KASAN: use-after-free Read in worker_thread
23 views
Skip to first unread message
syzbot
Oct 16, 2022, 2:28:42 AM10/16/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 44b8b2ac1d96 Merge 5.15.73 into android13-5.15-lts
git tree: android13-5.15-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16b1549a880000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7f461eef7aac48
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1745a872880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=109d08e2880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eae95419fc66/disk-44b8b2ac.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/40ad978c1f0f/vmlinux-44b8b2ac.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fba752...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in worker_thread+0xb14/0x1340 kernel/workqueue.c:2458
Read of size 8 at addr ffff8881168eac60 by task kworker/1:8/451
CPU: 1 PID: 451 Comm: kworker/1:8 Not tainted 5.15.73-syzkaller-04348-g44b8b2ac1d96 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: 0x0 (mm_percpu_wq)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3d0 mm/kasan/report.c:256
__kasan_report mm/kasan/report.c:435 [inline]
kasan_report+0x1a6/0x1f0 mm/kasan/report.c:452
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
worker_thread+0xb14/0x1340 kernel/workqueue.c:2458
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 431:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:512
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
kasan_kmalloc include/linux/kasan.h:254 [inline]
__kmalloc+0x203/0x350 mm/slub.c:4423
__kmalloc_node include/linux/slab.h:457 [inline]
kmalloc_node include/linux/slab.h:614 [inline]
kvmalloc_node+0x82/0x130 mm/util.c:623
kvmalloc include/linux/mm.h:844 [inline]
kvzalloc include/linux/mm.h:852 [inline]
alloc_netdev_mqs+0x8c/0xc80 net/core/dev.c:10828
alloc_etherdev_mqs+0x33/0x40 net/ethernet/eth.c:393
usbnet_probe+0x1c2/0x2750 drivers/net/usb/usbnet.c:1694
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_set_configuration+0x1a91/0x2020 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x140/0x240 drivers/usb/core/driver.c:293
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_new_device+0x1012/0x1ba0 drivers/usb/core/hub.c:2572
hub_port_connect drivers/usb/core/hub.c:5362 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5506 [inline]
port_event drivers/usb/core/hub.c:5652 [inline]
hub_event+0x2c85/0x5160 drivers/usb/core/hub.c:5734
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
process_scheduled_works kernel/workqueue.c:2376 [inline]
worker_thread+0xe94/0x1340 kernel/workqueue.c:2462
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
Freed by task 431:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
kasan_slab_free include/linux/kasan.h:220 [inline]
slab_free_hook mm/slub.c:1721 [inline]
slab_free_freelist_hook+0xc9/0x1a0 mm/slub.c:1747
slab_free mm/slub.c:3515 [inline]
kfree+0xc8/0x210 mm/slub.c:4575
kvfree+0x35/0x40 mm/util.c:658
netdev_freemem+0x3e/0x60 net/core/dev.c:10782
netdev_release+0x79/0xa0 net/core/net-sysfs.c:1903
device_release+0x9c/0x1d0
kobject_cleanup lib/kobject.c:705 [inline]
kobject_release lib/kobject.c:736 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x163/0x240 lib/kobject.c:753
put_device+0x1f/0x30 drivers/base/core.c:3511
free_netdev+0x365/0x450 net/core/dev.c:10968
usbnet_disconnect+0x277/0x3b0 drivers/net/usb/usbnet.c:1633
usb_unbind_interface+0x20f/0x8e0 drivers/usb/core/driver.c:458
__device_release_driver drivers/base/dd.c:1220 [inline]
device_release_driver_internal+0x528/0x7e0 drivers/base/dd.c:1253
device_release_driver+0x19/0x20 drivers/base/dd.c:1276
bus_remove_device+0x2de/0x340 drivers/base/bus.c:529
device_del+0x64e/0xec0 drivers/base/core.c:3591
usb_disable_device+0x3a4/0x710 drivers/usb/core/message.c:1419
usb_disconnect+0x342/0x880 drivers/usb/core/hub.c:2229
hub_port_connect drivers/usb/core/hub.c:5206 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5506 [inline]
