KASAN: use-after-free Read in v4l2_ctrl_grab

Status: upstream: reported C repro on 2019/04/11 02:10
Reported-by: syzbot+43f0de2c8739cdfafc97@syzkaller.appspotmail.com
First crash: 2690d, last: 1285d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Fix bisection attempts (12)
Created Duration User Patch Repo Result
2020/11/27 19:25 18m bisect fix linux-4.19.y error job log
2020/10/28 14:53 22m bisect fix linux-4.19.y OK (0) job log log
2020/09/28 14:29 24m bisect fix linux-4.19.y OK (0) job log log
2020/08/29 11:05 25m bisect fix linux-4.19.y OK (0) job log log
2020/07/29 16:06 26m bisect fix linux-4.19.y OK (0) job log log
2020/06/29 15:43 23m bisect fix linux-4.19.y OK (0) job log log
2020/05/30 15:19 24m bisect fix linux-4.19.y OK (0) job log log
2020/04/30 14:25 26m bisect fix linux-4.19.y OK (0) job log log
2020/03/31 14:01 23m bisect fix linux-4.19.y OK (0) job log log
2020/03/01 13:36 25m bisect fix linux-4.19.y OK (0) job log log
2020/01/31 13:09 26m bisect fix linux-4.19.y OK (0) job log log
2020/01/01 12:44 24m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in v4l2_ctrl_lock include/media/v4l2-ctrls.h:454 [inline]
BUG: KASAN: use-after-free in v4l2_ctrl_grab drivers/media/v4l2-core/v4l2-ctrls.c:2527 [inline]
BUG: KASAN: use-after-free in v4l2_ctrl_grab+0x150/0x160 drivers/media/v4l2-core/v4l2-ctrls.c:2520
Read of size 8 at addr ffff8880b24da660 by task syz-executor310/8107

CPU: 0 PID: 8107 Comm: syz-executor310 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
 v4l2_ctrl_lock include/media/v4l2-ctrls.h:454 [inline]
 v4l2_ctrl_grab drivers/media/v4l2-core/v4l2-ctrls.c:2527 [inline]
 v4l2_ctrl_grab+0x150/0x160 drivers/media/v4l2-core/v4l2-ctrls.c:2520
 vicodec_stop_streaming+0x14a/0x190 drivers/media/platform/vicodec/vicodec-core.c:1166
 __vb2_queue_cancel+0xae/0x790 drivers/media/common/videobuf2/videobuf2-core.c:1693
 vb2_core_queue_release+0x22/0x70 drivers/media/common/videobuf2/videobuf2-core.c:2082
 v4l2_m2m_ctx_release+0x26/0x30 drivers/media/v4l2-core/v4l2-mem2mem.c:928
 vicodec_release+0xb6/0x110 drivers/media/platform/vicodec/vicodec-core.c:1304
 v4l2_release+0xf4/0x190 drivers/media/v4l2-core/v4l2-dev.c:448
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f0ec122ee59
Code: Bad RIP value.
RSP: 002b:00007ffda3a8cfa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f0ec12a2270 RCX: 00007f0ec122ee59
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0ec12a2270
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001

Allocated by task 8107:
 __do_kmalloc_node mm/slab.c:3689 [inline]
 __kmalloc_node+0x4c/0x70 mm/slab.c:3696
 kmalloc_node include/linux/slab.h:557 [inline]
 kvmalloc_node+0x61/0xf0 mm/util.c:423
 kvmalloc include/linux/mm.h:577 [inline]
 kvzalloc include/linux/mm.h:585 [inline]
 v4l2_ctrl_new.part.0+0x22c/0x1400 drivers/media/v4l2-core/v4l2-ctrls.c:2176
 v4l2_ctrl_new drivers/media/v4l2-core/v4l2-ctrls.c:2109 [inline]
 v4l2_ctrl_new_std+0x211/0x330 drivers/media/v4l2-core/v4l2-ctrls.c:2293
 vicodec_open+0x1a6/0xad0 drivers/media/platform/vicodec/vicodec-core.c:1243
 v4l2_open+0x1af/0x350 drivers/media/v4l2-core/v4l2-dev.c:427
 chrdev_open+0x266/0x770 fs/char_dev.c:423
 do_dentry_open+0x4aa/0x1160 fs/open.c:796
 do_last fs/namei.c:3421 [inline]
 path_openat+0x793/0x2df0 fs/namei.c:3537
 do_filp_open+0x18c/0x3f0 fs/namei.c:3567
 do_sys_open+0x3b3/0x520 fs/open.c:1085
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 8107:
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 kvfree+0x59/0x60 mm/util.c:452
 v4l2_ctrl_handler_free drivers/media/v4l2-core/v4l2-ctrls.c:1930 [inline]
 v4l2_ctrl_handler_free+0x4a9/0x810 drivers/media/v4l2-core/v4l2-ctrls.c:1910
 vicodec_release+0x63/0x110 drivers/media/platform/vicodec/vicodec-core.c:1302
 v4l2_release+0xf4/0x190 drivers/media/v4l2-core/v4l2-dev.c:448
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880b24da640
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 32 bytes inside of
 256-byte region [ffff8880b24da640, ffff8880b24da740)
The buggy address belongs to the page:
page:ffffea0002c93680 count:1 mapcount:0 mapping:ffff88813bff07c0 index:0xffff8880b24dab40
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea0002841748 ffffea000262fb88 ffff88813bff07c0
raw: ffff8880b24dab40 ffff8880b24da000 0000000100000004 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880b24da500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880b24da580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
>ffff8880b24da600: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                                       ^
 ffff8880b24da680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880b24da700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================

