[BUG] KASAN: slab-use-after-free Read in go7007_usb_read_interrupt

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   52.641036][ T9513] BUG: KASAN: slab-use-after-free in
go7007_usb_read_interrupt+0x5a/0xc0
[   52.641146][ T9513] Read of size 8 at addr ffff88810b989918 by task
repro/9513
[   52.641174][ T9513]
[   52.641217][ T9513] CPU: 1 UID: 0 PID: 9513 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   52.641257][ T9513] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   52.641290][ T9513] Call Trace:
[   52.641312][ T9513]  <TASK>
[   52.641334][ T9513]  dump_stack_lvl+0xe8/0x150
[   52.641374][ T9513]  print_address_description+0x55/0x1e0
[   52.641409][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.641455][ T9513]  print_report+0x58/0x70
[   52.641484][ T9513]  kasan_report+0x117/0x150
[   52.641531][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.641582][ T9513]  go7007_usb_read_interrupt+0x5a/0xc0
[   52.641651][ T9513]  go7007_read_interrupt+0xfd/0x500
[   52.641690][ T9513]  ? usb_control_msg+0x2c1/0x3e0
[   52.641742][ T9513]  ? __pfx_go7007_read_interrupt+0x10/0x10
[   52.641781][ T9513]  ? usb_control_msg+0x2c1/0x3e0
[   52.641815][ T9513]  ? __pfx_autoremove_wake_function+0x10/0x10
[   52.641867][ T9513]  ? go7007_usb_ezusb_write_interrupt+0x265/0x3c0
[   52.641915][ T9513]  ? go7007_usb_ezusb_write_interrupt+0x280/0x3c0
[   52.641965][ T9513]  go7007_read_addr+0xb1/0x140
[   52.642006][ T9513]  go7007_i2c_xfer+0x6e7/0xe90
[   52.642047][ T9513]  ? check_path+0x21/0x40
[   52.642095][ T9513]  ? __pfx_go7007_i2c_xfer+0x10/0x10
[   52.642136][ T9513]  ? lockdep_unlock+0x5c/0xd0
[   52.642170][ T9513]  ? __lock_acquire+0x25db/0x2db0
[   52.642209][ T9513]  ? go7007_smbus_xfer+0xa7/0xf0
[   52.642251][ T9513]  __i2c_smbus_xfer+0x626/0x1f70
[   52.642297][ T9513]  ? __pfx_go7007_smbus_xfer+0x10/0x10
[   52.642344][ T9513]  ? __pfx___i2c_smbus_xfer+0x10/0x10
[   52.642397][ T9513]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   52.642441][ T9513]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   52.642481][ T9513]  ? rt_mutex_lock_nested+0x15c/0x1d0
[   52.642518][ T9513]  i2c_smbus_xfer+0x1f5/0x310
[   52.642564][ T9513]  i2cdev_ioctl_smbus+0x434/0x730
[   52.642616][ T9513]  ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[   52.642663][ T9513]  i2cdev_ioctl+0x615/0x880
[   52.642697][ T9513]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   52.642731][ T9513]  ? __fget_files+0x2a/0x420
[   52.642761][ T9513]  ? __fget_files+0x3a0/0x420
[   52.642795][ T9513]  ? bpf_lsm_file_ioctl+0x9/0x20
[   52.642829][ T9513]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   52.642861][ T9513]  __se_sys_ioctl+0xfc/0x170
[   52.642902][ T9513]  do_syscall_64+0x155/0x510
[   52.642947][ T9513]  ? trace_irq_disable+0x3b/0x140
[   52.642987][ T9513]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   52.643018][ T9513]  ? clear_bhb_loop+0x30/0x80
[   52.643052][ T9513]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   52.643084][ T9513] RIP: 0033:0x426e3d
[   52.643127][ T9513] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   52.643162][ T9513] RSP: 002b:00007f48b7fff130 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   52.643207][ T9513] RAX: ffffffffffffffda RBX: 00007f48b7fff6c0
RCX: 0000000000426e3d
[   52.643232][ T9513] RDX: 00007f48b7fff1a0 RSI: 0000000000000720
RDI: 0000000000000004
[   52.643253][ T9513] RBP: 00007f48b7fff180 R08: 0000000000000000
R09: 0000000000000001