port_event drivers/usb/core/hub.c:5652 [inline]
hub_event+0x1d59/0x5160 drivers/usb/core/hub.c:5734
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
process_scheduled_works kernel/workqueue.c:2376 [inline]
worker_thread+0xe94/0x1340 kernel/workqueue.c:2462
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
Last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
insert_work+0x56/0x340 kernel/workqueue.c:1369
__queue_work+0x934/0xcf0 kernel/workqueue.c:1535
queue_work_on+0xf2/0x170 kernel/workqueue.c:1562
usbnet_link_change+0xe6/0x100
usbnet_probe+0x1cf3/0x2750 drivers/net/usb/usbnet.c:1835
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_set_configuration+0x1a91/0x2020 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x140/0x240 drivers/usb/core/driver.c:293
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_new_device+0x1012/0x1ba0 drivers/usb/core/hub.c:2572
hub_port_connect drivers/usb/core/hub.c:5362 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5506 [inline]
port_event drivers/usb/core/hub.c:5652 [inline]
hub_event+0x2c85/0x5160 drivers/usb/core/hub.c:5734
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
process_scheduled_works kernel/workqueue.c:2376 [inline]
worker_thread+0xe94/0x1340 kernel/workqueue.c:2462
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff8881168ea000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 3168 bytes inside of
4096-byte region [ffff8881168ea000, ffff8881168eb000)
The buggy address belongs to the page:
page:ffffea00045a3a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1168e8
head:ffffea00045a3a00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043380
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 224, ts 3577000914, free_ts 0
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1ab/0x1b0 mm/page_alloc.c:2495
prep_new_page mm/page_alloc.c:2501 [inline]
get_page_from_freelist+0x38b/0x400 mm/page_alloc.c:4281
__alloc_pages+0x3a8/0x7c0 mm/page_alloc.c:5548
allocate_slab+0x62/0x580 mm/slub.c:1928
new_slab mm/slub.c:1991 [inline]
___slab_alloc+0x2e2/0x6f0 mm/slub.c:3024
__slab_alloc+0x4a/0x90 mm/slub.c:3111
slab_alloc_node mm/slub.c:3202 [inline]
slab_alloc mm/slub.c:3244 [inline]
kmem_cache_alloc_trace+0x214/0x310 mm/slub.c:3261
kmalloc include/linux/slab.h:591 [inline]
kzalloc include/linux/slab.h:721 [inline]
kernfs_iop_get_link+0x65/0x590 fs/kernfs/symlink.c:135
vfs_readlink+0x177/0x420 fs/namei.c:4927
do_readlinkat+0x28f/0x3b0 fs/stat.c:454
__do_sys_readlink fs/stat.c:475 [inline]
__se_sys_readlink fs/stat.c:472 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:472
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page_owner free stack trace missing
Memory state around the buggy address:
ffff8881168eab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881168eab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881168eac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881168eac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881168ead00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 44b8b2ac1d96 Merge 5.15.73 into android13-5.15-lts
git tree: android13-5.15-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16b1549a880000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7f461eef7aac48
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1745a872880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=109d08e2880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eae95419fc66/disk-44b8b2ac.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/40ad978c1f0f/vmlinux-44b8b2ac.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fba752...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in worker_thread+0xb14/0x1340 kernel/workqueue.c:2458
Read of size 8 at addr ffff8881168eac60 by task kworker/1:8/451
CPU: 1 PID: 451 Comm: kworker/1:8 Not tainted 5.15.73-syzkaller-04348-g44b8b2ac1d96 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: 0x0 (mm_percpu_wq)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3d0 mm/kasan/report.c:256
