Message-ID: <CAB7eex+X4ZQYkLLjVyNoqK2O9_tV8cnsrcgBNewSoibz93Vb-g@mail.gmail.com>
Date:   Wed, 10 Aug 2022 20:49:29 +0800
From:   Rondreis <linhaoguo86@...il.com>
To:     justin@...aid.com, axboe@...nel.dk, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     xyru1999@...il.com
Subject: warn in usb_stor_pre_reset in linux v5.18

Hello,

When fuzzing the Linux kernel driver v5.18.0, the following crash was triggered.

HEAD commit: 4b0986a3613c92f4ec1bdc7f60ec66fea135991f (HEAD, tag: v5.18)
git tree: upstream

kernel config: https://pastebin.com/KecL2gaG
C reproducer: https://pastebin.com/9PQvFCiy
console output: https://pastebin.com/XyBzBX2F

Basically, in the c reproducer, we use the gadget module to emulate
the process of attaching a usb device (vendor id: 0x13d3, product id:
0x3340, with function: ms_null and midi_null).
To reproduce this crash, we utilize a third-party library to emulate
the attaching process: https://github.com/linux-usb-gadgets/libusbgx.
Just clone this repository, make install it, and compile the c
reproducer with ``` gcc crash.c -lusbgx -o crash ``` will do the
trick.

It seems that when dev_set_drvdata allocate a space and
smsusb_term_device tries to free it, while there is a UAF happened in
smsusb_term_device and eventually affect the dummy_timer, cause kernel
produce such error message.

