[BUG] KASAN: slab-use-after-free Write in cxusb_medion_analog_init

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   45.869690][ T9842] BUG: KASAN: slab-use-after-free in
cxusb_medion_analog_init+0x53d/0xe90
[   45.869716][ T9842] Write of size 8 at addr ffff88802c55f668 by
task repro/9842
[   45.869722][ T9842]
[   45.869732][ T9842] CPU: 1 UID: 0 PID: 9842 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   45.869740][ T9842] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   45.869748][ T9842] Call Trace:
[   45.869753][ T9842]  <TASK>
[   45.869757][ T9842]  dump_stack_lvl+0xe8/0x150
[   45.869768][ T9842]  print_address_description+0x55/0x1e0
[   45.869776][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   45.869783][ T9842]  print_report+0x58/0x70
[   45.869789][ T9842]  kasan_report+0x117/0x150
[   45.869799][ T9842]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   45.869810][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   45.869818][ T9842]  cxusb_medion_analog_init+0x53d/0xe90
[   45.869826][ T9842]  ? __pfx_cxusb_medion_analog_init+0x10/0x10
[   45.869833][ T9842]  ? cxusb_ctrl_msg+0x157/0x1e0
[   45.869844][ T9842]  ? __pfx_cxusb_medion_set_mode+0x10/0x10
[   45.869854][ T9842]  ? __mutex_unlock_slowpath+0x731/0x900
[   45.869864][ T9842]  ? __asan_memset+0x22/0x50
[   45.869872][ T9842]  cxusb_medion_get+0x35a/0x510
[   45.869885][ T9842]  cxusb_videoradio_open+0x54/0x130
[   45.869895][ T9842]  v4l2_open+0x1bf/0x3a0
[   45.869902][ T9842]  chrdev_open+0x4cd/0x5e0
[   45.869912][ T9842]  ? __pfx_chrdev_open+0x10/0x10
[   45.869920][ T9842]  ? fsnotify_open_perm_and_set_mode+0x135/0x6d0
[   45.869929][ T9842]  ? __pfx_chrdev_open+0x10/0x10
[   45.869937][ T9842]  do_dentry_open+0x822/0x13a0
[   45.869948][ T9842]  vfs_open+0x3b/0x340
[   45.869956][ T9842]  ? path_openat+0x1552/0x1f30
[   45.869964][ T9842]  path_openat+0x1569/0x1f30
[   45.869974][ T9842]  do_file_open+0x23e/0x4a0
[   45.869982][ T9842]  ? __pfx_do_file_open+0x10/0x10
[   45.869992][ T9842]  ? alloc_fd+0x676/0x6f0
[   45.870000][ T9842]  do_sys_openat2+0x115/0x200
[   45.870009][ T9842]  ? _raw_spin_unlock_irq+0x2e/0x50
[   45.870017][ T9842]  ? __pfx_do_sys_openat2+0x10/0x10
[   45.870026][ T9842]  ? exc_page_fault+0x6a/0xc0
[   45.870036][ T9842]  ? do_user_addr_fault+0xc71/0x1340
[   45.870045][ T9842]  __x64_sys_openat+0x138/0x170
[   45.870054][ T9842]  do_syscall_64+0x155/0x510
[   45.870063][ T9842]  ? trace_irq_disable+0x3b/0x140
[   45.870072][ T9842]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.870079][ T9842]  ? clear_bhb_loop+0x30/0x80
[   45.870086][ T9842]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.870092][ T9842] RIP: 0033:0x43bf52
[   45.870102][ T9842] Code: 08 0f 85 71 ea ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[   45.870110][ T9842] RSP: 002b:00007f2384c85118 EFLAGS: 00000246
ORIG_RAX: 0000000000000101
[   45.870120][ T9842] RAX: ffffffffffffffda RBX: 00007f2384c856c0
RCX: 000000000043bf52
[   45.870125][ T9842] RDX: 0000000000000000 RSI: 00000000004d1b00
RDI: ffffffffffffff9c
[   45.870129][ T9842] RBP: 00007f2384c85140 R08: 0000000000000000
R09: 0000000000000000
[   45.870133][ T9842] R10: 0000000000000000 R11: 0000000000000246
R12: 00007f2384c856c0
[   45.870138][ T9842] R13: 00007ffdc4beb3f0 R14: 00007f2384c85ce4