Crashes (355):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/22 06:55 linux-4.19.y 3f8a27f9e27b 1c576c23 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in v4l2_ctrl_grab
2022/11/20 11:55 linux-4.19.y 3f8a27f9e27b 5bb70014 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in v4l2_ctrl_grab
2019/04/11 05:43 linux-4.19.y 4d552acf3370 e955ac50 .config console log report syz C ci2-linux-4-19
2023/02/13 14:54 linux-4.19.y 3f8a27f9e27b 957959cb .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in v4l2_ctrl_grab
2022/11/20 11:43 linux-4.19.y 3f8a27f9e27b 5bb70014 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in v4l2_ctrl_grab
2021/02/20 05:54 linux-4.19.y 255b58a2b3af f689d40a .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in v4l2_ctrl_grab
2019/12/02 12:43 linux-4.19.y 174651bdf802 f879db37 .config console log report ci2-linux-4-19
2019/11/26 10:52 linux-4.19.y 14260788bbb9 598ca6c8 .config console log report ci2-linux-4-19
2019/11/25 17:43 linux-4.19.y 14260788bbb9 598ca6c8 .config console log report ci2-linux-4-19
2019/11/20 17:10 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 22:28 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 21:28 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 16:10 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 16:09 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 12:15 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/18 18:25 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/18 02:08 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/17 23:08 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/17 18:53 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/16 17:37 linux-4.19.y c555efaf1402 cdac920b .config console log report ci2-linux-4-19
2019/11/16 17:31 linux-4.19.y c555efaf1402 cdac920b .config console log report ci2-linux-4-19
2019/11/16 07:24 linux-4.19.y c555efaf1402 cdac920b .config console log report ci2-linux-4-19
2019/11/01 16:14 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/11/01 14:44 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/11/01 09:05 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/10/28 19:06 linux-4.19.y c3038e718a19 439d7b14 .config console log report ci2-linux-4-19
2019/10/28 10:23 linux-4.19.y c3038e718a19 25bb509e .config console log report ci2-linux-4-19
2019/10/28 10:22 linux-4.19.y c3038e718a19 25bb509e .config console log report ci2-linux-4-19
2019/10/21 10:03 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/21 06:08 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/12 17:28 linux-4.19.y dafd634415a7 426631dd .config console log report ci2-linux-4-19
2019/10/06 11:18 linux-4.19.y 6cad9d0cf87b f3f7d9c8 .config console log report ci2-linux-4-19
2019/10/06 07:32 linux-4.19.y 6cad9d0cf87b f3f7d9c8 .config console log report ci2-linux-4-19
2019/10/03 07:03 linux-4.19.y 555161ee1b7a 2e29b534 .config console log report ci2-linux-4-19
2019/10/02 00:04 linux-4.19.y 555161ee1b7a b7a87a83 .config console log report ci2-linux-4-19
2019/09/30 09:17 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/30 00:39 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/24 05:05 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/24 03:01 linux-4.19.y d573e8a79f70 c68252d2 .config console log report ci2-linux-4-19
2019/09/22 02:27 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/21 08:24 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/21 08:19 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/15 09:14 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/10 18:26 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report ci2-linux-4-19
2019/09/09 14:44 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
2019/09/09 13:30 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
2019/09/07 01:43 linux-4.19.y 0fed55c248d9 acb5b744 .config console log report ci2-linux-4-19
2019/04/11 01:31 linux-4.19.y 4d552acf3370 65b612b7 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.