The crash report is as follow:

```
==================================================================
BUG: KASAN: use-after-free in dummy_timer+0x2a37/0x33b0
drivers/block/aoe/aoenet.c:163
Read of size 4 at addr ffff88801aa1e814 by task syz-fuzzer/2931

CPU: 0 PID: 2931 Comm: syz-fuzzer Not tainted 5.18.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:313 [inline]
print_report.cold+0xe5/0x659 mm/kasan/report.c:429
kasan_report+0x8a/0x1b0 mm/kasan/report.c:491
dummy_timer+0x2a37/0x33b0 drivers/block/aoe/aoenet.c:163
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers kernel/time/timer.c:1790 [inline]
__run_timers kernel/time/timer.c:1763 [inline]
run_timer_softirq+0x1084/0x16d0 kernel/time/timer.c:1803
__do_softirq+0x1c0/0x8ee kernel/softirq.c:571
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu kernel/softirq.c:650 [inline]
irq_exit_rcu+0xe2/0x120 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:unwind_get_return_address arch/x86/kernel/unwind_orc.c:318 [inline]
RIP: 0010:unwind_get_return_address+0x5a/0xa0 arch/x86/kernel/unwind_orc.c:313
Code: 05 5b 31 c0 5d c3 48 8d 6b 48 48 b8 00 00 00 00 00 fc ff df 48
89 ea 48 c1 ea 03 80 3c 02 00 75 32 48 8b 7b 48 e8 56 5d 0b 00 <85> c0
74 d3 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 80
RSP: 0018:ffffc90000e9f5f8 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffc90000e9f610 RCX: 0000000000000000
RDX: 1ffff920001d3ecb RSI: 0000000000000000 RDI: ffffffff81ed3c4f
RBP: ffffc90000e9f658 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc90000e9f66f R11: 000000000005203e R12: ffffc90000e9f6c8
R13: 0000000000000000 R14: ffff888104ce5580 R15: 0000000000001000
arch_stack_walk+0x93/0xe0 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:368 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0x105/0x170 mm/kasan/common.c:374
kfree+0xcd/0x450 mm/slab.c:3795
tomoyo_realpath_from_path+0x191/0x620 security/tomoyo/realpath.c:291
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x219/0x420 security/tomoyo/file.c:822
security_inode_getattr+0xcf/0x140 security/security.c:1344
vfs_getattr+0x22/0x60 fs/stat.c:157
vfs_statx+0x170/0x360 fs/stat.c:232
vfs_fstatat+0x8c/0xb0 fs/stat.c:255
__do_sys_newfstatat+0x91/0x110 fs/stat.c:425
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x49d50a
Code: e8 1b 99 fc ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 4c
8b 54 24 28 4c 8b 44 24 30 4c 8b 4c 24 38 48 8b 44 24 08 0f 05 <48> 3d
01 f0 ff ff 76 20 48 c7 44 24 40 ff ff ff ff 48 c7 44 24 48
RSP: 002b:000000c0000e5d20 EFLAGS: 00000206 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 000000c000026f00 RCX: 000000000049d50a
RDX: 000000c000e7c1d8 RSI: 000000c000e6d770 RDI: ffffffffffffff9c
RBP: 000000c0000e5db0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 000000c00b596820 R15: 0000000000000177
</TASK>

Allocated by task 6:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
set_alloc_info mm/kasan/common.c:435 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0x81/0xa0 mm/kasan/common.c:524
slab_want_init_on_alloc mm/slab.h:839 [inline]
slab_want_init_on_alloc mm/slab.h:832 [inline]
slab_alloc mm/slab.c:3299 [inline]
kmem_cache_alloc_trace+0x20b/0x450 mm/slab.c:3567
dev_set_drvdata include/linux/device.h:766 [inline]
usb_set_intfdata include/linux/usb.h:270 [inline]
smsusb_init_device+0xb2/0xb07 drivers/media/usb/siano/smsusb.c:400
smsusb_probe+0xda2/0xe3f drivers/media/usb/siano/smsusb.c:566
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:555 [inline]
really_probe drivers/base/dd.c:634 [inline]
really_probe+0x23e/0xa00 drivers/base/dd.c:579
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x26d/0x3f0 drivers/base/dd.c:989
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc45/0x1d40 drivers/base/core.c:3412
usb_set_configuration+0x1019/0x1900 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2a0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:555 [inline]
really_probe drivers/base/dd.c:634 [inline]
really_probe+0x23e/0xa00 drivers/base/dd.c:579
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x26d/0x3f0 drivers/base/dd.c:989
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc45/0x1d40 drivers/base/core.c:3412
usb_new_device.cold+0x4b8/0x10ca drivers/usb/core/hub.c:2566
hub_port_connect drivers/usb/core/hub.c:5359 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
