powermate: config urb returned -108 ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x3c2f/0x5470 kernel/locking/lockdep.c:4897 Read of size 8 at addr ffff88807ce3f658 by task syslogd/2956 CPU: 1 PID: 2956 Comm: syslogd Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 __lock_acquire+0x3c2f/0x5470 kernel/locking/lockdep.c:4897 lock_acquire kernel/locking/lockdep.c:5639 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 powermate_config_complete+0x79/0xb0 drivers/input/misc/powermate.c:202 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1656 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1726 dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:finish_task_switch.isra.0+0x323/0xb80 kernel/sched/core.c:4866 Code: 83 61 fa 07 85 c0 75 02 0f 0b 48 85 db 0f 85 25 01 00 00 4c 89 f7 e8 fc f7 ff ff e8 c7 70 2d 00 fb 65 48 8b 1c 25 40 70 02 00 <48> 8d bb 80 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 RSP: 0018:ffffc90001a97808 EFLAGS: 00000206 RAX: 000000000002d0c5 RBX: ffff88807d420140 RCX: 1ffffffff1b26021 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90001a97850 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff817d1918 R11: 0000000000000001 R12: ffff8880b9d3aa58 R13: ffff88801ae78180 R14: ffff8880b9d39d00 R15: ffff8880b9d3a738 context_switch kernel/sched/core.c:4989 [inline] __schedule+0xaba/0x4f00 kernel/sched/core.c:6296 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6711 irqentry_exit+0x31/0x80 kernel/entry/common.c:425 asm_sysvec_reschedule_ipi+0x12/0x20 arch/x86/include/asm/idtentry.h:643 RIP: 0010:legitimize_root+0xdc/0x1a0 fs/namei.c:743 Code: cd 02 48 b8 00 00 00 00 00 fc ff df 48 89 fa 89 6b 3c 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 90 00 00 00 48 8d 7b 44 <8b> b3 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea RSP: 0018:ffffc90001a97a60 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc90001a97c40 RCX: 0000000000000000 RDX: 1ffff92000352fa2 RSI: ffffffff81cc2a8a RDI: ffffc90001a97c84 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff81cc2a6b R11: 0000000000000000 R12: 0000000000000001 R13: ffffc90001a97c60 R14: 0000000000000000 R15: ffffc90001a97df0 try_to_unlazy+0x12c/0x3b0 fs/namei.c:779 open_last_lookups fs/namei.c:3329 [inline] path_openat+0x7be/0x2940 fs/namei.c:3556 do_filp_open+0x1aa/0x400 fs/namei.c:3586 do_sys_openat2+0x16d/0x4d0 fs/open.c:1214 do_sys_open fs/open.c:1230 [inline] __do_sys_openat fs/open.c:1246 [inline] __se_sys_openat fs/open.c:1241 [inline] __x64_sys_openat+0x13f/0x1f0 fs/open.c:1241 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbfd2bf4697 Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f RSP: 002b:00007fff7a5b5370 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000560b55e242c0 RCX: 00007fbfd2bf4697 RDX: 0000000000000d41 RSI: 00007fbfd2d8299a RDI: 00000000ffffff9c RBP: 00007fbfd2d8299a R08: 00007fbfd2c84040 R09: 00007fbfd2c840c0 R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000d41 R13: 0000560b55e24400 R14: 0000000000000003 R15: 0000560b55e24410 Allocated by task 1724: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] ____kasan_kmalloc mm/kasan/common.c:475 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:270 [inline] kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3567 kmalloc include/linux/slab.h:582 [inline] kzalloc include/linux/slab.h:716 [inline] powermate_probe+0x24a/0x12a0 drivers/input/misc/powermate.c:323 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc17/0x1ee0 drivers/base/core.c:3393 usb_set_configuration+0x101e/0x1900 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:751 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:781 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:898 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:969 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc17/0x1ee0 drivers/base/core.c:3393 usb_new_device.cold+0x63f/0x108e drivers/usb/core/hub.c:2563 hub_port_connect drivers/usb/core/hub.c:5353 [inline] hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] port_event drivers/usb/core/hub.c:5643 [inline] hub_event+0x23e5/0x4460 drivers/usb/core/hub.c:5725 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Freed by task 10670: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:367 [inline] ____kasan_slab_free mm/kasan/common.c:329 [inline] __kasan_slab_free+0xee/0x130 mm/kasan/common.c:375 kasan_slab_free include/linux/kasan.h:236 [inline] __cache_free mm/slab.c:3437 [inline] kfree+0xf6/0x290 mm/slab.c:3794 powermate_disconnect+0x1ce/0x250 drivers/input/misc/powermate.c:432 usb_unbind_interface+0x1d8/0x8e0 