__kasan_report mm/kasan/report.c:435 [inline]
kasan_report+0x1a6/0x1f0 mm/kasan/report.c:452
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
worker_thread+0xb14/0x1340 kernel/workqueue.c:2458
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 431:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:512
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
kasan_kmalloc include/linux/kasan.h:254 [inline]
__kmalloc+0x203/0x350 mm/slub.c:4423
__kmalloc_node include/linux/slab.h:457 [inline]
kmalloc_node include/linux/slab.h:614 [inline]
kvmalloc_node+0x82/0x130 mm/util.c:623
kvmalloc include/linux/mm.h:844 [inline]
kvzalloc include/linux/mm.h:852 [inline]
alloc_netdev_mqs+0x8c/0xc80 net/core/dev.c:10828
alloc_etherdev_mqs+0x33/0x40 net/ethernet/eth.c:393
usbnet_probe+0x1c2/0x2750 drivers/net/usb/usbnet.c:1694
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_set_configuration+0x1a91/0x2020 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x140/0x240 drivers/usb/core/driver.c:293
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_new_device+0x1012/0x1ba0 drivers/usb/core/hub.c:2572
hub_port_connect drivers/usb/core/hub.c:5362 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5506 [inline]
port_event drivers/usb/core/hub.c:5652 [inline]
hub_event+0x2c85/0x5160 drivers/usb/core/hub.c:5734
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
process_scheduled_works kernel/workqueue.c:2376 [inline]
worker_thread+0xe94/0x1340 kernel/workqueue.c:2462
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
Freed by task 431:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
kasan_slab_free include/linux/kasan.h:220 [inline]
slab_free_hook mm/slub.c:1721 [inline]
slab_free_freelist_hook+0xc9/0x1a0 mm/slub.c:1747
slab_free mm/slub.c:3515 [inline]
kfree+0xc8/0x210 mm/slub.c:4575
kvfree+0x35/0x40 mm/util.c:658
netdev_freemem+0x3e/0x60 net/core/dev.c:10782
netdev_release+0x79/0xa0 net/core/net-sysfs.c:1903
device_release+0x9c/0x1d0
kobject_cleanup lib/kobject.c:705 [inline]
kobject_release lib/kobject.c:736 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x163/0x240 lib/kobject.c:753
put_device+0x1f/0x30 drivers/base/core.c:3511
free_netdev+0x365/0x450 net/core/dev.c:10968
usbnet_disconnect+0x277/0x3b0 drivers/net/usb/usbnet.c:1633
usb_unbind_interface+0x20f/0x8e0 drivers/usb/core/driver.c:458
__device_release_driver drivers/base/dd.c:1220 [inline]
device_release_driver_internal+0x528/0x7e0 drivers/base/dd.c:1253
device_release_driver+0x19/0x20 drivers/base/dd.c:1276
bus_remove_device+0x2de/0x340 drivers/base/bus.c:529
device_del+0x64e/0xec0 drivers/base/core.c:3591
usb_disable_device+0x3a4/0x710 drivers/usb/core/message.c:1419
usb_disconnect+0x342/0x880 drivers/usb/core/hub.c:2229
hub_port_connect drivers/usb/core/hub.c:5206 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5506 [inline]
port_event drivers/usb/core/hub.c:5652 [inline]
hub_event+0x1d59/0x5160 drivers/usb/core/hub.c:5734
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
process_scheduled_works kernel/workqueue.c:2376 [inline]
worker_thread+0xe94/0x1340 kernel/workqueue.c:2462
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
Last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
insert_work+0x56/0x340 kernel/workqueue.c:1369
__queue_work+0x934/0xcf0 kernel/workqueue.c:1535
queue_work_on+0xf2/0x170 kernel/workqueue.c:1562
usbnet_link_change+0xe6/0x100
usbnet_probe+0x1cf3/0x2750 drivers/net/usb/usbnet.c:1835
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_set_configuration+0x1a91/0x2020 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x140/0x240 drivers/usb/core/driver.c:293
really_probe+0x28d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x1b7/0x290 drivers/base/dd.c:750
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:780
__device_attach_driver+0x2bf/0x470 drivers/base/dd.c:902
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x32b/0x530 drivers/base/dd.c:974
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1023
bus_probe_device+0xbc/0x1f0 drivers/base/bus.c:487