port_event drivers/usb/core/hub.c:5663 [inline]
hub_event+0x231e/0x4170 drivers/usb/core/hub.c:5745
process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289
worker_thread+0x623/0x1070 kernel/workqueue.c:2436
kthread+0x2ef/0x3a0 kernel/kthread.c:346
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Freed by task 6:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:368 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0x105/0x170 mm/kasan/common.c:374
kfree+0xcd/0x450 mm/slab.c:3795
smsusb_term_device+0xd6/0x160 drivers/media/usb/siano/smsusb.c:350
smsusb_init_device+0xa80/0xb07 drivers/media/usb/siano/smsusb.c:494
smsusb_probe+0xda2/0xe3f drivers/media/usb/siano/smsusb.c:566
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:555 [inline]
really_probe drivers/base/dd.c:634 [inline]
really_probe+0x23e/0xa00 drivers/base/dd.c:579
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x26d/0x3f0 drivers/base/dd.c:989
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc45/0x1d40 drivers/base/core.c:3412
usb_set_configuration+0x1019/0x1900 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:238
usb_probe_device+0xd9/0x2a0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:555 [inline]
really_probe drivers/base/dd.c:634 [inline]
really_probe+0x23e/0xa00 drivers/base/dd.c:579
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
__device_attach+0x26d/0x3f0 drivers/base/dd.c:989
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
device_add+0xc45/0x1d40 drivers/base/core.c:3412
usb_new_device.cold+0x4b8/0x10ca drivers/usb/core/hub.c:2566
hub_port_connect drivers/usb/core/hub.c:5359 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
port_event drivers/usb/core/hub.c:5663 [inline]
hub_event+0x231e/0x4170 drivers/usb/core/hub.c:5745
process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289
worker_thread+0x623/0x1070 kernel/workqueue.c:2436
kthread+0x2ef/0x3a0 kernel/kthread.c:346
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xa1/0xb0 mm/kasan/generic.c:188
insert_work+0x4a/0x390 kernel/workqueue.c:1358
__queue_work+0x4dd/0x1140 kernel/workqueue.c:1517
queue_work_on+0xee/0x110 kernel/workqueue.c:1545
queue_work include/linux/workqueue.h:502 [inline]
schedule_work include/linux/workqueue.h:563 [inline]
smsusb_onresponse+0x594/0x780 drivers/media/usb/siano/smsusb.c:147
__usb_hcd_giveback_urb+0x2c2/0x5a0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
__skb_queue_head_init include/linux/skbuff.h:2272 [inline]
skbpoolfree drivers/block/aoe/aoedev.c:434 [inline]
freedev drivers/block/aoe/aoedev.c:289 [inline]
dummy_timer+0x1267/0x33b0 drivers/block/aoe/aoedev.c:365
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers kernel/time/timer.c:1790 [inline]
__run_timers kernel/time/timer.c:1763 [inline]
run_timer_softirq+0x1084/0x16d0 kernel/time/timer.c:1803
__do_softirq+0x1c0/0x8ee kernel/softirq.c:571

Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xa1/0xb0 mm/kasan/generic.c:188
insert_work+0x4a/0x390 kernel/workqueue.c:1358
__queue_work+0x4dd/0x1140 kernel/workqueue.c:1517
queue_work_on+0xee/0x110 kernel/workqueue.c:1545
queue_work include/linux/workqueue.h:502 [inline]
schedule_work include/linux/workqueue.h:563 [inline]
smsusb_onresponse+0x594/0x780 drivers/media/usb/siano/smsusb.c:147
__usb_hcd_giveback_urb+0x2c2/0x5a0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
__skb_queue_head_init include/linux/skbuff.h:2272 [inline]
skbpoolfree drivers/block/aoe/aoedev.c:434 [inline]
freedev drivers/block/aoe/aoedev.c:289 [inline]
dummy_timer+0x1267/0x33b0 drivers/block/aoe/aoedev.c:365
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers kernel/time/timer.c:1790 [inline]
__run_timers kernel/time/timer.c:1763 [inline]
run_timer_softirq+0x1084/0x16d0 kernel/time/timer.c:1803
__do_softirq+0x1c0/0x8ee kernel/softirq.c:571

The buggy address belongs to the object at ffff88801aa1e000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 2068 bytes inside of
4096-byte region [ffff88801aa1e000, ffff88801aa1f000)

The buggy address belongs to the physical page:
page:ffffea00006a8600 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x1aa18
head:ffffea00006a8600 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x100000000010200(slab|head|node=0|zone=1)
raw: 0100000000010200 0000000000000000 dead000000000001 ffff888100043040
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask
