KASAN: slab-out-of-bounds Read in mark

KASAN: slab-out-of-bounds Read in mark_lock
Status: upstream: reported C repro on 2020/05/22 16:33
Reported-by: syzbot+31610284091be1bf04f4@syzkaller.appspotmail.com
First crash: 77d, last: 77d

Cause bisection: introduced by (bisect log):

commit f2c2e717642c66f7fe7e5dd69b2e8ff5849f4d10
Author: Andrey Konovalov <andreyknvl@google.com>
Date: Mon Feb 24 16:13:03 2020 +0000

usb: gadget: add raw-gadget interface

Crash: KASAN: slab-out-of-bounds Read in dlfb_usb_probe (log)
Repro: C syz .config

Fix bisection: fixed by (bisect log):

commit c154703bc8dd2231ae81aafef5589b795b2b7e09
Author: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun Apr 19 04:18:07 2020 +0000

Input: tca6416-keypad - fix a typo in MODULE_DESCRIPTION

Sample crash report:

usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: syz
usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
usb 1-1: config 0 descriptor??
==================================================================
BUG: KASAN: slab-out-of-bounds in hex_string+0x416/0x520 lib/vsprintf.c:1144
Read of size 1 at addr ffff8880a6c1301b by task kworker/1:8/4076

CPU: 1 PID: 4076 Comm: kworker/1:8 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1e9/0x30e lib/dump_stack.c:118
 print_address_description+0x74/0x5c0 mm/kasan/report.c:382
 printk+0x62/0x83 kernel/printk/printk.c:2081
 __kasan_report+0x103/0x1a0 mm/kasan/report.c:511
 hex_string+0x416/0x520 lib/vsprintf.c:1144
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:110 [inline]
 hlock_class kernel/locking/lockdep.c:179 [inline]
 mark_lock+0x102/0x1b00 kernel/locking/lockdep.c:3912
 hex_string+0x416/0x520 lib/vsprintf.c:1144
 kasan_report+0x4d/0x80 mm/kasan/common.c:625
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:110 [inline]
 hlock_class kernel/locking/lockdep.c:179 [inline]
 mark_lock+0x102/0x1b00 kernel/locking/lockdep.c:3912
 hex_string+0x416/0x520 lib/vsprintf.c:1144
 pointer+0x539/0x970 lib/vsprintf.c:2204
 vsnprintf+0xbf4/0x1aa0 lib/vsprintf.c:2597
 va_format lib/vsprintf.c:1659 [inline]
 pointer+0x12d/0x970 lib/vsprintf.c:2232
 vsnprintf+0xbf4/0x1aa0 lib/vsprintf.c:2597
 vscnprintf+0x29/0x80 lib/vsprintf.c:2696
 vprintk_store+0x4b/0x680 kernel/printk/printk.c:1942
 vprintk_emit+0x128/0x3c0 kernel/printk/printk.c:2003
 dev_vprintk_emit+0x494/0x512 drivers/base/core.c:3774
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
 _raw_spin_unlock_irqrestore+0xb4/0xd0 kernel/locking/spinlock.c:191
 __debug_check_no_obj_freed lib/debugobjects.c:977 [inline]
 debug_check_no_obj_freed+0x592/0x640 lib/debugobjects.c:998
 mark_held_locks kernel/locking/lockdep.c:3628 [inline]
 __trace_hardirqs_on_caller kernel/locking/lockdep.c:3657 [inline]
 lockdep_hardirqs_on+0x4a4/0x8a0 kernel/locking/lockdep.c:3702
 dev_printk_emit+0x6a/0x8c drivers/base/core.c:3785
 usb_control_msg+0x2f3/0x420 drivers/usb/core/message.c:159
 _dev_info+0xb9/0xdb drivers/base/core.c:3843
 dlfb_parse_vendor_descriptor drivers/video/fbdev/udlfb.c:1588 [inline]
 dlfb_usb_probe+0x3ee/0x2080 drivers/video/fbdev/udlfb.c:1672
 dlfb_parse_vendor_descriptor drivers/video/fbdev/udlfb.c:1589 [inline]
 dlfb_usb_probe+0x443/0x2080 drivers/video/fbdev/udlfb.c:1672
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
 _raw_spin_unlock_irqrestore+0x6f/0xd0 kernel/locking/spinlock.c:191
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
 _raw_spin_unlock_irqrestore+0xb4/0xd0 kernel/locking/spinlock.c:191
 __pm_runtime_set_status+0x89e/0xb50 drivers/base/power/runtime.c:1251
 usb_probe_interface+0x614/0xac0 drivers/usb/core/driver.c:374
 really_probe+0x761/0xf60 drivers/base/dd.c:524
 driver_probe_device+0xe6/0x230 drivers/base/dd.c:697
 coredump_store+0x90/0x90 drivers/base/dd.c:373
 bus_for_each_drv+0x108/0x170 drivers/base/bus.c:431
 __device_attach+0x20c/0x3a0 drivers/base/dd.c:870
 bus_probe_device+0xb8/0x1f0 drivers/base/bus.c:491