R15: 00007ffdc4beb4e7
[   45.870145][ T9842]  </TASK>
[   45.870147][ T9842]
[   45.870151][ T9842] Allocated by task 9:
[   45.870154][ T9842]  kasan_save_track+0x3e/0x80
[   45.870162][ T9842]  __kasan_kmalloc+0x93/0xb0
[   45.870170][ T9842]  __kmalloc_cache_noprof+0x325/0x610
[   45.870178][ T9842]  cxusb_medion_register_analog+0x909/0x1120
[   45.870184][ T9842]  cxusb_probe+0x664/0x710
[   45.870192][ T9842]  usb_probe_interface+0x71f/0xe00
[   45.870205][ T9842]  really_probe+0x267/0xaf0
[   45.870212][ T9842]  __driver_probe_device+0x1e2/0x350
[   45.870219][ T9842]  driver_probe_device+0x4f/0x240
[   45.870225][ T9842]  __device_attach_driver+0x270/0x410
[   45.870232][ T9842]  bus_for_each_drv+0x258/0x2f0
[   45.870240][ T9842]  __device_attach+0x2c5/0x450
[   45.870246][ T9842]  device_initial_probe+0xa1/0xd0
[   45.870252][ T9842]  bus_probe_device+0x12a/0x220
[   45.870260][ T9842]  device_add+0x7ec/0xb90
[   45.870265][ T9842]  usb_set_configuration+0x1a87/0x2110
[   45.870273][ T9842]  usb_generic_driver_probe+0x8d/0x150
[   45.870281][ T9842]  usb_probe_device+0x1c4/0x3b0
[   45.870288][ T9842]  really_probe+0x267/0xaf0
[   45.870294][ T9842]  __driver_probe_device+0x1e2/0x350
[   45.870300][ T9842]  driver_probe_device+0x4f/0x240
[   45.870307][ T9842]  __device_attach_driver+0x270/0x410
[   45.870313][ T9842]  bus_for_each_drv+0x258/0x2f0
[   45.870321][ T9842]  __device_attach+0x2c5/0x450
[   45.870327][ T9842]  device_initial_probe+0xa1/0xd0
[   45.870332][ T9842]  bus_probe_device+0x12a/0x220
[   45.870340][ T9842]  device_add+0x7ec/0xb90
[   45.870345][ T9842]  usb_new_device+0xa14/0x1720
[   45.870352][ T9842]  hub_event+0x2a1c/0x4f30
[   45.870359][ T9842]  process_scheduled_works+0xc99/0x1900
[   45.870369][ T9842]  worker_thread+0xa53/0xfc0
[   45.870375][ T9842]  kthread+0x38b/0x480
[   45.870382][ T9842]  ret_from_fork+0x514/0xb70
[   45.870389][ T9842]  ret_from_fork_asm+0x1a/0x30
[   45.870396][ T9842]
[   45.870398][ T9842] Freed by task 34:
[   45.870401][ T9842]  kasan_save_track+0x3e/0x80
[   45.870408][ T9842]  kasan_save_free_info+0x46/0x50
[   45.870414][ T9842]  __kasan_slab_free+0x5c/0x80
[   45.870421][ T9842]  kfree+0x1c5/0x650
[   45.870426][ T9842]  v4l2_device_release+0x304/0x470
[   45.870435][ T9842]  device_release+0xc4/0x1f0
[   45.870442][ T9842]  kobject_put+0x228/0x560
[   45.870448][ T9842]  cxusb_medion_unregister_analog+0xc2/0x1c0
[   45.870454][ T9842]  cxusb_disconnect+0x9b/0x1a0
[   45.870462][ T9842]  usb_unbind_interface+0x26e/0x910
[   45.870470][ T9842]  device_release_driver_internal+0x4d9/0x870
[   45.870476][ T9842]  bus_remove_device+0x455/0x570
[   45.870484][ T9842]  device_del+0x527/0x8f0
[   45.870489][ T9842]  usb_disable_device+0x3d4/0x8d0
[   45.870496][ T9842]  usb_disconnect+0x32f/0x990
[   45.870502][ T9842]  hub_event+0x1cc9/0x4f30
[   45.870508][ T9842]  process_scheduled_works+0xc99/0x1900
[   45.870517][ T9842]  worker_thread+0xa53/0xfc0
[   45.870522][ T9842]  kthread+0x38b/0x480
[   45.870529][ T9842]  ret_from_fork+0x514/0xb70
[   45.870535][ T9842]  ret_from_fork_asm+0x1a/0x30
[   45.870542][ T9842]
[   45.870543][ T9842] The buggy address belongs to the object at
ffff88802c55f000
[   45.870543][ T9842]  which belongs to the cache kmalloc-2k of size 2048
[   45.870551][ T9842] The buggy address is located 1640 bytes inside of
