KASAN: slab-out-of-bounds Read in dlfb_usb

KASAN: slab-out-of-bounds Read in dlfb_usb_probe
Status: upstream: reported C repro on 2020/03/16 21:47
Reported-by: syzbot+ed94135f896a14d75284@syzkaller.appspotmail.com
First crash: 217d, last: 123d

Cause bisection: introduced by (bisect log):

commit f2c2e717642c66f7fe7e5dd69b2e8ff5849f4d10
Author: Andrey Konovalov <andreyknvl@google.com>
Date: Mon Feb 24 16:13:03 2020 +0000

usb: gadget: add raw-gadget interface

Crash: KASAN: slab-out-of-bounds Read in dlfb_usb_probe (log)
Repro: C syz .config

Fix bisection: failed (bisect log)

duplicates (1):
Title	Repro	Bisected	Count	Last	Reported	Patched	Status
KASAN: slab-out-of-bounds Read in hex_string	syz		2	541d	540d	0/17	closed as dup on 2020/03/18 15:46

Sample crash report:

usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: syz
usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
usb 1-1: config 0 descriptor??
==================================================================
BUG: KASAN: slab-out-of-bounds in hex_string+0x439/0x4c0 lib/vsprintf.c:1144
Read of size 1 at addr ffff8880a202da1b by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382
 __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 hex_string+0x439/0x4c0 lib/vsprintf.c:1144
 pointer+0x346/0x7c0 lib/vsprintf.c:2204
 vsnprintf+0x5ac/0x14f0 lib/vsprintf.c:2597
 va_format.isra.0+0x129/0x1b0 lib/vsprintf.c:1659
 pointer+0x534/0x7c0 lib/vsprintf.c:2232
 vsnprintf+0x5ac/0x14f0 lib/vsprintf.c:2597
 vscnprintf+0x29/0x80 lib/vsprintf.c:2696
 vprintk_store+0x40/0x4b0 kernel/printk/printk.c:1942
 vprintk_emit+0x139/0x730 kernel/printk/printk.c:2003
 dev_vprintk_emit+0x4fc/0x541 drivers/base/core.c:3774
 dev_printk_emit+0xba/0xf1 drivers/base/core.c:3785
 __dev_printk+0x1db/0x203 drivers/base/core.c:3797
 _dev_info+0xd7/0x109 drivers/base/core.c:3843
 dlfb_parse_vendor_descriptor drivers/video/fbdev/udlfb.c:1589 [inline]
 dlfb_usb_probe.cold+0x103c/0x1cae drivers/video/fbdev/udlfb.c:1672
 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:374
 really_probe+0x281/0x6d0 drivers/base/dd.c:520
 driver_probe_device+0x104/0x210 drivers/base/dd.c:697
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:804
 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
 __device_attach+0x21a/0x360 drivers/base/dd.c:870
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0x132d/0x1c10 drivers/base/core.c:2538
 usb_set_configuration+0xec5/0x1740 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:241
 usb_probe_device+0xc6/0x1f0 drivers/usb/core/driver.c:272
 really_probe+0x281/0x6d0 drivers/base/dd.c:520
 driver_probe_device+0x104/0x210 drivers/base/dd.c:697
 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:804
 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
 __device_attach+0x21a/0x360 drivers/base/dd.c:870
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0x132d/0x1c10 drivers/base/core.c:2538
 usb_new_device.cold+0x701/0xfcf drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x1eca/0x38f0 drivers/usb/core/hub.c:5576
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Allocated by task 5:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 __kasan_kmalloc mm/kasan/common.c:495 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468
 __do_kmalloc mm/slab.c:3656 [inline]
 __kmalloc+0x161/0x7a0 mm/slab.c:3665
 kmalloc include/linux/slab.h:560 [inline]
 usb_get_configuration+0x311/0x3890 drivers/usb/core/config.c:919
 usb_enumerate_device drivers/usb/core/hub.c:2387 [inline]
 usb_new_device+0x387/0x670 drivers/usb/core/hub.c:2523
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x1eca/0x38f0 drivers/usb/core/hub.c:5576
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Freed by task 4242:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x109/0x2b0 mm/slab.c:3757
 kernfs_fop_write+0x300/0x490 fs/kernfs/file.c:329
 __vfs_write+0x76/0x100 fs/read_write.c:495
 vfs_write+0x268/0x5d0 fs/read_write.c:559
 ksys_write+0x12d/0x250 fs/read_write.c:612
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

The buggy address belongs to the object at ffff8880a202da00
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 27 bytes inside of
 32-byte region [ffff8880a202da00, ffff8880a202da20)
The buggy address belongs to the page:
page:ffffea0002880b40 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a202dfc1
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea0002766188 ffff8880aa001240 ffff8880aa0001c0
raw: ffff8880a202dfc1 ffff8880a202d000 0000000100000027 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a202d900: fb fb fb fb fc fc fc fc 06 fc fc fc fc fc fc fc
 ffff8880a202d980: 06 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc
>ffff8880a202da00: 00 00 00 03 fc fc fc fc fb fb fb fb fc fc fc fc
                            ^
 ffff8880a202da80: 05 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8880a202db00: 06 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc
==================================================================

Crashes (5):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-selinux-root	2020/05/22 22:50	upstream	051143e1	9682898d	.config	log	report	syz	C	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org
ci-upstream-kasan-gce-root	2020/05/22 19:30	upstream	051143e1	9682898d	.config	log	report	syz	C	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org
ci-qemu-upstream-386	2020/06/19 09:30	upstream	435faf5c	bc258b50	.config	log	report	syz	C	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org
ci2-upstream-usb	2020/05/14 23:13	https://github.com/google/kasan.git usb-fuzzer	059e7e0f	2d572622	.config	log	report	syz	C	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org
ci2-upstream-usb	2020/03/16 21:22	https://github.com/google/kasan.git usb-fuzzer	d6ff8147	749688d2	.config	log	report	syz	C	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org