kmsan-gce
2019/09/21 14:56 https://github.com/google/kmsan.git master cebbfdbcf2b7 d96e88f3 .config console log report syz C ci-upstream-kmsan-gce
2019/09/21 07:43 https://github.com/google/kmsan.git master cebbfdbcf2b7 d96e88f3 .config console log report syz C ci-upstream-kmsan-gce
2019/09/09 10:10 https://github.com/google/kmsan.git master 014077b5cd62 a60cb4cd .config console log report syz C ci-upstream-kmsan-gce
2019/10/06 22:34 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report ci-upstream-kmsan-gce
2019/10/06 16:06 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report ci-upstream-kmsan-gce
2019/10/06 09:24 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report ci-upstream-kmsan-gce
2019/10/05 02:29 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report ci-upstream-kmsan-gce
2019/10/05 00:42 https://github.com/google/kmsan.git master 1e76a3e537c3 f3f7d9c8 .config console log report ci-upstream-kmsan-gce
2019/10/02 12:54 https://github.com/google/kmsan.git master 1e76a3e537c3 2e29b534 .config console log report ci-upstream-kmsan-gce
2019/09/29 23:29 https://github.com/google/kmsan.git master 124037e07586 c1ad5441 .config console log report ci-upstream-kmsan-gce
2019/09/29 05:44 https://github.com/google/kmsan.git master 124037e07586 eb6b9855 .config console log report ci-upstream-kmsan-gce
2019/09/28 12:03 https://github.com/google/kmsan.git master 124037e07586 d8074e0b .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.