[   52.643273][ T9513] R10: 0000000000000008 R11: 0000000000000246
R12: 00007f48b7fff6c0
[   52.643294][ T9513] R13: 00007ffd4000ef40 R14: 00007f48b7fffce4
R15: 00007ffd4000f037
[   52.643328][ T9513]  </TASK>
[   52.643340][ T9513]
[   52.643354][ T9513] Allocated by task 25:
[   52.643370][ T9513]  kasan_save_track+0x3e/0x80
[   52.643407][ T9513]  __kasan_kmalloc+0x93/0xb0
[   52.643444][ T9513]  __kmalloc_cache_noprof+0x325/0x610
[   52.643479][ T9513]  go7007_usb_probe+0x2f0/0x1f20
[   52.643519][ T9513]  usb_probe_interface+0x71f/0xe00
[   52.643564][ T9513]  really_probe+0x267/0xaf0
[   52.643596][ T9513]  __driver_probe_device+0x1e2/0x350
[   52.643639][ T9513]  driver_probe_device+0x4f/0x240
[   52.643670][ T9513]  __device_attach_driver+0x270/0x410
[   52.643702][ T9513]  bus_for_each_drv+0x258/0x2f0
[   52.643741][ T9513]  __device_attach+0x2c5/0x450
[   52.643769][ T9513]  device_initial_probe+0xa1/0xd0
[   52.643799][ T9513]  bus_probe_device+0x12a/0x220
[   52.643837][ T9513]  device_add+0x7ec/0xb90
[   52.643861][ T9513]  usb_set_configuration+0x1a87/0x2110
[   52.643898][ T9513]  usb_generic_driver_probe+0x8d/0x150
[   52.643934][ T9513]  usb_probe_device+0x1c4/0x3b0
[   52.643971][ T9513]  really_probe+0x267/0xaf0
[   52.644001][ T9513]  __driver_probe_device+0x1e2/0x350
[   52.644032][ T9513]  driver_probe_device+0x4f/0x240
[   52.644063][ T9513]  __device_attach_driver+0x270/0x410
[   52.644095][ T9513]  bus_for_each_drv+0x258/0x2f0
[   52.644133][ T9513]  __device_attach+0x2c5/0x450
[   52.644161][ T9513]  device_initial_probe+0xa1/0xd0
[   52.644190][ T9513]  bus_probe_device+0x12a/0x220
[   52.644229][ T9513]  device_add+0x7ec/0xb90
[   52.644253][ T9513]  usb_new_device+0xa14/0x1720
[   52.644282][ T9513]  hub_event+0x2a1c/0x4f30
[   52.644315][ T9513]  process_scheduled_works+0xc99/0x1900
[   52.644361][ T9513]  worker_thread+0xa53/0xfc0
[   52.644387][ T9513]  kthread+0x38b/0x480
[   52.644420][ T9513]  ret_from_fork+0x514/0xb70
[   52.644452][ T9513]  ret_from_fork_asm+0x1a/0x30
[   52.644486][ T9513]
[   52.644493][ T9513] Freed by task 9528:
[   52.644507][ T9513]  kasan_save_track+0x3e/0x80
[   52.644542][ T9513]  kasan_save_free_info+0x46/0x50
[   52.644570][ T9513]  __kasan_slab_free+0x5c/0x80
[   52.644625][ T9513]  kfree+0x1c5/0x650
[   52.644651][ T9513]  go7007_remove+0x82/0x150
[   52.644686][ T9513]  v4l2_device_put+0x81/0xd0
[   52.644725][ T9513]  usb_unbind_interface+0x26e/0x910
[   52.644762][ T9513]  device_release_driver_internal+0x4d9/0x870
[   52.644795][ T9513]  unbind_store+0x1a1/0x1d0
[   52.644819][ T9513]  kernfs_fop_write_iter+0x3af/0x540
[   52.644862][ T9513]  vfs_write+0x61d/0xb90
[   52.644891][ T9513]  ksys_write+0x150/0x270
[   52.644920][ T9513]  do_syscall_64+0x155/0x510
[   52.644961][ T9513]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   52.644990][ T9513]
[   52.644997][ T9513] The buggy address belongs to the object at
ffff88810b989800
[   52.644997][ T9513]  which belongs to the cache kmalloc-512 of size 512
[   52.645040][ T9513] The buggy address is located 280 bytes inside of
[   52.645040][ T9513]  freed 512-byte region [ffff88810b989800,
ffff88810b989a00)
[   52.645073][ T9513]
[   52.645081][ T9513] The buggy address belongs to the physical page:
[   52.645112][ T9513] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x10b988
[   52.645143][ T9513] head: order:2 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[   52.645169][ T9513] flags:
0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   52.645212][ T9513] page_type: f5(slab)
