ubi0: attaching mtd0
usb usb9: usbfs: process 23091 (syz-executor.0) did not claim interface 0 before use
ubi0: scanning is finished
==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]
BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x387/0x6f0 drivers/usb/core/hcd.c:771
Write of size 2 at addr ffff8880510f9ec0 by task syz-executor.0/23085
CPU: 0 PID: 23085 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report+0x8f/0xa0 mm/kasan/report.c:412
memcpy+0x35/0x50 mm/kasan/kasan.c:303
memcpy include/linux/string.h:377 [inline]
usb_hcd_poll_rh_status+0x387/0x6f0 drivers/usb/core/hcd.c:771
call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1696 [inline]
run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
__do_softirq+0x265/0x980 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:_free_event+0x2ee/0x1150 kernel/events/core.c:4481
Code: ff 48 8d bb 70 04 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 91 0c 00 00 48 8b bb 70 04 00 00 fd 86 1f 00 48 8d bb 80 04 00 00 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffff888057b4fca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff888057abe000 RCX: ffffffff81762eb4
RDX: 1ffff1100af57c8e RSI: ffffffff81762ef4 RDI: 0000000000000000
RBP: 1ffff1100af69f98 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888057abe098 R14: ffff888057abe4e0 R15: ffff888057b4fce0
put_event kernel/events/core.c:4578 [inline]
perf_event_release_kernel+0x6d9/0xcd0 kernel/events/core.c:4693
perf_release+0x33/0x40 kernel/events/core.c:4703
__fput+0x2ce/0x890 fs/file_table.c:278
task_work_run+0x148/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f8189c2cc9b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffec9d3a410 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f8189c2cc9b
RDX: 00007f8189d92348 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007f8189d8e960 R08: 0000000000000000 R09: 00007f8189d92350
R10: 00007ffec9d3a510 R11: 0000000000000293 R12: 000000000006c984
R13: 00007ffec9d3a510 R14: 00007f8189d8cf60 R15: 0000000000000032
Allocated by task 23091:
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15a/0x3c0 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
proc_do_submiturb+0x2d17/0x3b00 drivers/usb/core/devio.c:1673
proc_submiturb drivers/usb/core/devio.c:1827 [inline]
usbdev_do_ioctl+0x773/0x3030 drivers/usb/core/devio.c:2481
usbdev_ioctl+0x21/0x30 drivers/usb/core/devio.c:2585
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8129:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
kvfree+0x59/0x60 mm/util.c:452
__vunmap+0x2a5/0x3f0 mm/vmalloc.c:1534
vfree+0x65/0x100 mm/vmalloc.c:1598
copy_entries_to_user net/ipv4/netfilter/ip_tables.c:870 [inline]
get_entries net/ipv4/netfilter/ip_tables.c:1027 [inline]
do_ipt_get_ctl+0x6e8/0x8e0 net/ipv4/netfilter/ip_tables.c:1705
nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:122
ip_getsockopt net/ipv4/ip_sockglue.c:1574 [inline]
ip_getsockopt+0x167/0x1c0 net/ipv4/ip_sockglue.c:1554
tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:3629
__sys_getsockopt+0x135/0x210 net/socket.c:2050
__do_sys_getsockopt net/socket.c:2061 [inline]
__se_sys_getsockopt net/socket.c:2058 [inline]
__x64_sys_getsockopt+0xba/0x150 net/socket.c:2058
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880510f9ec0
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
32-byte region [ffff8880510f9ec0, ffff8880510f9ee0)
The buggy address belongs to the page:
page:ffffea0001443e40 count:1 mapcount:0 mapping:ffff88813bff01c0 index:0xffff8880510f9fc1
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea0002d138c8 ffffea0002caa448 ffff88813bff01c0
raw: ffff8880510f9fc1 ffff8880510f9000 0000000100000036 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880510f9d80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
ffff8880510f9e00: 00 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc
>ffff8880510f9e80: fb fb fb fb fc fc fc fc 01 fc fc fc fc fc fc fc
^
ffff8880510f9f00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
ffff8880510f9f80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: ff 48 8d decl -0x73(%rax)
3: bb 70 04 00 00 mov $0x470,%ebx
8: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
f: fc ff df
12: 48 89 fa mov %rdi,%rdx
15: 48 c1 ea 03 shr $0x3,%rdx
19: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
1d: 0f 85 91 0c 00 00 jne 0xcb4
23: 48 8b bb 70 04 00 00 mov 0x470(%rbx),%rdi
* 2a: e8 fd 86 1f 00 callq 0x1f872c <-- trapping instruction
2f: 48 8d bb 80 04 00 00 lea 0x480(%rbx),%rdi
36: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3d: fc ff df