syzbot


KASAN: use-after-free Read in __usb_hcd_giveback_urb

Status: upstream: reported on 2024/04/06 03:35
Reported-by: syzbot+94936196e16d5ad44ed6@syzkaller.appspotmail.com
First crash: 46d, last: 30d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: use-after-free Read in __usb_hcd_giveback_urb 11 9h45m 193d 0/3 upstream: reported on 2023/11/11 02:11
upstream KASAN: use-after-free Read in __usb_hcd_giveback_urb (2) usb 1 537d 532d 0/26 auto-obsoleted due to no activity on 2023/03/31 19:51
upstream KASAN: use-after-free Read in __usb_hcd_giveback_urb usb 1 1385d 1384d 0/26 auto-closed as invalid on 2020/12/04 05:52
upstream KASAN: slab-use-after-free Read in __usb_hcd_giveback_urb usb 1 276d 274d 0/26 auto-obsoleted due to no activity on 2023/11/28 05:12
upstream KASAN: slab-use-after-free Read in __usb_hcd_giveback_urb (2) usb 81 14h50m 60d 0/26 upstream: reported on 2024/03/22 17:26

Sample crash report:
xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock+0x290/0x370 kernel/locking/spinlock_debug.c:114
Read of size 4 at addr ffff88801fb8d85c by task syz-executor.3/7799

CPU: 1 PID: 7799 Comm: syz-executor.3 Not tainted 6.1.87-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15f/0x4f0 mm/kasan/report.c:395
 kasan_report+0x136/0x160 mm/kasan/report.c:495
 debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
 do_raw_spin_lock+0x290/0x370 kernel/locking/spinlock_debug.c:114
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0xdd/0x120 kernel/locking/spinlock.c:162
 __wake_up_common_lock kernel/sched/wait.c:137 [inline]
 __wake_up+0xfd/0x1c0 kernel/sched/wait.c:160
 __usb_hcd_giveback_urb+0x3a8/0x530 drivers/usb/core/hcd.c:1678
 dummy_timer+0x8ad/0x3200 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1504
 expire_timers kernel/time/timer.c:1549 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1820
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
 __do_softirq+0x2e9/0xa4c kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x60 kernel/kcov.c:206
Code: 00 0f 0b 0f 1f 00 53 48 89 fb e8 17 00 00 00 48 8b 3d 48 ea e8 0c 48 89 de 5b e9 57 a0 56 00 cc cc cc cc cc cc cc 48 8b 04 24 <65> 48 8b 0d d4 df 77 7e 65 8b 15 d5 df 77 7e f7 c2 00 01 ff 00 74
RSP: 0018:ffffc90004ab7668 EFLAGS: 00000246
RAX: ffffffff8a86a6fd RBX: dffffc0000000000 RCX: 0000000000040000
RDX: ffffc900044e2000 RSI: 000000000003ffff RDI: ffffc90004ab7760
RBP: ffffc90004ab7810 R08: ffffffff81b7c285 R09: fffffbfff2093445
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90004ab7760
R13: 0000000000000102 R14: dffffc0000000000 R15: 00000000000009af
 xas_start+0x1d/0x7b0 lib/xarray.c:180
 xas_load+0x28/0x140 lib/xarray.c:235
 mapping_get_entry mm/filemap.c:1853 [inline]
 __filemap_get_folio+0x22c/0xe80 mm/filemap.c:1915
 shmem_get_folio_gfp+0x356/0x3470 mm/shmem.c:1881
 shmem_get_folio mm/shmem.c:2072 [inline]
 shmem_write_begin+0x16e/0x4e0 mm/shmem.c:2559
 generic_perform_write+0x2fc/0x5e0 mm/filemap.c:3817
 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3945
 generic_file_write_iter+0xab/0x310 mm/filemap.c:3977
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x7ae/0xba0 fs/read_write.c:584
 ksys_write+0x19c/0x2c0 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f759467cbef
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 b9 80 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c 81 02 00 48
RSP: 002b:00007f7595465e80 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00007f759467cbef
RDX: 0000000001000000 RSI: 00007f758adf7000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000005106
R10: 0000000020005182 R11: 0000000000000293 R12: 0000000000000003
R13: 00007f7595465f80 R14: 00007f7595465f40 R15: 00007f758adf7000
 </TASK>