[   52.645249][ T9513] raw: 057ff00000000040 ffff88801b041c80
dead000000000100 dead000000000122
[   52.645276][ T9513] raw: 0000000000000000 0000000000100010
00000000f5000000 0000000000000000
[   52.645304][ T9513] head: 057ff00000000040 ffff88801b041c80
dead000000000100 dead000000000122
[   52.645329][ T9513] head: 0000000000000000 0000000000100010
00000000f5000000 0000000000000000
[   52.645356][ T9513] head: 057ff00000000002 ffffffffffffff01
00000000ffffffff 00000000ffffffff
[   52.645382][ T9513] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000004
[   52.645398][ T9513] page dumped because: kasan: bad access detected
[   52.645420][ T9513] page_owner tracks the page as allocated
[   52.645432][ T9513] page last allocated via order 2, migratetype
Unmovable, gfp_mask
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 5043, tgid 5043 (udevadm), ts 19171820541
[   52.645484][ T9513]  post_alloc_hook+0x1f9/0x250
[   52.645515][ T9513]  get_page_from_freelist+0x235a/0x23e0
[   52.645553][ T9513]  __alloc_frozen_pages_noprof+0x217/0x5a0
[   52.645590][ T9513]  allocate_slab+0x7d/0x610
[   52.645630][ T9513]  refill_objects+0x2d6/0x350
[   52.645655][ T9513]  __pcs_replace_empty_main+0x2c9/0x6c0
[   52.645696][ T9513]  __kmalloc_cache_noprof+0x3a5/0x610
[   52.645729][ T9513]  kernfs_fop_open+0x3f0/0xda0
[   52.645769][ T9513]  do_dentry_open+0x822/0x13a0
[   52.645808][ T9513]  vfs_open+0x3b/0x340
[   52.645845][ T9513]  path_openat+0x1569/0x1f30
[   52.645890][ T9513]  do_file_open+0x23e/0x4a0
[   52.645915][ T9513]  do_sys_openat2+0x115/0x200
[   52.645947][ T9513]  __x64_sys_openat+0x138/0x170
[   52.645980][ T9513]  do_syscall_64+0x155/0x510
[   52.646012][ T9513]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   52.646035][ T9513] page last free pid 5008 tgid 5008 ts
18799667384 stack trace:
[   52.646053][ T9513]  free_pages_prepare+0xa03/0xb00
[   52.646076][ T9513]  __free_contig_range_common+0x174/0x340
[   52.646110][ T9513]  free_pages_bulk+0x48/0x120
[   52.646138][ T9513]  vfree+0x231/0x470
[   52.646158][ T9513]  delayed_vfree_work+0x55/0x80
[   52.646184][ T9513]  process_scheduled_works+0xc99/0x1900
[   52.646219][ T9513]  worker_thread+0xa53/0xfc0
[   52.646240][ T9513]  kthread+0x38b/0x480
[   52.646265][ T9513]  ret_from_fork+0x514/0xb70
[   52.646290][ T9513]  ret_from_fork_asm+0x1a/0x30
[   52.646317][ T9513]
[   52.646323][ T9513] Memory state around the buggy address:
[   52.646336][ T9513]  ffff88810b989800: fa fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   52.646352][ T9513]  ffff88810b989880: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   52.646369][ T9513] >ffff88810b989900: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   52.646381][ T9513]                             ^
[   52.646394][ T9513]  ffff88810b989980: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   52.646410][ T9513]  ffff88810b989a00: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[   52.646422][ T9513]
==================================================================
[   52.646480][ T9513] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   52.744427][ T9513] CPU: 1 UID: 0 PID: 9513 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   52.745433][ T9513] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   52.746540][ T9513] Call Trace:
[   52.746878][ T9513]  <TASK>
[   52.747153][ T9513]  vpanic+0x56d/0xa60
[   52.747527][ T9513]  ? __pfx_vpanic+0x10/0x10
[   52.747948][ T9513]  ? irqentry_exit+0x218/0x760
