Re: KASAN: slab-out-of-bounds Read in vhci_hub_control
From: Dmitry Vyukov
Date: Wed Oct 10 2018 - 15:42:43 EST
On Tue, Oct 2, 2018 at 6:04 PM, Shuah Khan <shuah@xxxxxxxxxx> wrote:
> On 09/04/2018 12:52 PM, syzbot wrote:
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit: 420f51f4ab6b Merge tag 'arm64-fixes' of git://git.kernel.o..
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=126a6f0e400000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=531a917630d2a492
>> dashboard link: https://syzkaller.appspot.com/bug?extid=bccc1fe10b70fadc78d0
>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121caa46400000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14ed8ab6400000
>
> C producer doesn't reproduce the problem on 4.19-rc5. Does this C producer
> depend on state of the machine? i.e what is the status of vhci_hcd - are
> there any devices attached?
>
> I can see the problem looking at the code and fix is easy. However, I would
> like be able to reproduce it and verify the fix works. Also this would be a
> good regression for the driver I could consider adding to selftests.
Are you sure you used the provided config/commit?
I've followed these instructions:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#crash-does-not-reproduce
and the C repro gave me this in a second:
[ 57.259910] ==================================================================
[ 57.262304] BUG: KASAN: slab-out-of-bounds in vhci_hub_control+0x169c/0x1a70
[ 57.264508] Read of size 4 at addr ffff880064641fbc by task a.out/4253
[ 57.266581]
[ 57.267093] CPU: 3 PID: 4253 Comm: a.out Not tainted 4.19.0-rc5+ #13
[ 57.269107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.10.2-1 04/01/2014
[ 57.271324] Call Trace:
[ 57.271786] dump_stack+0x1af/0x295
[ 57.272449] ? arch_local_irq_restore+0x53/0x53
[ 57.273249] ? kmsg_dump_rewind_nolock+0xe4/0xe4
[ 57.274049] ? trace_hardirqs_off_caller+0x270/0x270
[ 57.274920] print_address_description+0x73/0x250
[ 57.275735] kasan_report+0x256/0x380
[ 57.276373] ? vhci_hub_control+0x169c/0x1a70
[ 57.277139] __asan_report_load4_noabort+0x14/0x20
[ 57.277982] vhci_hub_control+0x169c/0x1a70
[ 57.278731] ? vhci_hcd_probe+0x330/0x330
[ 57.279453] ? rcu_read_lock_sched_held+0x108/0x120
[ 57.280308] ? __kmalloc+0x312/0x710
[ 57.280945] ? kasan_check_write+0x14/0x20
[ 57.281669] ? do_raw_spin_lock+0xc1/0x230
[ 57.282425] ? usb_hcd_submit_urb+0x689/0x1e70
[ 57.283209] usb_hcd_submit_urb+0x161f/0x1e70
[ 57.283967] ? vhci_hcd_probe+0x330/0x330
[ 57.284672] ? __asan_alloca_poison+0x14/0xa0
[ 57.285437] ? usb_create_hcd+0x40/0x40
[ 57.286113] ? __x64_sys_ioctl+0x73/0xb0
[ 57.286810] ? do_syscall_64+0x192/0x770
[ 57.287502] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 57.288413] ? find_held_lock+0x35/0x1d0
[ 57.289104] ? __lockdep_init_map+0xe4/0x650
[ 57.289856] ? __lockdep_init_map+0xe4/0x650
[ 57.290611] ? lockdep_init_map+0x9/0x10
[ 57.291303] usb_submit_urb+0x829/0x11a0
[ 57.292017] ? rcu_pm_notify+0xc0/0xc0
[ 57.292676] usb_start_wait_urb+0x140/0x330
[ 57.293422] ? sg_clean+0x220/0x220
[ 57.294046] usb_control_msg+0x334/0x4c0
[ 57.294779] ? usb_start_wait_urb+0x330/0x330
[ 57.295542] proc_control+0x913/0xe50
[ 57.296189] ? proc_bulk+0x9d0/0x9d0
[ 57.296822] usbdev_do_ioctl+0x2260/0x3690
[ 57.297576] ? processcompl_compat+0x5e0/0x5e0
[ 57.298366] ? mark_held_locks+0x100/0x100
[ 57.299086] ? futex_wait_setup+0x410/0x410
[ 57.299821] ? kasan_check_write+0x14/0x20
[ 57.300539] ? wake_up_q+0x9d/0xf0
[ 57.301139] ? drop_futex_key_refs.isra.14+0x71/0xc0
[ 57.302016] ? futex_wake+0x2e5/0x6b0
[ 57.302671] ? lock_downgrade+0x9a0/0x9a0
[ 57.303372] ? check_noncircular+0x20/0x20
[ 57.304115] ? kasan_check_read+0x11/0x20
[ 57.304816] ? do_futex+0x874/0x22c0
[ 57.305445] ? find_held_lock+0x35/0x1d0
[ 57.306130] ? lock_acquire+0x1db/0x520
[ 57.306834] ? lock_downgrade+0x9a0/0x9a0
[ 57.307535] ? kasan_check_read+0x11/0x20
[ 57.308231] ? rcu_is_watching+0x8c/0x150
[ 57.308930] ? rcu_cleanup_dead_rnp+0x210/0x210
[ 57.309724] ? __fget+0x428/0x660
[ 57.310310] ? iterate_fd+0x400/0x400
[ 57.310957] ? kasan_check_write+0x14/0x20
[ 57.311670] ? do_raw_spin_lock+0xc1/0x230
