KASAN: use-after-free Read in firmware_fallback

KASAN: use-after-free Read in firmware_fallback_sysfs
Status: upstream: reported on 2021/02/01 04:16
Reported-by: syzbot+de271708674e2093097b@syzkaller.appspotmail.com
First crash: 31d, last: 3h37m

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-54	KASAN: use-after-free Read in firmware_fallback_sysfs	C			989	2h01m	315d	0/1	upstream: reported C repro on 2020/04/19 04:26

Sample crash report:

platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
==================================================================
BUG: KASAN: use-after-free in __list_add_valid+0x88/0xf4 lib/list_debug.c:23
Read of size 8 at addr ffff000017a52cc8 by task syz-executor.0/5972

CPU: 1 PID: 5972 Comm: syz-executor.0 Not tainted 5.11.0-syzkaller-11646-g5695e5161974 #0
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x3e0 arch/arm64/include/asm/pointer_auth.h:76
 show_stack+0x18/0x70 arch/arm64/kernel/stacktrace.c:191
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x110/0x188 lib/dump_stack.c:120
 print_address_description.constprop.0+0x2c/0x300 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report+0x1ec/0x200 mm/kasan/report.c:416
 __asan_report_load8_noabort+0x34/0x60 mm/kasan/report_generic.c:309
 __list_add_valid+0x88/0xf4 lib/list_debug.c:23
 __list_add include/linux/list.h:67 [inline]
 list_add include/linux/list.h:86 [inline]
 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:516 [inline]
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:581 [inline]
 firmware_fallback_sysfs+0x350/0xaa0 drivers/base/firmware_loader/fallback.c:657
 _request_firmware+0xa1c/0x1130 drivers/base/firmware_loader/main.c:831
 request_firmware+0x48/0x70 drivers/base/firmware_loader/main.c:875
 reg_reload_regdb+0x90/0x1dc net/wireless/reg.c:1095
 nl80211_reload_regdb+0x10/0x1c net/wireless/nl80211.c:7235
 genl_family_rcv_msg_doit+0x1b8/0x2a0 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x24c/0x42c net/netlink/genetlink.c:800
 netlink_rcv_skb+0x198/0x34c net/netlink/af_netlink.c:2502
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x3e0/0x670 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x610/0xa20 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xc0/0xf4 net/socket.c:674
 ____sys_sendmsg+0x548/0x6d0 net/socket.c:2350
 ___sys_sendmsg+0xf4/0x170 net/socket.c:2404
 __sys_sendmsg+0xbc/0x150 net/socket.c:2433
 __do_sys_sendmsg net/socket.c:2442 [inline]
 __se_sys_sendmsg net/socket.c:2440 [inline]
 __arm64_sys_sendmsg+0x70/0xa0 net/socket.c:2440
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0xf0/0x2c0 arch/arm64/kernel/syscall.c:129
 do_el0_svc+0xa4/0xd0 arch/arm64/kernel/syscall.c:168
 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:416
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432
 el0_sync+0x170/0x180 arch/arm64/kernel/entry.S:699

Allocated by task 5903:
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 ____kasan_kmalloc mm/kasan/common.c:506 [inline]
 __kasan_kmalloc+0x88/0xb0 mm/kasan/common.c:515
 kasan_kmalloc include/linux/kasan.h:233 [inline]
 kmem_cache_alloc_trace+0x250/0x464 mm/slub.c:2934
 kmalloc include/linux/slab.h:554 [inline]
 kzalloc include/linux/slab.h:684 [inline]
 __allocate_fw_priv drivers/base/firmware_loader/main.c:186 [inline]
 alloc_lookup_fw_priv drivers/base/firmware_loader/main.c:250 [inline]
 _request_firmware_prepare drivers/base/firmware_loader/main.c:744 [inline]
 _request_firmware+0x2b4/0x1130 drivers/base/firmware_loader/main.c:806
 request_firmware+0x48/0x70 drivers/base/firmware_loader/main.c:875
 reg_reload_regdb+0x90/0x1dc net/wireless/reg.c:1095
 nl80211_reload_regdb+0x10/0x1c net/wireless/nl80211.c:7235
 genl_family_rcv_msg_doit+0x1b8/0x2a0 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x24c/0x42c net/netlink/genetlink.c:800
 netlink_rcv_skb+0x198/0x34c net/netlink/af_netlink.c:2502
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x3e0/0x670 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x610/0xa20 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xc0/0xf4 net/socket.c:674
 ____sys_sendmsg+0x548/0x6d0 net/socket.c:2350
 ___sys_sendmsg+0xf4/0x170 net/socket.c:2404
 __sys_sendmsg+0xbc/0x150 net/socket.c:2433
 __do_sys_sendmsg net/socket.c:2442 [inline]
 __se_sys_sendmsg net/socket.c:2440 [inline]
 __arm64_sys_sendmsg+0x70/0xa0 net/socket.c:2440
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0xf0/0x2c0 arch/arm64/kernel/syscall.c:129
 do_el0_svc+0xa4/0xd0 arch/arm64/kernel/syscall.c:168
 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:416
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432
 el0_sync+0x170/0x180 arch/arm64/kernel/entry.S:699

