[BUG] general protection fault in usbip_recv_xbuff

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   43.862608][ T9503] KASAN: null-ptr-deref in range
[0x0000000000000118-0x000000000000011f]
[   43.863617][ T9503] CPU: 0 UID: 0 PID: 9503 Comm: vudc_rx Not
tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   43.864586][ T9503] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   43.865607][ T9503] RIP: 0010:__dev_printk+0x6e/0x190
[   43.867655][ T9503] Code: 00 fc ff df 49 ff c7 4c 89 f8 48 c1 e8 03
42 0f b6 04 28 84 c0 0f 85 16 01 00 00 41 0f b6 2f 4d 8d 7e 68 4c 89
f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 63 c7 1b fc 4d 8b 3f
4d 85 ff 75
[   43.869424][ T9503] RSP: 0018:ffffc90007987aa8 EFLAGS: 00010202
[   43.870016][ T9503] RAX: 0000000000000023 RBX: ffffc90007987b40
RCX: 000000008c764501
[   43.870738][ T9503] RDX: 0000000000000000 RSI: 00000000000000b0
RDI: ffffffff8c764560
[   43.872458][ T9503] RBP: 0000000000000033 R08: ffffc90007987b77
R09: 0000000000000000
[   43.873303][ T9503] R10: ffffc90007987b60 R11: fffff52000f30f6f
R12: ffffc90007987b20
[   43.874080][ T9503] R13: dffffc0000000000 R14: 00000000000000b0
R15: 0000000000000118
[   43.874817][ T9503] FS:  0000000000000000(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   43.875620][ T9503] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.876214][ T9503] CR2: 000055f3e6a0e240 CR3: 000000010f232000
CR4: 0000000000752ef0
[   43.876936][ T9503] PKRU: 55555554
[   43.877267][ T9503] Call Trace:
[   43.877581][ T9503]  <TASK>
[   43.877861][ T9503]  _dev_err+0x11e/0x180
[   43.878251][ T9503]  ? __pfx_usbip_recv+0x10/0x10
[   43.879498][ T9503]  ? __pfx__dev_err+0x10/0x10
[   43.879940][ T9503]  ? rcu_is_watching+0x16/0xb0
[   43.880386][ T9503]  ? trace_kmalloc+0x2a/0xf0
[   43.880819][ T9503]  usbip_recv_xbuff+0x547/0x620
[   43.881332][ T9503]  ? v_rx_loop+0x685/0xd90
[   43.881791][ T9503]  ? kmemdup_noprof+0x55/0x70
[   43.882295][ T9503]  ? __asan_memcpy+0x40/0x70
[   43.882787][ T9503]  v_rx_loop+0x84d/0xd90
[   43.883238][ T9503]  ? __pfx_v_rx_loop+0x10/0x10
[   43.883771][ T9503]  ? __kthread_parkme+0x7a/0x200
[   43.884292][ T9503]  kthread+0x38b/0x480
[   43.884733][ T9503]  ? __pfx_v_rx_loop+0x10/0x10
[   43.885223][ T9503]  ? __pfx_kthread+0x10/0x10
[   43.885711][ T9503]  ret_from_fork+0x514/0xb70
[   43.886199][ T9503]  ? __pfx_ret_from_fork+0x10/0x10
[   43.886731][ T9503]  ? __switch_to+0xc79/0x1410
[   43.887198][ T9503]  ? __pfx_kthread+0x10/0x10
[   43.887661][ T9503]  ret_from_fork_asm+0x1a/0x30
[   43.888142][ T9503]  </TASK>
[   43.888447][ T9503] Modules linked in:
[   43.888884][ T9503] ---[ end trace 0000000000000000 ]---
[   43.889649][ T9503] RIP: 0010:__dev_printk+0x6e/0x190
[   43.889659][ T9503] Code: 00 fc ff df 49 ff c7 4c 89 f8 48 c1 e8 03
42 0f b6 04 28 84 c0 0f 85 16 01 00 00 41 0f b6 2f 4d 8d 7e 68 4c 89
f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 63 c7 1b fc 4d 8b 3f
4d 85 ff 75
[   43.889665][ T9503] RSP: 0018:ffffc90007987aa8 EFLAGS: 00010202
[   43.889672][ T9503] RAX: 0000000000000023 RBX: ffffc90007987b40
RCX: 000000008c764501
[   43.889677][ T9503] RDX: 0000000000000000 RSI: 00000000000000b0
RDI: ffffffff8c764560
[   43.889682][ T9503] RBP: 0000000000000033 R08: ffffc90007987b77
R09: 0000000000000000
[   43.889687][ T9503] R10: ffffc90007987b60 R11: fffff52000f30f6f
R12: ffffc90007987b20
[   43.889692][ T9503] R13: dffffc0000000000 R14: 00000000000000b0
R15: 0000000000000118
[   43.889697][ T9503] FS:  0000000000000000(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   43.889703][ T9503] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.889708][ T9503] CR2: 000055f3e6a0e240 CR3: 000000010f232000
CR4: 0000000000752ef0
[   43.889715][ T9503] PKRU: 55555554
[   43.889721][ T9503] Kernel panic - not syncing: Fatal exception
[   43.900522][ T9503] Kernel Offset: disabled
[   43.901129][ T9503] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data