drivers/usb/core/driver.c:458 __device_release_driver+0x5d7/0x700 drivers/base/dd.c:1205 device_release_driver_internal drivers/base/dd.c:1236 [inline] device_release_driver+0x26/0x40 drivers/base/dd.c:1259 bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:529 device_del+0x502/0xd50 drivers/base/core.c:3580 usb_disable_device+0x35b/0x7b0 drivers/usb/core/message.c:1419 usb_disconnect.cold+0x27a/0x78e drivers/usb/core/hub.c:2225 hub_quiesce+0x170/0x310 drivers/usb/core/hub.c:1327 hub_disconnect+0xcb/0x510 drivers/usb/core/hub.c:1722 usb_unbind_interface+0x1d8/0x8e0 drivers/usb/core/driver.c:458 __device_release_driver+0x5d7/0x700 drivers/base/dd.c:1205 device_release_driver_internal drivers/base/dd.c:1236 [inline] device_release_driver+0x26/0x40 drivers/base/dd.c:1259 usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 proc_ioctl.part.0+0x4d6/0x560 drivers/usb/core/devio.c:2332 proc_ioctl drivers/usb/core/devio.c:170 [inline] proc_ioctl_default drivers/usb/core/devio.c:2375 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2731 [inline] usbdev_ioctl+0x2b29/0x36c0 drivers/usb/core/devio.c:2791 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88807ce3f600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 88 bytes inside of 256-byte region [ffff88807ce3f600, ffff88807ce3f700) The buggy address belongs to the page: page:ffffea0001f38fc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807ce3f000 pfn:0x7ce3f flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0001e76288 ffffea0001bea508 ffff888010c40500 raw: ffff88807ce3f000 ffff88807ce3f000 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x3420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 4117, ts 179314801108, free_ts 179224784572 prep_new_page mm/page_alloc.c:2418 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369 __alloc_pages_node include/linux/gfp.h:570 [inline] kmem_getpages mm/slab.c:1378 [inline] cache_grow_begin+0x75/0x350 mm/slab.c:2584 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957 ____cache_alloc mm/slab.c:3040 [inline] ____cache_alloc mm/slab.c:3023 [inline] __do_cache_alloc mm/slab.c:3267 [inline] slab_alloc mm/slab.c:3308 [inline] __do_kmalloc mm/slab.c:3692 [inline] __kmalloc+0x3b3/0x4d0 mm/slab.c:3703 kmalloc_array+0x42/0x70 include/linux/slab.h:622 kcalloc include/linux/slab.h:653 [inline] iter_file_splice_write+0x13f/0xc10 fs/splice.c:628 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x110/0x180 fs/splice.c:936 splice_direct_to_actor+0x34b/0x8c0 fs/splice.c:891 do_splice_direct+0x1b3/0x280 fs/splice.c:979 do_sendfile+0xaf2/0x1250 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1304 [inline] __se_sys_sendfile64 fs/read_write.c:1296 [inline] __x64_sys_sendfile64+0x149/0x210 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1338 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389 free_unref_page_prepare mm/page_alloc.c:3309 [inline] free_unref_page_list+0x1a9/0xfa0 mm/page_alloc.c:3425 release_pages+0x3f4/0x1480 mm/swap.c:980 __pagevec_release+0x77/0x100 mm/swap.c:1000 pagevec_release include/linux/pagevec.h:81 [inline] truncate_inode_pages_range+0x743/0x1020 mm/truncate.c:411 kill_bdev block/bdev.c:78 [inline] set_blocksize+0x2bd/0x370 block/bdev.c:158 sb_set_blocksize+0x49/0x110 block/bdev.c:167 __ext4_fill_super fs/ext4/super.c:4790 [inline] ext4_fill_super+0x23af/0xe7b0 fs/ext4/super.c:5555 get_tree_bdev+0x440/0x760 fs/super.c:1295 vfs_get_tree+0x89/0x2f0 fs/super.c:1500 do_new_mount fs/namespace.c:2994 [inline] path_mount+0x1320/0x1fa0 fs/namespace.c:3324 do_mount fs/namespace.c:3337 [inline] __do_sys_mount fs/namespace.c:3545 [inline] __se_sys_mount fs/namespace.c:3522 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3522 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88807ce3f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807ce3f580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807ce3f600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807ce3f680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807ce3f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 83 61 fa 07 andl $0x7,-0x6(%rcx) 4: 85 c0 test %eax,%eax 6: 75 02 jne 0xa 8: 0f 0b ud2 a: 48 85 db test %rbx,%rbx d: 0f 85 25 01 00 00 jne 0x138 13: 4c 89 f7 mov %r14,%rdi 16: e8 fc f7 ff ff callq 0xfffff817 1b: e8 c7 70 2d 00 callq 0x2d70e7 20: fb sti 21: 65 48 8b 1c 25 40 70 mov %gs:0x27040,%rbx 28: 02 00 * 2a: 48 8d bb 80 15 00 00 lea 0x1580(%rbx),%rdi <-- trapping instruction 31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 38: fc ff df 3b: 48 89 fa mov %rdi,%rdx 3e: 48 rex.W 3f: c1 .byte 0xc1