[   52.748395][ T9513]  panic+0xc5/0xd0
[   52.748749][ T9513]  ? __pfx_panic+0x10/0x10
[   52.749159][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.749694][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.750208][ T9513]  check_panic_on_warn+0x89/0xb0
[   52.750669][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.751183][ T9513]  end_report+0x73/0x170
[   52.751578][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.752096][ T9513]  kasan_report+0x128/0x150
[   52.752516][ T9513]  ? go7007_usb_read_interrupt+0x5a/0xc0
[   52.753032][ T9513]  go7007_usb_read_interrupt+0x5a/0xc0
[   52.753534][ T9513]  go7007_read_interrupt+0xfd/0x500
[   52.754014][ T9513]  ? usb_control_msg+0x2c1/0x3e0
[   52.754472][ T9513]  ? __pfx_go7007_read_interrupt+0x10/0x10
[   52.755006][ T9513]  ? usb_control_msg+0x2c1/0x3e0
[   52.755459][ T9513]  ? __pfx_autoremove_wake_function+0x10/0x10
[   52.756087][ T9513]  ? go7007_usb_ezusb_write_interrupt+0x265/0x3c0
[   52.756677][ T9513]  ? go7007_usb_ezusb_write_interrupt+0x280/0x3c0
[   52.757262][ T9513]  go7007_read_addr+0xb1/0x140
[   52.757707][ T9513]  go7007_i2c_xfer+0x6e7/0xe90
[   52.758148][ T9513]  ? check_path+0x21/0x40
[   52.758550][ T9513]  ? __pfx_go7007_i2c_xfer+0x10/0x10
[   52.759038][ T9513]  ? lockdep_unlock+0x5c/0xd0
[   52.759488][ T9513]  ? __lock_acquire+0x25db/0x2db0
[   52.759954][ T9513]  ? go7007_smbus_xfer+0xa7/0xf0
[   52.760410][ T9513]  __i2c_smbus_xfer+0x626/0x1f70
[   52.760872][ T9513]  ? __pfx_go7007_smbus_xfer+0x10/0x10
[   52.761371][ T9513]  ? __pfx___i2c_smbus_xfer+0x10/0x10
[   52.761867][ T9513]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   52.762402][ T9513]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   52.762958][ T9513]  ? rt_mutex_lock_nested+0x15c/0x1d0
[   52.763475][ T9513]  i2c_smbus_xfer+0x1f5/0x310
[   52.763936][ T9513]  i2cdev_ioctl_smbus+0x434/0x730
[   52.764423][ T9513]  ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[   52.764966][ T9513]  i2cdev_ioctl+0x615/0x880
[   52.765383][ T9513]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   52.765865][ T9513]  ? __fget_files+0x2a/0x420
[   52.766356][ T9513]  ? __fget_files+0x3a0/0x420
[   52.766813][ T9513]  ? bpf_lsm_file_ioctl+0x9/0x20
[   52.767293][ T9513]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   52.767782][ T9513]  __se_sys_ioctl+0xfc/0x170
[   52.768233][ T9513]  do_syscall_64+0x155/0x510
[   52.768686][ T9513]  ? trace_irq_disable+0x3b/0x140
[   52.769170][ T9513]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   52.769743][ T9513]  ? clear_bhb_loop+0x30/0x80
[   52.770176][ T9513]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   52.770716][ T9513] RIP: 0033:0x426e3d
[   52.771080][ T9513] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   52.772803][ T9513] RSP: 002b:00007f48b7fff130 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   52.773578][ T9513] RAX: ffffffffffffffda RBX: 00007f48b7fff6c0
RCX: 0000000000426e3d
[   52.774348][ T9513] RDX: 00007f48b7fff1a0 RSI: 0000000000000720
RDI: 0000000000000004
[   52.775103][ T9513] RBP: 00007f48b7fff180 R08: 0000000000000000
R09: 0000000000000001
[   52.775895][ T9513] R10: 0000000000000008 R11: 0000000000000246
R12: 00007f48b7fff6c0
[   52.776679][ T9513] R13: 00007ffd4000ef40 R14: 00007f48b7fffce4
R15: 00007ffd4000f037
[   52.777430][ T9513]  </TASK>
[   52.778415][ T9513] Kernel Offset: disabled
[   52.778969][ T9513] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data