syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status (2)

Status: upstream: reported C repro on 2021/04/14 12:03
Reported-by: syzbot+88471b70b068a105c1f8@syzkaller.appspotmail.com
First crash: 1101d, last: 414d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status 7 1067d 1200d 0/1 auto-closed as invalid on 2021/09/14 14:45
linux-4.19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status 2 1323d 1325d 0/1 auto-closed as invalid on 2021/01/02 08:21
linux-4.14 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status (2) 1 850d 850d 0/1 auto-closed as invalid on 2022/04/19 20:25
upstream KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status usb 3 1689d 1695d 0/26 auto-closed as invalid on 2020/01/01 21:24
upstream KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status (2) usb C inconclusive 116 836d 1319d 20/26 fixed on 2022/03/08 16:11

Sample crash report:
vhci_hcd: connection closed
usb usb9: usbfs: process 21590 (syz-executor154) did not claim interface 0 before use
vhci_hcd vhci_hcd.0: port 2 already used
==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]
BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x387/0x6f0 drivers/usb/core/hcd.c:771
Write of size 2 at addr ffff8880a5e5ff40 by task syz-executor154/21590

CPU: 1 PID: 21590 Comm: syz-executor154 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
 kasan_report+0x8f/0xa0 mm/kasan/report.c:412
 memcpy+0x35/0x50 mm/kasan/kasan.c:303
 memcpy include/linux/string.h:377 [inline]
 usb_hcd_poll_rh_status+0x387/0x6f0 drivers/usb/core/hcd.c:771
 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1696 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
Code: 48 c7 c0 88 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d 7c 31 d8 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 fb eb e6 f8 eb c0 0f 0b 0f 0b 48 c7 c7 88
RSP: 0018:ffff8880924d79d0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3051 RBX: 0000000000000286 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffffffff8d4469c8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dead000000000200
R13: ffff888089e00000 R14: 0000000000000000 R15: dffffc0000000000
 __debug_check_no_obj_freed lib/debugobjects.c:798 [inline]
 debug_check_no_obj_freed+0x201/0x490 lib/debugobjects.c:817
 free_pages_prepare mm/page_alloc.c:1056 [inline]
 __free_pages_ok+0x22d/0xd30 mm/page_alloc.c:1279
 release_pages+0xab5/0x15a0 mm/swap.c:768
 tlb_flush_mmu_free mm/memory.c:261 [inline]
 tlb_flush_mmu+0x1dc/0x4f0 mm/memory.c:270
 arch_tlb_finish_mmu mm/memory.c:285 [inline]
 tlb_finish_mmu+0x108/0x200 mm/memory.c:444
 exit_mmap+0x2d9/0x530 mm/mmap.c:3095
 __mmput kernel/fork.c:1016 [inline]
 mmput+0x14e/0x4a0 kernel/fork.c:1037
 exit_mm kernel/exit.c:549 [inline]
 do_exit+0xaec/0x2be0 kernel/exit.c:857
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f3d2d3687f9
Code: Bad RIP value.
RSP: 002b:00007ffed7dd72a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f3d2d3df3f0 RCX: 00007f3d2d3687f9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 000000000000ffff R11: 0000000000000246 R12: 00007f3d2d3df3f0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001

Allocated by task 21590:
 __do_kmalloc mm/slab.c:3727 [inline]
 __kmalloc+0x15a/0x3c0 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 proc_do_submiturb+0x2d17/0x3b00 drivers/usb/core/devio.c:1673
 proc_submiturb drivers/usb/core/devio.c:1827 [inline]
 usbdev_do_ioctl+0x773/0x3030 drivers/usb/core/devio.c:2481
 usbdev_ioctl+0x21/0x30 drivers/usb/core/devio.c:2585
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 20295:
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 security_sk_free+0x3e/0x70 security/security.c:1474
 sk_prot_free net/core/sock.c:1516 [inline]
 __sk_destruct+0x51d/0x8a0 net/core/sock.c:1602
 sk_destruct net/core/sock.c:1617 [inline]
 __sk_free+0x165/0x3b0 net/core/sock.c:1628
 sk_free+0x3b/0x50 net/core/sock.c:1639
 sock_put include/net/sock.h:1713 [inline]
 unix_release_sock+0x87a/0xd60 net/unix/af_unix.c:582
 unix_release+0x3f/0x80 net/unix/af_unix.c:878
 __sock_release+0xcd/0x2a0 net/socket.c:599
 sock_close+0x15/0x20 net/socket.c:1214
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880a5e5ff40
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
 32-byte region [ffff8880a5e5ff40, ffff8880a5e5ff60)
The buggy address belongs to the page:
page:ffffea00029797c0 count:1 mapcount:0 mapping:ffff88813bff01c0 index:0xffff8880a5e5ffc1
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea0002ad5348 ffffea0002ae1f48 ffff88813bff01c0
raw: ffff8880a5e5ffc1 ffff8880a5e5f000 000000010000003f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a5e5fe00: 07 fc fc fc fc fc fc fc 00 00 01 fc fc fc fc fc
 ffff8880a5e5fe80: 00 00 01 fc fc fc fc fc 00 00 03 fc fc fc fc fc
>ffff8880a5e5ff00: fb fb fb fb fc fc fc fc 01 fc fc fc fc fc fc fc
                                           ^
 ffff8880a5e5ff80: 00 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a5e60000: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	48 c7 c0 88 82 f1 89 	mov    $0xffffffff89f18288,%rax
   7:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   e:	fc ff df
  11:	48 c1 e8 03          	shr    $0x3,%rax
  15:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1)
  19:	75 2f                	jne    0x4a
  1b:	48 83 3d 7c 31 d8 01 	cmpq   $0x0,0x1d8317c(%rip)        # 0x1d8319f
  22:	00
  23:	74 15                	je     0x3a
  25:	48 89 df             	mov    %rbx,%rdi
  28:	57                   	push   %rdi
  29:	9d                   	popfq
* 2a:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1) <-- trapping instruction
  2f:	eb b2                	jmp    0xffffffe3
  31:	e8 fb eb e6 f8       	callq  0xf8e6ec31
  36:	eb c0                	jmp    0xfffffff8
  38:	0f 0b                	ud2
  3a:	0f 0b                	ud2
  3c:	48                   	rex.W
  3d:	c7                   	.byte 0xc7
  3e:	c7                   	(bad)
  3f:	88                   	.byte 0x88

