syzbot


KASAN: global-out-of-bounds Read in load_next_firmware_from_table

Status: fixed on 2019/10/15 23:40
Subsystems: usb libertas
[Documentation on labels]
Reported-by: syzbot+98156c174c5a2cad9f8f@syzkaller.appspotmail.com
Fix commit: 764f3f1ecffc libertas: Add missing sentinel at end of if_usb.c fw_table
First crash: 1755d, last: 1702d
Discussions (17)
Title Replies (including bot) Last reply
[PATCH 5.2 000/313] 5.2.19-stable review 324 (324) 2020/06/23 22:07
[PATCH 4.19 000/211] 4.19.77-stable review 227 (227) 2019/11/12 00:25
[PATCH 5.3 000/344] 5.3.4-stable review 360 (360) 2019/11/11 06:01
[PATCH 4.14 000/185] 4.14.147-stable review 191 (191) 2019/10/05 00:10
[PATCH 4.9 000/129] 4.9.195-stable review 135 (135) 2019/10/04 22:56
[PATCH 4.4 00/99] 4.4.195-stable review 105 (105) 2019/10/04 22:55
[PATCH AUTOSEL 5.2 001/185] ALSA: hda: Flush interrupts on disabling 191 (191) 2019/10/02 19:16
[PATCH AUTOSEL 5.3 001/203] ALSA: hda: Flush interrupts on disabling 217 (217) 2019/10/02 14:35
[PATCH AUTOSEL 4.4 01/44] ALSA: hda: Flush interrupts on disabling 44 (44) 2019/09/22 19:01
[PATCH AUTOSEL 4.9 01/60] ALSA: hda: Flush interrupts on disabling 60 (60) 2019/09/22 18:59
[PATCH AUTOSEL 4.14 01/89] ALSA: hda: Flush interrupts on disabling 89 (89) 2019/09/22 18:57
[PATCH AUTOSEL 4.19 001/128] ALSA: hda: Flush interrupts on disabling 128 (128) 2019/09/22 18:54
[PATCH] libertas: Add missing sentinel at end of if_usb.c fw_table 2 (2) 2019/07/24 11:49
Reminder: 11 open syzbot bugs in "net/wireless" subsystem 1 (1) 2019/07/24 01:47
Reminder: 67 open syzbot bugs in usb subsystem 1 (1) 2019/07/24 01:35
Reminder: 47 open syzbot bugs in usb subsystem 1 (1) 2019/07/09 19:01
KASAN: global-out-of-bounds Read in load_next_firmware_from_table 0 (1) 2019/07/09 12:27
Last patch testing requests (2)
Created Duration User Patch Repo Result
2019/07/11 13:13 17m oneukum@suse.com patch https://github.com/google/kasan.git usb-fuzzer OK
2019/07/10 12:31 17m kevin@guarana.org patch https://github.com/google/kasan.git usb-fuzzer OK

Sample crash report:
usb 1-1: Direct firmware load for libertas/usb8388_v9.bin failed with error -2
usb 1-1: Direct firmware load for libertas/usb8388_v5.bin failed with error -2
usb 1-1: Direct firmware load for libertas/usb8388.bin failed with error -2
usb 1-1: Direct firmware load for usb8388.bin failed with error -2
==================================================================
BUG: KASAN: global-out-of-bounds in load_next_firmware_from_table+0x267/0x2d0 drivers/net/wireless/marvell/libertas/firmware.c:99
Read of size 8 at addr ffffffff8608e138 by task kworker/0:2/102

CPU: 0 PID: 102 Comm: kworker/0:2 Not tainted 5.3.0-rc5+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 print_address_description+0x6a/0x32c mm/kasan/report.c:351
 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
 kasan_report+0xe/0x12 mm/kasan/common.c:612
 load_next_firmware_from_table+0x267/0x2d0 drivers/net/wireless/marvell/libertas/firmware.c:99
 helper_firmware_cb+0xdc/0x100 drivers/net/wireless/marvell/libertas/firmware.c:70
 request_firmware_work_func+0x126/0x242 drivers/base/firmware_loader/main.c:975
 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
 worker_thread+0x96/0xe20 kernel/workqueue.c:2415
 kthread+0x318/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the variable:
 fw_table+0x98/0x5c0

Memory state around the buggy address:
 ffffffff8608e000: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 05 fa
 ffffffff8608e080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff8608e100: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 00
                                        ^
 ffffffff8608e180: 00 00 00 01 fa fa fa fa 00 00 00 00 02 fa fa fa
 ffffffff8608e200: fa fa fa fa 00 03 fa fa fa fa fa fa 00 00 00 00
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/28 10:18 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 1eb076e9 .config console log report syz C ci2-upstream-usb
2019/08/19 18:24 https://github.com/google/kasan.git usb-fuzzer e06ce4da6fa7 ae348fb7 .config console log report syz C ci2-upstream-usb
2019/07/05 21:56 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report syz C ci2-upstream-usb
2019/08/06 08:56 https://github.com/google/kasan.git usb-fuzzer e96407b49762 6affd8e8 .config console log report ci2-upstream-usb
2019/07/05 21:27 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.