| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <ZDKszDkJSxxRf_2J@dragonet>
Date: Sun, 9 Apr 2023 21:17:16 +0900
From: "Dae R. Jeong" <threeearcat@...il.com>
To: gregkh@...uxfoundation.org, rafael.j.wysocki@...el.com,
heikki.krogerus@...ux.intel.com, mchehab@...nel.org,
mailhol.vincent@...adoo.fr, linux-usb@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: BUG: unable to handle kernel paging request in usb_start_wait_urb
Hi,
We observed an issue "BUG: unable to handle kernel paging request in
usb_start_wait_urb" during fuzzing.
We acknowledge that this issue is a bit old, and we are sorry for
reporting this late. And unfortunately, we have not found a reproducer
for the crash yet. We will inform you if we have any update on this
crash. Detailed crash information is attached below.
Best regards,
Dae R. Jeong
-----
- Kernel version:
6.2-rc1
- Crash report:
BUG: unable to handle page fault for address: ffff8800302e746d
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 8679 Comm: kworker/1:3 Not tainted 6.2.0-rc7-32171-g7f09e8f6ebfb #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: pm hcd_resume_work
RIP: 0010:freelist_dereference mm/slub.c:388 [inline]
RIP: 0010:get_freepointer mm/slub.c:395 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:422 [inline]
RIP: 0010:__slab_alloc_node mm/slub.c:3347 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:3442 [inline]
RIP: 0010:__kmem_cache_alloc_node+0x1b6/0x430 mm/slub.c:3491
Code: 48 89 df e8 6c 25 e7 ff 49 c1 ed 3a 44 3b 6d c0 0f 85 08 01 00 00 41 8b 5e 28 4c 8b 6d b8 4c 89 ef e8 0e 25 e7 ff 49 8d 3c 1c <49> 8b 1c 1c e8 41 25 e7 ff 49 8d 47 08 48 89 45 a0 49 8b 06 48 89
RSP: 0018:ffff888107ef3740 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffff888008441328 RDI: ffff8800302e746d
RBP: ffff888107ef37b0 R08: ffffffff83c943cc R09: ffffffff83c93f61
R10: 0000000000000002 R11: ffff888108e22180 R12: ffff8800302e7465
R13: ffff888008441328 R14: ffff888008441300 R15: 0000000000025081
FS: 0000000000000000(0000) GS:ffff88813dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800302e746d CR3: 0000000010104000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc+0xa6/0x290 mm/slab_common.c:981
kmalloc include/linux/slab.h:584 [inline]
kzalloc include/linux/slab.h:720 [inline]
rh_call_control drivers/usb/core/hcd.c:514 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:848 [inline]
usb_hcd_submit_urb+0x60c/0x10e0 drivers/usb/core/hcd.c:1552
usb_submit_urb+0xc3d/0xcf0 drivers/usb/core/urb.c:596
usb_start_wait_urb+0x8e/0x190 drivers/usb/core/message.c:58
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x19d/0x250 drivers/usb/core/message.c:153
get_port_status drivers/usb/core/hub.c:584 [inline]
hub_ext_port_status+0xbd/0x3c0 drivers/usb/core/hub.c:601
usb_hub_port_status drivers/usb/core/hub.c:623 [inline]
hub_activate+0x50a/0x1150 drivers/usb/core/hub.c:1133
hub_resume+0x49/0x210 drivers/usb/core/hub.c:3947
usb_resume_interface drivers/usb/core/driver.c:1359 [inline]
usb_resume_both+0x41e/0x640 drivers/usb/core/driver.c:1519
usb_runtime_resume+0x21/0x30 drivers/usb/core/driver.c:1977
__rpm_callback+0x185/0x2f0 drivers/base/power/runtime.c:392
rpm_callback drivers/base/power/runtime.c:446 [inline]
rpm_resume+0xa80/0xf60 drivers/base/power/runtime.c:912
__pm_runtime_resume+0xe9/0x110 drivers/base/power/runtime.c:1170
pm_runtime_get_sync include/linux/pm_runtime.h:429 [inline]
usb_autoresume_device+0x25/0x60 drivers/usb/core/driver.c:1707
usb_remote_wakeup+0x4a/0xa0 drivers/usb/core/hub.c:3785
hcd_resume_work+0x2d/0x40 drivers/usb/core/hcd.c:2393
process_one_work+0x281/0x6a0 kernel/workqueue.c:2289
worker_thread+0x3a5/0x6c0 kernel/workqueue.c:2436
kthread+0x13f/0x170 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
CR2: ffff8800302e746d
---[ end trace 0000000000000000 ]---
RIP: 0010:freelist_dereference mm/slub.c:388 [inline]
RIP: 0010:get_freepointer mm/slub.c:395 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:422 [inline]
RIP: 0010:__slab_alloc_node mm/slub.c:3347 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:3442 [inline]
RIP: 0010:__kmem_cache_alloc_node+0x1b6/0x430 mm/slub.c:3491
Code: 48 89 df e8 6c 25 e7 ff 49 c1 ed 3a 44 3b 6d c0 0f 85 08 01 00 00 41 8b 5e 28 4c 8b 6d b8 4c 89 ef e8 0e 25 e7 ff 49 8d 3c 1c <49> 8b 1c 1c e8 41 25 e7 ff 49 8d 47 08 48 89 45 a0 49 8b 06 48 89
RSP: 0018:ffff888107ef3740 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffff888008441328 RDI: ffff8800302e746d
RBP: ffff888107ef37b0 R08: ffffffff83c943cc R09: ffffffff83c93f61
R10: 0000000000000002 R11: ffff888108e22180 R12: ffff8800302e7465
R13: ffff888008441328 R14: ffff888008441300 R15: 0000000000025081
FS: 0000000000000000(0000) GS:ffff88813dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800302e746d CR3: 0000000010104000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 df mov %rbx,%rdi
3: e8 6c 25 e7 ff callq 0xffe72574
8: 49 c1 ed 3a shr $0x3a,%r13
c: 44 3b 6d c0 cmp -0x40(%rbp),%r13d
10: 0f 85 08 01 00 00 jne 0x11e
16: 41 8b 5e 28 mov 0x28(%r14),%ebx
1a: 4c 8b 6d b8 mov -0x48(%rbp),%r13
1e: 4c 89 ef mov %r13,%rdi
21: e8 0e 25 e7 ff callq 0xffe72534
26: 49 8d 3c 1c lea (%r12,%rbx,1),%rdi
* 2a: 49 8b 1c 1c mov (%r12,%rbx,1),%rbx <-- trapping instruction
2e: e8 41 25 e7 ff callq 0xffe72574
33: 49 8d 47 08 lea 0x8(%r15),%rax
37: 48 89 45 a0 mov %rax,-0x60(%rbp)
3b: 49 8b 06 mov (%r14),%rax
3e: 48 rex.W
3f: 89 .byte 0x89
Powered by blists - more mailing lists