Allocated by task 6979:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:383
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:692 [inline]
 xpad_probe+0x3be/0x1b10 drivers/input/joystick/xpad.c:1965
 usb_probe_interface+0x5c0/0xaf0 drivers/usb/core/driver.c:396
 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639
 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:785
 driver_probe_device+0x50/0x420 drivers/base/dd.c:815
 __device_attach_driver+0x2cf/0x510 drivers/base/dd.c:943
 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:427
 __device_attach+0x359/0x570 drivers/base/dd.c:1015
 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:487
 device_add+0xb48/0xfd0 drivers/base/core.c:3686
 usb_set_configuration+0x19dd/0x2020 drivers/usb/core/message.c:2165
 usb_generic_driver_probe+0x84/0x140 drivers/usb/core/generic.c:238
 usb_probe_device+0x130/0x260 drivers/usb/core/driver.c:293
 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639
 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:785
 driver_probe_device+0x50/0x420 drivers/base/dd.c:815
 __device_attach_driver+0x2cf/0x510 drivers/base/dd.c:943
 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:427
 __device_attach+0x359/0x570 drivers/base/dd.c:1015
 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:487
 device_add+0xb48/0xfd0 drivers/base/core.c:3686
 usb_new_device+0xbdd/0x18f0 drivers/usb/core/hub.c:2614
 hub_port_connect drivers/usb/core/hub.c:5465 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5605 [inline]
 port_event drivers/usb/core/hub.c:5761 [inline]
 hub_event+0x2efe/0x5730 drivers/usb/core/hub.c:5843
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

Freed by task 14:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 __kmem_cache_free+0x25c/0x3c0 mm/slub.c:3674
 xpad_disconnect+0x355/0x480 drivers/input/joystick/xpad.c:2146
 usb_unbind_interface+0x1cd/0x840 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:550 [inline]
 __device_release_driver drivers/base/dd.c:1260 [inline]
 device_release_driver_internal+0x59e/0x880 drivers/base/dd.c:1286
 bus_remove_device+0x2e5/0x400 drivers/base/bus.c:529
 device_del+0x6e2/0xbd0 drivers/base/core.c:3874
 usb_disable_device+0x3b8/0x840 drivers/usb/core/message.c:1414
 usb_disconnect+0x33c/0x8c0 drivers/usb/core/hub.c:2269
 hub_port_connect drivers/usb/core/hub.c:5309 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5605 [inline]
 port_event drivers/usb/core/hub.c:5761 [inline]
 hub_event+0x1f78/0x5730 drivers/usb/core/hub.c:5843
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

Last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
 kvfree_call_rcu+0x116/0x8c0 kernel/rcu/tree.c:3400
 cgroup_migrate_finish+0x1b7/0x380 kernel/cgroup/cgroup.c:2722
 cgroup_attach_task+0x61e/0x970 kernel/cgroup/cgroup.c:2923
 cgroup_attach_task_all+0x9d/0xe0 kernel/cgroup/cgroup-v1.c:70
 kvm_vm_worker_thread+0xd0/0x540 arch/x86/kvm/../../../virt/kvm/kvm_main.c:6087
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

Second to last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
 kvfree_call_rcu+0x116/0x8c0 kernel/rcu/tree.c:3400
 neigh_periodic_work+0x3c5/0xd40 net/core/neighbour.c:1005
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88801fb8d800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 92 bytes inside of
 1024-byte region [ffff88801fb8d800, ffff88801fb8dc00)