Last potentially related work creation:
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xf8/0x130 mm/kasan/generic.c:345
 insert_work+0x50/0x2a0 kernel/workqueue.c:1331
 __queue_work+0x4d0/0x11a0 kernel/workqueue.c:1497
 queue_work_on+0xb8/0x100 kernel/workqueue.c:1524
 queue_work include/linux/workqueue.h:507 [inline]
 netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:658 [inline]
 netdevice_event+0x414/0x7dc drivers/infiniband/core/roce_gid_mgmt.c:801
 notifier_call_chain+0xc0/0x180 kernel/notifier.c:83
 raw_notifier_call_chain+0x18/0x24 kernel/notifier.c:410
 call_netdevice_notifiers_info+0x84/0xec net/core/dev.c:2063
 __netdev_upper_dev_link+0x2c0/0x590 net/core/dev.c:8003
 netdev_upper_dev_link+0x84/0xb4 net/core/dev.c:8044
 register_vlan_dev+0x208/0x75c net/8021q/vlan.c:183
 register_vlan_device net/8021q/vlan.c:280 [inline]
 vlan_ioctl_handler+0x700/0xc50 net/8021q/vlan.c:625
 sock_ioctl+0x2b0/0x860 net/socket.c:1148
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __arm64_sys_ioctl+0x120/0x18c fs/ioctl.c:739
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0xf0/0x2c0 arch/arm64/kernel/syscall.c:129
 do_el0_svc+0xa4/0xd0 arch/arm64/kernel/syscall.c:168
 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:416
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432
 el0_sync+0x170/0x180 arch/arm64/kernel/entry.S:699

Second to last potentially related work creation:
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xf8/0x130 mm/kasan/generic.c:345
 insert_work+0x50/0x2a0 kernel/workqueue.c:1331
 __queue_work+0x4d0/0x11a0 kernel/workqueue.c:1497
 queue_work_on+0xb8/0x100 kernel/workqueue.c:1524
 queue_work include/linux/workqueue.h:507 [inline]
 netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:658 [inline]
 netdevice_event+0x414/0x7dc drivers/infiniband/core/roce_gid_mgmt.c:801
 notifier_call_chain+0xc0/0x180 kernel/notifier.c:83
 raw_notifier_call_chain+0x18/0x24 kernel/notifier.c:410
 call_netdevice_notifiers_info+0x84/0xec net/core/dev.c:2063
 call_netdevice_notifiers_extack net/core/dev.c:2075 [inline]
 call_netdevice_notifiers net/core/dev.c:2089 [inline]
 dev_set_mac_address+0x20c/0x2f4 net/core/dev.c:8918
 dev_set_mac_address_user+0x44/0x6c net/core/dev.c:8932
 do_setlink+0xee4/0x2840 net/core/rtnetlink.c:2663
 __rtnl_newlink+0x8b8/0xfe4 net/core/rtnetlink.c:3376
 rtnl_newlink+0x70/0xac net/core/rtnetlink.c:3491
 rtnetlink_rcv_msg+0x300/0x744 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x198/0x34c net/netlink/af_netlink.c:2502
 rtnetlink_rcv+0x18/0x24 net/core/rtnetlink.c:5571
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x3e0/0x670 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x610/0xa20 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xc0/0xf4 net/socket.c:674
 __sys_sendto+0x16c/0x22c net/socket.c:1977
 __do_sys_sendto net/socket.c:1989 [inline]
 __se_sys_sendto net/socket.c:1985 [inline]
 __arm64_sys_sendto+0xc0/0x134 net/socket.c:1985
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0xf0/0x2c0 arch/arm64/kernel/syscall.c:129
 do_el0_svc+0xa4/0xd0 arch/arm64/kernel/syscall.c:168
 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:416
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432
 el0_sync+0x170/0x180 arch/arm64/kernel/entry.S:699