Crashes (50):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/06/11 23:57 linux-4.19.y 3f8a27f9e27b 0d5abf15 .config console log report syz C ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2023/03/02 01:43 linux-4.19.y 3f8a27f9e27b f8902b57 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/11/11 08:11 linux-4.19.y 3f8a27f9e27b f42ee5d8 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/07/16 14:57 linux-4.19.y 3f8a27f9e27b 95cb00d1 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/07/06 05:14 linux-4.19.y 3f8a27f9e27b bff65f44 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/06/24 21:24 linux-4.19.y 3f8a27f9e27b a371c43c .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/06/22 18:44 linux-4.19.y 3f8a27f9e27b 912f5df7 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/06/11 22:16 linux-4.19.y 3f8a27f9e27b 0d5abf15 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/04/28 17:56 linux-4.19.y 3f8a27f9e27b e9076525 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/04/07 21:08 linux-4.19.y 3f8a27f9e27b 53c67432 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/31 07:36 linux-4.19.y 3f8a27f9e27b 9d49f3a7 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/27 15:17 linux-4.19.y 3f8a27f9e27b 89bc8608 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/26 18:57 linux-4.19.y 3f8a27f9e27b 89bc8608 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/18 01:44 linux-4.19.y 3f8a27f9e27b e2d91b1d .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/10 15:29 linux-4.19.y 3f8a27f9e27b 9e8eaa75 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/08 08:48 linux-4.19.y 3f8a27f9e27b 7bdd8b2c .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/03/07 10:52 linux-4.19.y 3f8a27f9e27b 7bdd8b2c .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/02/23 11:56 linux-4.19.y 3f8a27f9e27b 6e821dbf .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/02/21 02:11 linux-4.19.y 3f8a27f9e27b 3cd800e4 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/02/02 08:48 linux-4.19.y 3f8a27f9e27b 4ebb2798 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/02/02 00:37 linux-4.19.y 3f8a27f9e27b 4ebb2798 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/02/01 23:14 linux-4.19.y 3f8a27f9e27b 4ebb2798 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/01/31 09:19 linux-4.19.y 3f8a27f9e27b a491ad2d .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/01/30 04:54 linux-4.19.y 3f8a27f9e27b 495e00c5 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2022/01/28 21:52 linux-4.19.y 3f8a27f9e27b 495e00c5 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/12/13 22:10 linux-4.19.y 3f8a27f9e27b 0304899b .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/24 06:53 linux-4.19.y 3f8a27f9e27b 545ab074 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/21 22:59 linux-4.19.y 3f8a27f9e27b 4eb20a4e .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/17 13:09 linux-4.19.y 3f8a27f9e27b cafff8b6 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/07 16:26 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/07 11:15 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/07 08:39 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/07 03:03 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/06 16:01 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/06 12:23 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/06 05:37 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/06 03:59 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/05 19:11 linux-4.19.y 3f8a27f9e27b 4c1be0be .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/11/02 00:58 linux-4.19.y 3f8a27f9e27b 098b5d53 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/09/29 18:03 linux-4.19.y c2276d585654 e08fe937 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/09/28 03:47 linux-4.19.y c2276d585654 78494d16 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/09/26 04:04 linux-4.19.y 2950c9c5e0df 8cac236e .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/08/23 15:21 linux-4.19.y 59456c9cc40c b599f2fc .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/07/26 22:55 linux-4.19.y 4938296e03bd fd511809 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/07/21 03:59 linux-4.19.y 4938296e03bd 1b201b48 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/07/06 12:20 linux-4.19.y 9f84340f012e 6c4484eb .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/05/31 22:03 linux-4.19.y 6b7b0056defc 032639db .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/04/21 09:05 linux-4.19.y 2965db2e004c 95777977 .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/04/14 23:33 linux-4.19.y 0f1b4cb77d7f fcdb12ba .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
2021/04/14 12:02 linux-4.19.y 0f1b4cb77d7f 3134b37f .config console log report info ci2-linux-4-19 KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status
* Struck through repros no longer work on HEAD.