syzbot


KASAN: use-after-free Read in p54u_load_firmware_cb

Status: fixed on 2019/08/05 13:45
Reported-by: syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com
Fix commit: 6e41e2257f10 p54usb: Fix race between disconnect and firmware loading
First crash: 1243d, last: 1159d
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: slab-out-of-bounds Read in p54u_load_firmware_cb syz 8 1166d 1242d 0/24 closed as dup on 2019/08/13 13:28
Patch testing requests:
Created Duration User Patch Repo Result
2019/05/18 17:49 41m stern@rowland.harvard.edu patch https://github.com/google/kasan.git usb-fuzzer OK
2019/05/18 17:01 33m stern@rowland.harvard.edu patch https://github.com/google/kasan.git usb-fuzzer report log
2019/05/18 16:32 16m stern@rowland.harvard.edu patch https://github.com/google/kasan.git usb-fuzzer error
2019/05/18 15:13 35m stern@rowland.harvard.edu patch https://github.com/google/kasan.git usb-fuzzer report log
2019/05/17 20:46 14m stern@rowland.harvard.edu patch https://github.com/google/kasan.git usb-fuzzer error

Sample crash report:
usb 4-1: Direct firmware load for isl3887usb failed with error -2
usb 4-1: Firmware not found.
==================================================================
BUG: KASAN: use-after-free in p54u_load_firmware_cb.cold+0x97/0x13d drivers/net/wireless/intersil/p54/p54usb.c:936
Read of size 8 at addr ffff8881ca22f588 by task kworker/0:6/2861

CPU: 0 PID: 2861 Comm: kworker/0:6 Not tainted 5.2.0-rc1+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xca/0x13e lib/dump_stack.c:113
 print_address_description+0x67/0x231 mm/kasan/report.c:188
 __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:317
 kasan_report+0xe/0x20 mm/kasan/common.c:614
 p54u_load_firmware_cb.cold+0x97/0x13d drivers/net/wireless/intersil/p54/p54usb.c:936
 request_firmware_work_func+0x126/0x242 drivers/base/firmware_loader/main.c:785
 process_one_work+0x905/0x1570 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x30b/0x410 kernel/kthread.c:254
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the page:
page:ffffea0007288bc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x200000000000000()
raw: 0200000000000000 0000000000000000 ffffffff07280101 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881ca22f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881ca22f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881ca22f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff8881ca22f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881ca22f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (40):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-usb 2019/05/31 10:13 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f d9aaf3c2 .config log report syz
ci2-upstream-usb 2019/05/13 10:22 https://github.com/google/kasan.git usb-fuzzer 43151d6c3fce 16ab1e89 .config log report syz
ci2-upstream-usb 2019/07/28 20:06 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 c85e1c5b .config log report
ci2-upstream-usb 2019/07/25 17:17 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 0d7a1249 .config log report
ci2-upstream-usb 2019/07/25 10:51 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 32329ceb .config log report
ci2-upstream-usb 2019/07/24 19:37 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 32329ceb .config log report
ci2-upstream-usb 2019/07/24 16:18 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 32329ceb .config log report
ci2-upstream-usb 2019/07/24 10:50 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 32329ceb .config log report
ci2-upstream-usb 2019/07/23 13:06 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 bb071d58 .config log report
ci2-upstream-usb 2019/07/22 07:22 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 b3c615f5 .config log report
ci2-upstream-usb 2019/07/21 22:37 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/21 16:46 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/21 06:19 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/21 04:11 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/20 21:27 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/20 06:35 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/20 00:34 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 1656845f .config log report
ci2-upstream-usb 2019/07/19 04:59 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 7bb222f7 .config log report
ci2-upstream-usb 2019/07/18 20:10 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 7bb222f7 .config log report
ci2-upstream-usb 2019/07/17 10:40 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 0d10349c .config log report
ci2-upstream-usb 2019/07/09 23:24 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config log report
ci2-upstream-usb 2019/07/09 03:41 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config log report
ci2-upstream-usb 2019/07/08 19:42 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config log report
ci2-upstream-usb 2019/07/07 02:21 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config log report
ci2-upstream-usb 2019/07/06 17:31 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config log report
ci2-upstream-usb 2019/07/06 15:20 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 f62e1e85 .config log report
ci2-upstream-usb 2019/07/05 14:35 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 429efa16 .config log report
ci2-upstream-usb 2019/07/05 13:08 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 429efa16 .config log report
ci2-upstream-usb 2019/06/28 08:38 https://github.com/google/kasan.git usb-fuzzer 7829a896a587 7509bf36 .config log report
ci2-upstream-usb 2019/06/26 05:23 https://github.com/google/kasan.git usb-fuzzer 9939f56ee6c0 0a8d1a96 .config log report
ci2-upstream-usb 2019/06/14 02:10 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f d25bb7ad .config log report
ci2-upstream-usb 2019/06/04 19:53 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f e41a20c5 .config log report
ci2-upstream-usb 2019/06/03 09:58 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config log report
ci2-upstream-usb 2019/06/03 06:46 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config log report
ci2-upstream-usb 2019/06/01 23:14 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config log report
ci2-upstream-usb 2019/06/01 14:53 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config log report
ci2-upstream-usb 2019/06/01 08:57 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config log report
ci2-upstream-usb 2019/06/01 03:40 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config log report
ci2-upstream-usb 2019/05/13 09:27 https://github.com/google/kasan.git usb-fuzzer 43151d6c3fce 16ab1e89 .config log report
ci2-upstream-usb 2019/05/05 13:12 https://github.com/google/kasan.git usb-fuzzer 43151d6c3fce d28f4ce5 .config log report
* Struck through repros no longer work on HEAD.