[   45.870551][ T9842]  freed 2048-byte region [ffff88802c55f000,
ffff88802c55f800)
[   45.870557][ T9842]
[   45.870559][ T9842] The buggy address belongs to the physical page:
[   45.870566][ T9842] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0xffff88802c559000 pfn:0x2c558
[   45.870573][ T9842] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[   45.870579][ T9842] flags:
0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[   45.870589][ T9842] page_type: f5(slab)
[   45.870598][ T9842] raw: 00fff00000000240 ffff88801b042000
ffffea00006dc810 ffffea00006c7e10
[   45.870604][ T9842] raw: ffff88802c559000 0000000000080006
00000000f5000000 0000000000000000
[   45.870609][ T9842] head: 00fff00000000240 ffff88801b042000
ffffea00006dc810 ffffea00006c7e10
[   45.870615][ T9842] head: ffff88802c559000 0000000000080006
00000000f5000000 0000000000000000
[   45.870620][ T9842] head: 00fff00000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[   45.870625][ T9842] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000008
[   45.870629][ T9842] page dumped because: kasan: bad access detected
[   45.870634][ T9842] page_owner tracks the page as allocated
[   45.870637][ T9842] page last allocated via order 3, migratetype
Unmovable, gfp_mask
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 1, tgid 1 (swapper/0), ts 5765359105
[   45.870648][ T9842]  post_alloc_hook+0x1f9/0x250
[   45.870654][ T9842]  get_page_from_freelist+0x235a/0x23e0
[   45.870662][ T9842]  __alloc_frozen_pages_noprof+0x217/0x5a0
[   45.870669][ T9842]  allocate_slab+0x7d/0x610
[   45.870675][ T9842]  refill_objects+0x2d6/0x350
[   45.870680][ T9842]  __pcs_replace_empty_main+0x2c9/0x6c0
[   45.870689][ T9842]  __kvmalloc_node_noprof+0x64e/0x830
[   45.870697][ T9842]  v4l2_ctrl_new+0x105d/0x1860
[   45.870706][ T9842]  v4l2_ctrl_new_custom+0x5fc/0x850
[   45.870714][ T9842]  vivid_create_controls+0xe21/0x3bd0
[   45.870722][ T9842]  vivid_probe+0x4213/0x7290
[   45.870728][ T9842]  platform_probe+0xf9/0x190
[   45.870734][ T9842]  really_probe+0x267/0xaf0
[   45.870740][ T9842]  __driver_probe_device+0x1e2/0x350
[   45.870746][ T9842]  driver_probe_device+0x4f/0x240
[   45.870753][ T9842]  __driver_attach+0x33c/0x600
[   45.870759][ T9842] page_owner free stack trace missing
[   45.870761][ T9842]
[   45.870763][ T9842] Memory state around the buggy address:
[   45.870766][ T9842]  ffff88802c55f500: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   45.870770][ T9842]  ffff88802c55f580: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   45.870775][ T9842] >ffff88802c55f600: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   45.870778][ T9842]
          ^
[   45.870781][ T9842]  ffff88802c55f680: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   45.870785][ T9842]  ffff88802c55f700: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   45.870788][ T9842]
==================================================================
[   45.879932][ T9842] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   46.021649][ T9842] CPU: 1 UID: 0 PID: 9842 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   46.022673][ T9842] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   46.023774][ T9842] Call Trace:
[   46.024100][ T9842]  <TASK>
[   46.024386][ T9842]  vpanic+0x56d/0xa60