The buggy address belongs to the physical page:
page:ffffea00007ee200 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801fb8c800 pfn:0x1fb88
head:ffffea00007ee200 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff80000010200(slab|head|node=0|zone=1|lastcpupid=0xfff)
raw: 00fff80000010200 ffffea0001f72e08 ffffea000164dc08 ffff888012441dc0
raw: ffff88801fb8c800 000000000010000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3401, tgid 3401 (sshd), ts 53478956859, free_ts 53478874991
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2513
 prep_new_page mm/page_alloc.c:2520 [inline]
 get_page_from_freelist+0x31a1/0x3320 mm/page_alloc.c:4279
 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5547
 alloc_slab_page+0x6a/0x150 mm/slub.c:1794
 allocate_slab mm/slub.c:1939 [inline]
 new_slab+0x84/0x2d0 mm/slub.c:1992
 ___slab_alloc+0xc20/0x1270 mm/slub.c:3180
 __slab_alloc mm/slub.c:3279 [inline]
 slab_alloc_node mm/slub.c:3364 [inline]
 __kmem_cache_alloc_node+0x19f/0x260 mm/slub.c:3437
 __do_kmalloc_node mm/slab_common.c:954 [inline]
 __kmalloc_node_track_caller+0xa0/0x220 mm/slab_common.c:975
 kmalloc_reserve net/core/skbuff.c:446 [inline]
 __alloc_skb+0x135/0x670 net/core/skbuff.c:515
 alloc_skb include/linux/skbuff.h:1271 [inline]
 __tcp_send_ack+0x9a/0x600 net/ipv4/tcp_output.c:4020
 tcp_cleanup_rbuf net/ipv4/tcp.c:1650 [inline]
 tcp_recvmsg_locked+0x1b77/0x2450 net/ipv4/tcp.c:2670
 tcp_recvmsg+0x258/0x920 net/ipv4/tcp.c:2700
 inet_recvmsg+0x13b/0x250 net/ipv4/af_inet.c:888
 sock_recvmsg_nosec net/socket.c:1022 [inline]
 sock_recvmsg net/socket.c:1040 [inline]
 sock_read_iter+0x3b2/0x4b0 net/socket.c:1121
 call_read_iter include/linux/fs.h:2259 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x7de/0xbe0 fs/read_write.c:470
 ksys_read+0x19c/0x2c0 fs/read_write.c:613
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1440 [inline]
 free_pcp_prepare mm/page_alloc.c:1490 [inline]
 free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3358
 free_unref_page+0x33/0x3e0 mm/page_alloc.c:3453
 __skb_frag_unref include/linux/skbuff.h:3410 [inline]
 skb_release_data+0x37f/0x7a0 net/core/skbuff.c:785
 skb_release_all net/core/skbuff.c:856 [inline]
 __kfree_skb net/core/skbuff.c:870 [inline]
 skb_attempt_defer_free+0x29a/0x400 net/core/skbuff.c:6671
 tcp_eat_recv_skb net/ipv4/tcp.c:1660 [inline]
 tcp_recvmsg_locked+0x1209/0x2450 net/ipv4/tcp.c:2654
 tcp_recvmsg+0x258/0x920 net/ipv4/tcp.c:2700
 inet_recvmsg+0x13b/0x250 net/ipv4/af_inet.c:888
 sock_recvmsg_nosec net/socket.c:1022 [inline]
 sock_recvmsg net/socket.c:1040 [inline]
 sock_read_iter+0x3b2/0x4b0 net/socket.c:1121
 call_read_iter include/linux/fs.h:2259 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x7de/0xbe0 fs/read_write.c:470
 ksys_read+0x19c/0x2c0 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff88801fb8d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88801fb8d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801fb8d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff88801fb8d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801fb8d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	0f 0b                	ud2
   2:	0f 1f 00             	nopl   (%rax)
   5:	53                   	push   %rbx
   6:	48 89 fb             	mov    %rdi,%rbx
   9:	e8 17 00 00 00       	call   0x25
   e:	48 8b 3d 48 ea e8 0c 	mov    0xce8ea48(%rip),%rdi        # 0xce8ea5d
  15:	48 89 de             	mov    %rbx,%rsi
  18:	5b                   	pop    %rbx
  19:	e9 57 a0 56 00       	jmp    0x56a075
  1e:	cc                   	int3
  1f:	cc                   	int3
  20:	cc                   	int3
  21:	cc                   	int3
  22:	cc                   	int3
  23:	cc                   	int3
  24:	cc                   	int3
  25:	48 8b 04 24          	mov    (%rsp),%rax
* 29:	65 48 8b 0d d4 df 77 	mov    %gs:0x7e77dfd4(%rip),%rcx        # 0x7e77e005 <-- trapping instruction
  30:	7e
  31:	65 8b 15 d5 df 77 7e 	mov    %gs:0x7e77dfd5(%rip),%edx        # 0x7e77e00d
  38:	f7 c2 00 01 ff 00    	test   $0xff0100,%edx
  3e:	74                   	.byte 0x74

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/22 01:30 linux-6.1.y 6741e066ec76 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/04/15 22:40 linux-6.1.y cd5d98c0556c b9af7e61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/04/06 03:34 linux-6.1.y 347385861c50 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
* Struck through repros no longer work on HEAD.