syzbot

 sign-in | mailing list | source | docs
🐞 Open [981] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12500] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING in wdm_write/usb_submit_urb

Status: fixed on 2019/09/06 20:45
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+d232cca6ec42c2edb3fc@syzkaller.appspotmail.com
Fix commit: 1426bd2c9f7e USB: cdc-wdm: fix race between write and disconnect due to flag abuse
First crash: 1711d, last: 1696d
▶ ▼ Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: use-after-free Read in wdm_int_callback usb C 6 1711d 1722d 0/26 closed as dup on 2019/11/19 13:46
▶ ▼ Discussions (10)
Title Replies (including bot) Last reply
[PATCH 3.16 00/83] 3.16.78-rc1 review 88 (88) 2019/11/21 21:42
KASAN: use-after-free Read in wdm_int_callback 3 (5) 2019/11/19 14:32
[PATCH 4.19 00/93] 4.19.70-stable review 102 (102) 2019/09/06 13:54
[PATCH 4.4 00/77] 4.4.191-stable review 87 (87) 2019/09/06 10:59
[PATCH 5.2 000/143] 5.2.12-stable review 157 (157) 2019/09/06 08:16
[PATCH 4.14 00/57] 4.14.142-stable review 66 (66) 2019/09/06 07:36
[PATCH 4.9 00/83] 4.9.191-stable review 94 (94) 2019/09/06 07:36
[PATCH] USB: cdc-wdm: fix race between write and disconnect due to flag abuse 1 (1) 2019/08/27 10:34
Reminder: 52 active syzbot reports in usb subsystem 1 (1) 2019/08/22 03:28
WARNING in wdm_write/usb_submit_urb 8 (14) 2019/08/20 14:00
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2019/08/20 13:41 17m oneukum@suse.com patch https://github.com/google/kasan.git e06ce4da OK
2019/08/20 12:28 18m oneukum@suse.com patch https://github.com/google/kasan.git e06ce4da OK
2019/08/20 10:59 18m oneukum@suse.com patch https://github.com/google/kasan.git e06ce4da OK
2019/08/20 10:31 12m oneukum@suse.com patch https://github.com/google/kasan.git e06ce4da report log

Sample crash report:
------------[ cut here ]------------
URB 000000005fab893a submitted while active
WARNING: CPU: 1 PID: 1788 at drivers/usb/core/urb.c:362 usb_submit_urb+0x10c1/0x13b0 drivers/usb/core/urb.c:362
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 1788 Comm: syz-executor522 Not tainted 5.3.0-rc5+ #27
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 panic+0x2a3/0x6da kernel/panic.c:219
 __warn.cold+0x20/0x4a kernel/panic.c:576
 report_bug+0x262/0x2a0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:usb_submit_urb+0x10c1/0x13b0 drivers/usb/core/urb.c:362
Code: 89 de e8 82 bc ef fd 84 db 0f 85 42 f6 ff ff e8 45 bb ef fd 4c 89 fe 48 c7 c7 80 68 18 86 c6 05 27 30 3a 04 01 e8 34 a1 c5 fd <0f> 0b e9 20 f6 ff ff c7 44 24 14 01 00 00 00 e9 d7 f6 ff ff 41 bd
RSP: 0018:ffff8881d036fc98 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81288cfd RDI: ffffed103a06df85
RBP: ffff8881cfce56a0 R08: ffff8881d1ce4800 R09: ffffed103b663ee7
R10: ffffed103b663ee6 R11: ffff8881db31f737 R12: 1ffff1103a06dfa7
R13: 00000000fffffff0 R14: ffff8881cfce5688 R15: ffff8881d8106d00
 wdm_write+0x828/0xd87 drivers/usb/class/cdc-wdm.c:423
 __vfs_write+0x76/0x100 fs/read_write.c:494
 vfs_write+0x262/0x5c0 fs/read_write.c:558
 ksys_write+0x127/0x250 fs/read_write.c:611
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x447029
Code: e8 ec e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1e9e0a4da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 0000000000447029
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c
R13: 0000000020000000 R14: 00000000004af170 R15: 00000000000003e8
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/20 00:49 https://github.com/google/kasan.git usb-fuzzer e06ce4da6fa7 ae348fb7 .config console log report syz C ci2-upstream-usb
2019/08/19 02:43 https://github.com/google/kasan.git usb-fuzzer d0847550e22d b8ceabfc .config console log report syz ci2-upstream-usb
2019/09/03 01:10 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 14544a56 .config console log report ci2-upstream-usb
2019/08/31 11:36 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 bcd7bcc2 .config console log report ci2-upstream-usb
2019/08/30 16:24 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 9adfa876 .config console log report ci2-upstream-usb
2019/08/27 01:12 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 d21c5d9d .config console log report ci2-upstream-usb
2019/08/25 22:03 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 d21c5d9d .config console log report ci2-upstream-usb
2019/08/25 12:44 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 d21c5d9d .config console log report ci2-upstream-usb
2019/08/24 20:17 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 78ded196 .config console log report ci2-upstream-usb
2019/08/24 18:10 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 78ded196 .config console log report ci2-upstream-usb
2019/08/23 02:52 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 ca6f3cfa .config console log report ci2-upstream-usb
2019/08/22 17:05 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 c6c81a0b .config console log report ci2-upstream-usb
2019/08/21 21:46 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 4ea67ff8 .config console log report ci2-upstream-usb
2019/08/19 23:37 https://github.com/google/kasan.git usb-fuzzer e06ce4da6fa7 ae348fb7 .config console log report ci2-upstream-usb
2019/08/19 01:53 https://github.com/google/kasan.git usb-fuzzer d0847550e22d b8ceabfc .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.