[   46.024776][ T9842]  ? __pfx_vpanic+0x10/0x10
[   46.025219][ T9842]  panic+0xc5/0xd0
[   46.025585][ T9842]  ? __pfx_panic+0x10/0x10
[   46.026019][ T9842]  ? preempt_schedule_thunk+0x16/0x40
[   46.026525][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   46.027069][ T9842]  ? preempt_schedule_thunk+0x16/0x40
[   46.027586][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   46.028133][ T9842]  check_panic_on_warn+0x89/0xb0
[   46.028621][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   46.029167][ T9842]  end_report+0x73/0x170
[   46.029584][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   46.030137][ T9842]  kasan_report+0x128/0x150
[   46.030554][ T9842]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   46.031118][ T9842]  ? cxusb_medion_analog_init+0x53d/0xe90
[   46.031661][ T9842]  cxusb_medion_analog_init+0x53d/0xe90
[   46.032192][ T9842]  ? __pfx_cxusb_medion_analog_init+0x10/0x10
[   46.032770][ T9842]  ? cxusb_ctrl_msg+0x157/0x1e0
[   46.033244][ T9842]  ? __pfx_cxusb_medion_set_mode+0x10/0x10
[   46.033871][ T9842]  ? __mutex_unlock_slowpath+0x731/0x900
[   46.034410][ T9842]  ? __asan_memset+0x22/0x50
[   46.034833][ T9842]  cxusb_medion_get+0x35a/0x510
[   46.035319][ T9842]  cxusb_videoradio_open+0x54/0x130
[   46.035819][ T9842]  v4l2_open+0x1bf/0x3a0
[   46.036235][ T9842]  chrdev_open+0x4cd/0x5e0
[   46.036671][ T9842]  ? __pfx_chrdev_open+0x10/0x10
[   46.037150][ T9842]  ? fsnotify_open_perm_and_set_mode+0x135/0x6d0
[   46.037755][ T9842]  ? __pfx_chrdev_open+0x10/0x10
[   46.038238][ T9842]  do_dentry_open+0x822/0x13a0
[   46.038702][ T9842]  vfs_open+0x3b/0x340
[   46.039101][ T9842]  ? path_openat+0x1552/0x1f30
[   46.039562][ T9842]  path_openat+0x1569/0x1f30
[   46.040012][ T9842]  do_file_open+0x23e/0x4a0
[   46.040450][ T9842]  ? __pfx_do_file_open+0x10/0x10
[   46.040940][ T9842]  ? alloc_fd+0x676/0x6f0
[   46.041358][ T9842]  do_sys_openat2+0x115/0x200
[   46.041816][ T9842]  ? _raw_spin_unlock_irq+0x2e/0x50
[   46.042319][ T9842]  ? __pfx_do_sys_openat2+0x10/0x10
[   46.042794][ T9842]  ? exc_page_fault+0x6a/0xc0
[   46.043263][ T9842]  ? do_user_addr_fault+0xc71/0x1340
[   46.043840][ T9842]  __x64_sys_openat+0x138/0x170
[   46.044316][ T9842]  do_syscall_64+0x155/0x510
[   46.044765][ T9842]  ? trace_irq_disable+0x3b/0x140
[   46.045255][ T9842]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   46.045835][ T9842]  ? clear_bhb_loop+0x30/0x80
[   46.046292][ T9842]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   46.046827][ T9842] RIP: 0033:0x43bf52
[   46.047221][ T9842] Code: 08 0f 85 71 ea ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[   46.049024][ T9842] RSP: 002b:00007f2384c85118 EFLAGS: 00000246
ORIG_RAX: 0000000000000101
[   46.049812][ T9842] RAX: ffffffffffffffda RBX: 00007f2384c856c0
RCX: 000000000043bf52
[   46.050546][ T9842] RDX: 0000000000000000 RSI: 00000000004d1b00
RDI: ffffffffffffff9c
[   46.051293][ T9842] RBP: 00007f2384c85140 R08: 0000000000000000
R09: 0000000000000000
[   46.052042][ T9842] R10: 0000000000000000 R11: 0000000000000246
R12: 00007f2384c856c0
[   46.052786][ T9842] R13: 00007ffdc4beb3f0 R14: 00007f2384c85ce4
R15: 00007ffdc4beb4e7
[   46.053608][ T9842]  </TASK>
[   46.054173][ T9842] Kernel Offset: disabled
[   46.054718][ T9842] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data