0x1d2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL),
pid 2918, tgid 2918 (syz-fuzzer), ts 369046599373, free_ts
368942090992
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2449 [inline]
prep_new_page+0x297/0x330 mm/page_alloc.c:2456
local_lock_release include/linux/local_lock_internal.h:36 [inline]
rmqueue_pcplist mm/page_alloc.c:3703 [inline]
rmqueue mm/page_alloc.c:3730 [inline]
get_page_from_freelist+0x122b/0x27d0 mm/page_alloc.c:4195
alloc_flags_nofragment mm/page_alloc.c:4057 [inline]
__alloc_pages+0x2d5/0x6c0 mm/page_alloc.c:5423
alloc_pages+0x119/0x250 mm/mempolicy.c:2272
new_slab+0x2a9/0x3f0
___slab_alloc+0xc62/0x1080
__slab_alloc.isra.0+0x4d/0xa0
page_fixed_fake_head include/linux/page-flags.h:246 [inline]
_compound_head include/linux/page-flags.h:276 [inline]
virt_to_folio include/linux/mm.h:855 [inline]
virt_to_slab mm/slab.h:175 [inline]
memcg_slab_post_alloc_hook mm/slab.h:529 [inline]
slab_post_alloc_hook mm/slab.h:757 [inline]
slab_alloc mm/slab.c:3302 [inline]
__do_kmalloc mm/slab.c:3694 [inline]
__kmalloc+0x3b6/0x4b0 mm/slab.c:3705
kmalloc include/linux/slab.h:605 [inline]
tomoyo_realpath_from_path+0xc3/0x620 security/tomoyo/realpath.c:254
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x219/0x420 security/tomoyo/file.c:822
security_inode_getattr+0xcf/0x140 security/security.c:1344
vfs_getattr+0x22/0x60 fs/stat.c:157
vfs_statx+0x170/0x360 fs/stat.c:232
vfs_fstatat+0x8c/0xb0 fs/stat.c:255
__do_sys_newfstatat+0x91/0x110 fs/stat.c:425
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
page last free stack trace:
__preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline]
rcu_read_unlock_sched_notrace include/linux/rcupdate.h:817 [inline]
trace_mm_page_free include/trace/events/kmem.h:160 [inline]
trace_mm_page_free include/trace/events/kmem.h:160 [inline]
free_pages_prepare mm/page_alloc.c:1322 [inline]
free_pcp_prepare+0x4f3/0xb40 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page+0x19/0x490 mm/page_alloc.c:3438
__unfreeze_partials+0x3d2/0x3f0
_compound_head include/linux/page-flags.h:275 [inline]
virt_to_folio include/linux/mm.h:855 [inline]
virt_to_slab mm/slab.h:175 [inline]
memcg_slab_free_hook mm/slab.h:567 [inline]
memcg_slab_free_hook mm/slab.h:550 [inline]
___cache_free+0x12c/0x140 mm/slab.c:3444
arch_local_irq_restore arch/x86/include/asm/irqflags.h:137 [inline]
qlink_free mm/kasan/quarantine.c:171 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x13d/0x180 mm/kasan/quarantine.c:294
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x78/0x80 mm/kasan/common.c:469
slab_post_alloc_hook+0x4d/0x4d0 mm/slab.h:750
_compound_head include/linux/page-flags.h:272 [inline]
virt_to_folio include/linux/mm.h:855 [inline]
virt_to_slab mm/slab.h:175 [inline]
memcg_slab_post_alloc_hook mm/slab.h:529 [inline]
slab_post_alloc_hook mm/slab.h:757 [inline]
slab_alloc mm/slab.c:3302 [inline]
__do_kmalloc mm/slab.c:3694 [inline]
__kmalloc+0x19e/0x4b0 mm/slab.c:3705
kmalloc include/linux/slab.h:605 [inline]
kzalloc include/linux/slab.h:733 [inline]
tomoyo_encode2.part.0+0xec/0x3b0 security/tomoyo/realpath.c:45
tomoyo_encode2 security/tomoyo/realpath.c:31 [inline]
tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x219/0x420 security/tomoyo/file.c:822
security_inode_getattr+0xcf/0x140 security/security.c:1344
vfs_getattr+0x22/0x60 fs/stat.c:157
vfs_statx+0x170/0x360 fs/stat.c:232

Memory state around the buggy address:
ffff88801aa1e700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801aa1e780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801aa1e800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801aa1e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801aa1e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 05 5b 31 c0 5d add $0x5dc0315b,%eax
5: c3 retq
6: 48 8d 6b 48 lea 0x48(%rbx),%rbp
a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
11: fc ff df
14: 48 89 ea mov %rbp,%rdx
17: 48 c1 ea 03 shr $0x3,%rdx
1b: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
1f: 75 32 jne 0x53
21: 48 8b 7b 48 mov 0x48(%rbx),%rdi
25: e8 56 5d 0b 00 callq 0xb5d80
* 2a: 85 c0 test %eax,%eax <-- trapping instruction
2c: 74 d3 je 0x1
2e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
35: fc ff df
38: 48 89 ea mov %rbp,%rdx
3b: 48 c1 ea 03 shr $0x3,%rdx
3f: 80 .byte 0x80


```

Powered by blists - more mailing lists