 device_add+0x14a4/0x1ba0 drivers/base/core.c:2529
 device_add+0x1828/0x1ba0 drivers/base/core.c:2538
 usb_set_configuration+0x19d2/0x1f20 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0x82/0x140 drivers/usb/core/generic.c:241
 usb_probe_device+0x12d/0x1d0 drivers/usb/core/driver.c:272
 really_probe+0x761/0xf60 drivers/base/dd.c:524
 driver_probe_device+0xe6/0x230 drivers/base/dd.c:697
 coredump_store+0x90/0x90 drivers/base/dd.c:373
 bus_for_each_drv+0x108/0x170 drivers/base/bus.c:431
 __device_attach+0x20c/0x3a0 drivers/base/dd.c:870
 bus_probe_device+0xb8/0x1f0 drivers/base/bus.c:491
 device_add+0x14a4/0x1ba0 drivers/base/core.c:2529
 device_add+0x1828/0x1ba0 drivers/base/core.c:2538
 usb_new_device+0xcc3/0x1650 drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x2823/0x4cb0 drivers/usb/core/hub.c:5576
 lock_is_held include/linux/lockdep.h:406 [inline]
 rcu_read_lock_sched_held+0x106/0x170 kernel/rcu/update.c:121
 process_one_work+0x76e/0xfd0 kernel/workqueue.c:2268
 worker_thread+0xa7f/0x1450 kernel/workqueue.c:2414
 kthread+0x353/0x380 kernel/kthread.c:268
 rcu_lock_release+0x20/0x20 include/linux/rcupdate.h:213
 kthread_blkcg+0xd0/0xd0 kernel/kthread.c:1247
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Allocated by task 4076:
 save_stack mm/kasan/common.c:49 [inline]
 set_track mm/kasan/common.c:57 [inline]
 __kasan_kmalloc+0x114/0x160 mm/kasan/common.c:495
 __do_kmalloc mm/slab.c:3656 [inline]
 __kmalloc+0x24b/0x330 mm/slab.c:3665
 kmalloc include/linux/slab.h:560 [inline]
 usb_get_configuration+0x2d7/0x48e0 drivers/usb/core/config.c:919
 usb_enumerate_device drivers/usb/core/hub.c:2387 [inline]
 usb_new_device+0xf4/0x1650 drivers/usb/core/hub.c:2523
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x2823/0x4cb0 drivers/usb/core/hub.c:5576
 process_one_work+0x76e/0xfd0 kernel/workqueue.c:2268
 worker_thread+0xa7f/0x1450 kernel/workqueue.c:2414
 kthread+0x353/0x380 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Freed by task 5147:
 save_stack mm/kasan/common.c:49 [inline]
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0x125/0x190 mm/kasan/common.c:456
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x10a/0x220 mm/slab.c:3757
 tomoyo_check_open_permission+0x6e2/0x900 security/tomoyo/file.c:786
 security_file_open+0x50/0xc0 security/security.c:1548
 do_dentry_open+0x35d/0x10b0 fs/open.c:784
 do_open fs/namei.c:3229 [inline]
 path_openat+0x2790/0x38b0 fs/namei.c:3346
 do_filp_open+0x191/0x3a0 fs/namei.c:3373
 do_sys_openat2+0x463/0x770 fs/open.c:1148
 do_sys_open fs/open.c:1164 [inline]
 ksys_open include/linux/syscalls.h:1386 [inline]
 __do_sys_open fs/open.c:1170 [inline]
 __se_sys_open fs/open.c:1168 [inline]
 __x64_sys_open+0x1af/0x1e0 fs/open.c:1168
 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

The buggy address belongs to the object at ffff8880a6c13000
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 27 bytes inside of
 32-byte region [ffff8880a6c13000, ffff8880a6c13020)
The buggy address belongs to the page:
page:ffffea00029b04c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a6c13fc1
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00025f7e88 ffffea0002a6ff48 ffff8880aa4001c0
raw: ffff8880a6c13fc1 ffff8880a6c13000 000000010000003e 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a6c12f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880a6c12f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880a6c13000: 00 00 00 03 fc fc fc fc 00 00 01 fc fc fc fc fc
                            ^
 ffff8880a6c13080: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc
 ffff8880a6c13100: 00 00 01 fc fc fc fc fc 00 00 01 fc fc fc fc fc
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-smack-root	2020/05/22 11:38	upstream	d2f8825a	5afa2ddd	.config	log	report	syz	C	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, rafael@kernel.org