Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported |
---|---|---|---|---|---|---|
KASAN: invalid-free in dev_free usb | C | 1162 | 46d | 126d |
syzbot |
sign-in | mailing list | source | docs |
Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [usb?] KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | 1 (2) | 2024/09/21 21:02 |
================================================================== BUG: KASAN: slab-use-after-free in usb_endpoint_xfer_isoc include/uapi/linux/usb/ch9.h:563 [inline] BUG: KASAN: slab-use-after-free in raw_ioctl_ep_set_clear_halt_wedge+0x5f3/0x8f0 drivers/usb/gadget/legacy/raw_gadget.c:1012 Read of size 1 at addr ffff88807f4ed623 by task syz.1.4498/25408 CPU: 1 UID: 0 PID: 25408 Comm: syz.1.4498 Not tainted 6.12.0-rc3-syzkaller-00007-g6485cf5ea253 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 usb_endpoint_xfer_isoc include/uapi/linux/usb/ch9.h:563 [inline] raw_ioctl_ep_set_clear_halt_wedge+0x5f3/0x8f0 drivers/usb/gadget/legacy/raw_gadget.c:1012 raw_ioctl+0xcd7/0x3cd0 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8c6437dff9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8c65220038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f8c64535f80 RCX: 00007f8c6437dff9 RDX: 0000000000000000 RSI: 000000004004550d RDI: 0000000000000003 RBP: 00007f8c643f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f8c64535f80 R15: 00007f8c6465fa28 </TASK> Allocated by task 25454: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_track_caller_noprof+0x225/0x440 mm/slub.c:4283 memdup_user+0x2b/0xc0 mm/util.c:226 raw_ioctl_ep_enable drivers/usb/gadget/legacy/raw_gadget.c:847 [inline] raw_ioctl+0xd0c/0x3cd0 drivers/usb/gadget/legacy/raw_gadget.c:1318 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25408: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 dev_free drivers/usb/gadget/legacy/raw_gadget.c:225 [inline] kref_put+0x4ab/0x7c0 include/linux/kref.h:65 raw_release+0x135/0x1e0 drivers/usb/gadget/legacy/raw_gadget.c:473 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1565 [inline] __se_sys_close fs/open.c:1550 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1550 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807f4ed620 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 3 bytes inside of freed 16-byte region [ffff88807f4ed620, ffff88807f4ed630) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f4ed flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801ac41640 ffffea00009d1a40 dead000000000002 raw: 0000000000000000 0000000000800080 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5248, tgid 5248 (syz-executor), ts 102269225427, free_ts 101979184533 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_slab_page+0x59/0x120 mm/slub.c:2414 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_node_noprof+0x286/0x440 mm/slub.c:4270 __kvmalloc_node_noprof+0x72/0x190 mm/util.c:658 xt_jumpstack_alloc net/netfilter/x_tables.c:1355 [inline] xt_replace_table+0x1a2/0x780 net/netfilter/x_tables.c:1394 __do_replace+0x1ae/0xa40 net/ipv4/netfilter/ip_tables.c:1064 do_replace net/ipv4/netfilter/ip_tables.c:1141 [inline] do_ipt_set_ctl+0xf02/0x1250 net/ipv4/netfilter/ip_tables.c:1635 nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101 do_sock_setsockopt+0x3af/0x720 net/socket.c:2334 __sys_setsockopt+0x1a2/0x250 net/socket.c:2357 __do_sys_setsockopt net/socket.c:2366 [inline] __se_sys_setsockopt net/socket.c:2363 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2363 page last free pid 5295 tgid 5295 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638 discard_slab mm/slub.c:2677 [inline] __put_partials+0xeb/0x130 mm/slub.c:3145 put_cpu_partial+0x17c/0x250 mm/slub.c:3220 __slab_free+0x2ea/0x3d0 mm/slub.c:4449 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] __kmalloc_cache_noprof+0x132/0x2c0 mm/slub.c:4290 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] _request_firmware_prepare drivers/base/firmware_loader/main.c:750 [inline] _request_firmware+0x239/0x13b0 drivers/base/firmware_loader/main.c:900 request_firmware+0x36/0x50 drivers/base/firmware_loader/main.c:993 dvb_usbv2_download_firmware+0x18a/0x380 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:34 dvb_usbv2_probe+0x88a/0x3dc0 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:956 usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 Memory state around the buggy address: ffff88807f4ed500: 00 00 fc fc 00 00 fc fc 00 07 fc fc 00 00 fc fc ffff88807f4ed580: 00 04 fc fc 00 00 fc fc 00 05 fc fc 00 04 fc fc >ffff88807f4ed600: 00 03 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc ^ ffff88807f4ed680: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ffff88807f4ed700: 00 00 fc fc 00 00 fc fc 00 07 fc fc 00 00 fc fc ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2024/10/14 10:39 | upstream | 6485cf5ea253 | 084d8178 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/11/04 07:58 | upstream | a33ab3f94f51 | f00eed24 | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/30 16:42 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | c67e9601e29a | fb888278 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/28 08:39 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | c6d9e43954bf | 65e8686b | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/20 20:03 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 07b887f8236e | cd6fc0a3 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/08 08:49 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 4a9fe2a8ac53 | 402f1df0 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/07 02:41 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 4a9fe2a8ac53 | d7906eff | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/03 12:36 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 9852d85ec9d4 | a4c7fd36 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/03 00:11 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 9852d85ec9d4 | 02f9582a | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/10/02 23:57 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 9852d85ec9d4 | 02f9582a | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/09/29 23:16 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 075dbe9f6e3c | ba29ff75 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/09/21 19:42 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 68d4209158f4 | 6f888b75 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/09/13 07:12 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 2193ede180dd | 73e8a465 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/09/05 20:40 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 9c0c11bb87b0 | 464ac2ed | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/09/03 08:22 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | 35f4a629641b | 8045124c | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge | ||
2024/09/01 19:32 | https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing | fc88bb116179 | 1eda0d14 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-usb | KASAN: slab-use-after-free Read in raw_ioctl_ep_set_clear_halt_wedge |