The buggy address belongs to the object at ffff000017a52c00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 200 bytes inside of
 256-byte region [ffff000017a52c00, ffff000017a52d00)
The buggy address belongs to the page:
page:0000000027df753f refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff000017a52c00 pfn:0x57a52
head:0000000027df753f order:1 compound_mapcount:0
flags: 0x1ffc00000010200(slab|head)
raw: 01ffc00000010200 fffffc00005e5100 0000000200000002 ffff00000c402480
raw: ffff000017a52c00 000000008010000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff000017a52b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff000017a52c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff000017a52c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff000017a52d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff000017a52d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (204):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Title
ci-qemu2-arm64	2021/02/28 19:54	upstream	5695e516	4c37c133	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64	2021/02/27 06:36	upstream	8b83369d	4c37c133	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/26 19:53	upstream	8b83369d	4c37c133	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/26 01:31	upstream	29c395c7	76f7fc95	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/24 20:36	upstream	719bbd4a	fcc6d71b	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/24 13:47	upstream	c03c21ba	fcc6d71b	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/24 00:48	upstream	3b9cdafb	fcc6d71b	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/23 13:28	upstream	b12b4724	fcc6d71b	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/22 01:57	upstream	55f62bc8	a659b3f1	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/20 18:52	upstream	f40ddce8	053a2b26	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/17 17:22	upstream	f40ddce8	052f8d9f	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/17 08:30	upstream	f40ddce8	052f8d9f	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/14 21:03	upstream	358fecee	98682e5e	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/14 15:56	upstream	358fecee	98682e5e	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/14 00:12	upstream	8cc8e6aa	98682e5e	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/12 15:46	upstream	dcc0b490	a5f86b15	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/12 05:40	upstream	291009f6	a5f86b15	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/11 16:42	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/11 14:45	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/11 07:57	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/11 04:58	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64	2021/02/11 02:45	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/10 19:59	upstream	e0756cfc	9c8b8541	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/10 17:25	upstream	e0756cfc	9c8b8541	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/10 16:09	upstream	e0756cfc	9c8b8541	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64	2021/02/10 01:17	upstream	e0756cfc	2bd9619f	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/09 22:55	upstream	e0756cfc	2bd9619f	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/01/31 19:25	upstream	6642d600	fc9fd31e	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64	2021/01/28 04:06	upstream	2ab38c17	1fa053ad	.config	log	report	info	KASAN: use-after-free Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/28 10:53	upstream	5695e516	4c37c133	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/27 20:40	upstream	3fb6d0e0	4c37c133	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/26 17:04	upstream	2c87f7a3	4c37c133	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/26 15:05	upstream	2c87f7a3	4c37c133	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/25 06:00	upstream	719bbd4a	fcc6d71b	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/22 23:49	upstream	a99163e9	c26fb06b	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/22 06:27	upstream	31caf8b2	a659b3f1	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/21 14:59	upstream	e767b353	3e5ed8b4	.config	log	report	info	BUG: corrupted list in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/21 13:27	upstream	e767b353	3e5ed8b4	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/21 10:18	upstream	e767b353	3e5ed8b4	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/21 07:37	upstream	e767b353	3e5ed8b4	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/20 09:37	upstream	f40ddce8	053a2b26	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/20 07:31	upstream	f40ddce8	f689d40a	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/20 05:06	upstream	f40ddce8	f689d40a	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/19 22:33	upstream	f40ddce8	f689d40a	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/14 06:27	upstream	8cc8e6aa	98682e5e	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/13 05:19	upstream	dcc0b490	98682e5e	.config	log	report	info	KASAN: slab-out-of-bounds Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/12 01:54	upstream	291009f6	a5f86b15	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/11 14:57	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-compat	2021/02/11 11:06	upstream	291009f6	a52ee10a	.config	log	report	info	KASAN: slab-out-of-bounds Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/10 18:50	upstream	e0756cfc	9c8b8541	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/10 14:37	upstream	e0756cfc	9c8b8541	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs
ci-qemu2-arm64-mte	2021/02/10 07:38	upstream	e0756cfc	2bd9619f	.config	log	report	info	KASAN: invalid-access Read in firmware_fallback_sysfs