[ 57.312396] ? trace_hardirqs_off+0x9c/0x280
[ 57.313135] ? usbdev_compat_ioctl+0x30/0x30
[ 57.313871] usbdev_ioctl+0x25/0x30
[ 57.314488] do_vfs_ioctl+0x1c2/0x15b0
[ 57.315147] ? rcu_is_watching+0x8c/0x150
[ 57.315839] ? trace_hardirqs_on+0xa1/0x280
[ 57.316564] ? ioctl_preallocate+0x2d0/0x2d0
[ 57.317302] ? __fget_light+0x2c4/0x410
[ 57.317968] ? fget_raw+0x20/0x20
[ 57.318561] ? putname+0xee/0x130
[ 57.319140] ? rcu_read_lock_sched_held+0x108/0x120
[ 57.319987] ? kmem_cache_free+0x21d/0x270
[ 57.320702] ? __x64_sys_futex+0x344/0x4b0
[ 57.321411] ? do_syscall_64+0x9a/0x770
[ 57.322082] ? do_syscall_64+0x9a/0x770
[ 57.322780] ? lockdep_hardirqs_on+0x421/0x5c0
[ 57.323541] ? security_file_ioctl+0x87/0xb0
[ 57.324268] ksys_ioctl+0x94/0xb0
[ 57.324837] __x64_sys_ioctl+0x73/0xb0
[ 57.325478] do_syscall_64+0x192/0x770
[ 57.326117] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 57.327038] ? syscall_return_slowpath+0x560/0x560
[ 57.327880] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 57.328709] ? trace_hardirqs_on+0x280/0x280
[ 57.329462] ? prepare_exit_to_usermode+0x360/0x360
[ 57.330319] ? recalc_sigpending_tsk+0x150/0x150
[ 57.331148] ? prepare_exit_to_usermode+0x22f/0x360
[ 57.332006] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 57.332843] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 57.333731] RIP: 0033:0x4417c9
[ 57.334280] Code: e8 9c 5a 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00
00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b 9c fc ff c3 66 2e 0f 1f 84 00 00
00 00
[ 57.337498] RSP: 002b:00007ff768d47d78 EFLAGS: 00000246 ORIG_RAX:
0000000000000010
[ 57.338782] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004417c9
[ 57.339980] RDX: 0000000020000100 RSI: 00000000c0185500 RDI: 0000000000000003
[ 57.341179] RBP: 00007ff768d47da0 R08: 0000000000000000 R09: 0000000000000000
[ 57.342411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 57.343607] R13: 00007ffdc26d041f R14: 00007ff768d48700 R15: 0000000000000000
[ 57.344809]
[ 57.345081] Allocated by task 4081:
[ 57.345684] save_stack+0x43/0xd0
[ 57.346257] kasan_kmalloc+0xad/0xe0
[ 57.346877] kasan_slab_alloc+0x12/0x20
[ 57.347518] kmem_cache_alloc+0x12e/0x700
[ 57.348192] getname_flags+0xcb/0x580
[ 57.348810] __x64_sys_unlinkat+0x9e/0x100
[ 57.349502] do_syscall_64+0x192/0x770
[ 57.350139] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 57.350985]
[ 57.351252] Freed by task 4081:
[ 57.351790] save_stack+0x43/0xd0
[ 57.352358] __kasan_slab_free+0x11a/0x170
[ 57.353050] kasan_slab_free+0xe/0x10
[ 57.353677] kmem_cache_free+0x83/0x270
[ 57.354325] putname+0xee/0x130
[ 57.354876] filename_parentat+0x46d/0x570
[ 57.355566] do_unlinkat+0x160/0x970
[ 57.356169] __x64_sys_unlinkat+0xa8/0x100
[ 57.356865] do_syscall_64+0x192/0x770
[ 57.357498] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 57.358351]
[ 57.358630] The buggy address belongs to the object at ffff880064640880
[ 57.358630] which belongs to the cache names_cache of size 4096
[ 57.360718] The buggy address is located 1852 bytes to the right of
[ 57.360718] 4096-byte region [ffff880064640880, ffff880064641880)
[ 57.362785] The buggy address belongs to the page:
[ 57.363599] page:ffffea0001919000 count:1 mapcount:0
mapping:ffff88006c56bd80 index:0x0 compound_mapcount: 0
[ 57.365241] flags: 0x1fffc0000008100(slab|head)
[ 57.366014] raw: 01fffc0000008100 ffffea0001764388 ffffea0001ac7b08
ffff88006c56bd80
[ 57.367322] raw: 0000000000000000 ffff880064640880 0000000100000001
0000000000000000
[ 57.368608] page dumped because: kasan: bad access detected
[ 57.369518]
[ 57.369796] Memory state around the buggy address:
[ 57.370638] ffff880064641e80: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 57.371838] ffff880064641f00: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 57.373132] >ffff880064641f80: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 57.374320] ^
[ 57.375179] ffff880064642000: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 57.376380] ffff880064642080: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 57.377563] ==================================================================