KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh

KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status (2)
Status: upstream: reported on 2020/09/08 07:37
Reported-by: syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.com
First crash: 27d, last: 20h06m

similar bugs (2):
Kernel	Title	Repro	Bisected	Count	Last	Reported	Patched	Status
linux-4.19	KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status			2	24d	27d	0/1	upstream: reported on 2020/09/01 15:08
upstream	KASAN: slab-out-of-bounds Write in usb_hcd_poll_rh_status			3	391d	397d	0/17	auto-closed as invalid on 2020/01/01 21:24

Sample crash report:

==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:406 [inline]
BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x376/0x780 drivers/usb/core/hcd.c:775
Write of size 2 at addr ffff88804a091700 by task syz-executor.2/21267

CPU: 1 PID: 21267 Comm: syz-executor.2 Not tainted 5.9.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 check_memory_region_inline mm/kasan/generic.c:186 [inline]
 check_memory_region+0x13d/0x180 mm/kasan/generic.c:192
 memcpy+0x39/0x60 mm/kasan/common.c:106
 memcpy include/linux/string.h:406 [inline]
 usb_hcd_poll_rh_status+0x376/0x780 drivers/usb/core/hcd.c:775
 call_timer_fn+0x1ac/0x760 kernel/time/timer.c:1413
 expire_timers kernel/time/timer.c:1458 [inline]
 __run_timers.part.0+0x67c/0xaa0 kernel/time/timer.c:1755
 __run_timers kernel/time/timer.c:1736 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1768
 __do_softirq+0x1f8/0xb23 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x9b/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x235/0x280 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x51/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:770 [inline]
RIP: 0010:console_unlock+0xb4a/0xe60 kernel/printk/printk.c:2509
Code: 89 48 c1 e8 03 42 80 3c 38 00 0f 85 18 03 00 00 48 83 3d 50 88 9d 08 00 0f 84 90 01 00 00 e8 ed 5a 17 00 48 8b 7c 24 30 57 9d <0f> 1f 44 00 00 8b 5c 24 64 31 ff 89 de e8 34 57 17 00 85 db 0f 84
RSP: 0018:ffffc9001879f710 EFLAGS: 00000216
RAX: 000000000000bee3 RBX: 0000000000000200 RCX: ffffc9000ceff000
RDX: 0000000000040000 RSI: ffffffff815ee3a3 RDI: 0000000000000216
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8d0c09e7
R10: fffffbfff1a1813c R11: 0000000000000000 R12: ffffffff84ecd410
R13: 000000000000006c R14: ffffffff8aba8ed0 R15: dffffc0000000000
 vprintk_emit+0x2ff/0x740 kernel/printk/printk.c:2029
 dev_vprintk_emit+0x3eb/0x436 drivers/base/core.c:4129
 dev_printk_emit+0xba/0xf1 drivers/base/core.c:4140
 __dev_printk+0xcf/0xf5 drivers/base/core.c:4152
 _dev_warn+0xd7/0x109 drivers/base/core.c:4196
 checkintf drivers/usb/core/devio.c:825 [inline]
 checkintf.cold+0x7d/0x97 drivers/usb/core/devio.c:816
 proc_do_submiturb+0x174e/0x3630 drivers/usb/core/devio.c:1545
 proc_submiturb drivers/usb/core/devio.c:1892 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2588 [inline]
 usbdev_ioctl+0x682/0x3550 drivers/usb/core/devio.c:2708
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e179
Code: 3d b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f717a4b2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000001b440 RCX: 000000000045e179
RDX: 0000000020000440 RSI: 000000008038550a RDI: 0000000000000003
RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 000000000169fb6f R14: 00007f717a4b39c0 R15: 000000000118cf4c

Allocated by task 21264:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 __do_kmalloc mm/slab.c:3659 [inline]
 __kmalloc+0x1b0/0x360 mm/slab.c:3668
 kmalloc include/linux/slab.h:559 [inline]
 proc_do_submiturb+0x2a87/0x3630 drivers/usb/core/devio.c:1733
 proc_submiturb drivers/usb/core/devio.c:1892 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2588 [inline]
 usbdev_ioctl+0x682/0x3550 drivers/usb/core/devio.c:2708
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88804a091700
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
 32-byte region [ffff88804a091700, ffff88804a091720)
The buggy address belongs to the page:
page:00000000f12f6357 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804a091fc1 pfn:0x4a091
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea0002984f88 ffffea00021627c8 ffff8880aa040100
raw: ffff88804a091fc1 ffff88804a091000 000000010000003f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88804a091600: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff88804a091680: 05 fc fc fc fc fc fc fc fa fb fb fb fc fc fc fc
>ffff88804a091700: 01 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc
                   ^
 ffff88804a091780: 00 fc fc fc fc fc fc fc fa fb fb fb fc fc fc fc
 ffff88804a091800: 00 00 00 fc fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================

Crashes (3):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Maintainers
ci-upstream-kasan-gce	2020/09/28 09:32	upstream	a1b8638b	6bfdbe89	.config	log	report	info	andreyknvl@google.com, dvyukov@google.com, gregkh@linuxfoundation.org, gustavoars@kernel.org, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, noring@nocrew.org
ci-upstream-kasan-gce-root	2020/09/27 06:41	upstream	eeddbe68	5dd8aee8	.config	log	report	info	andreyknvl@google.com, gregkh@linuxfoundation.org, gustavoars@kernel.org, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, noring@nocrew.org
ci-upstream-kasan-gce-root	2020/09/01 15:14	upstream	b51594df	d5a3ae1f	.config	log	report		akpm@linux-foundation.org, andreyknvl@google.com, dvyukov@google.com, gregkh@linuxfoundation.org, gustavoars@kernel.org, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, m.szyprowski@samsung.com, noring@nocrew.org