device_add+0xb1e/0xef0 drivers/base/core.c:3404
usb_new_device+0x1012/0x1ba0 drivers/usb/core/hub.c:2572
hub_port_connect drivers/usb/core/hub.c:5362 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5506 [inline]
port_event drivers/usb/core/hub.c:5652 [inline]
hub_event+0x2c85/0x5160 drivers/usb/core/hub.c:5734
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
process_scheduled_works kernel/workqueue.c:2376 [inline]
worker_thread+0xe94/0x1340 kernel/workqueue.c:2462
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff8881168ea000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 3168 bytes inside of
4096-byte region [ffff8881168ea000, ffff8881168eb000)
The buggy address belongs to the page:
page:ffffea00045a3a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1168e8
head:ffffea00045a3a00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043380
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 224, ts 3577000914, free_ts 0
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1ab/0x1b0 mm/page_alloc.c:2495
prep_new_page mm/page_alloc.c:2501 [inline]
get_page_from_freelist+0x38b/0x400 mm/page_alloc.c:4281
__alloc_pages+0x3a8/0x7c0 mm/page_alloc.c:5548
allocate_slab+0x62/0x580 mm/slub.c:1928
new_slab mm/slub.c:1991 [inline]
___slab_alloc+0x2e2/0x6f0 mm/slub.c:3024
__slab_alloc+0x4a/0x90 mm/slub.c:3111
slab_alloc_node mm/slub.c:3202 [inline]
slab_alloc mm/slub.c:3244 [inline]
kmem_cache_alloc_trace+0x214/0x310 mm/slub.c:3261
kmalloc include/linux/slab.h:591 [inline]
kzalloc include/linux/slab.h:721 [inline]
kernfs_iop_get_link+0x65/0x590 fs/kernfs/symlink.c:135
vfs_readlink+0x177/0x420 fs/namei.c:4927
do_readlinkat+0x28f/0x3b0 fs/stat.c:454
__do_sys_readlink fs/stat.c:475 [inline]
__se_sys_readlink fs/stat.c:472 [inline]
__x64_sys_readlink+0x7f/0x90 fs/stat.c:472
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page_owner free stack trace missing
Memory state around the buggy address:
ffff8881168eab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881168eab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881168eac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881168eac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881168ead00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Jun Nie
Nov 23, 2022, 10:20:54 PM11/23/22
to syzkaller-android-bugs
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot
Nov 24, 2022, 1:48:16 AM11/24/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in worker_thread
==================================================================
BUG: KASAN: use-after-free in worker_thread+0xb0e/0x1390 kernel/workqueue.c:2434
Read of size 8 at addr ffff88811ade6b30 by task kworker/1:7/1356
CPU: 1 PID: 1356 Comm: kworker/1:7 Not tainted 6.1.0-rc6-syzkaller-00015-gc3eb11fbb826 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: 0x0 (events)
print_report+0x164/0x510 mm/kasan/report.c:395
kasan_report+0x13f/0x170 mm/kasan/report.c:495
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351
worker_thread+0xb0e/0x1390 kernel/workqueue.c:2434
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Allocated by task 513:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:52
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:500
____kasan_kmalloc mm/kasan/common.c:371 [inline]
__kasan_kmalloc+0x9c/0xb0 mm/kasan/common.c:380
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:955 [inline]
__kmalloc_node+0xb0/0x1e0 mm/slab_common.c:962
kmalloc_node include/linux/slab.h:579 [inline]
kvmalloc_node+0x72/0x190 mm/util.c:581
kvmalloc include/linux/slab.h:706 [inline]
kvzalloc include/linux/slab.h:714 [inline]
alloc_netdev_mqs+0x8c/0xd50 net/core/dev.c:10588
alloc_etherdev_mqs+0x36/0x40 net/ethernet/eth.c:394
usbnet_probe+0x186/0x2580 drivers/net/usb/usbnet.c:1693
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_set_configuration+0x1a91/0x2010 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x240 drivers/usb/core/driver.c:293
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_new_device+0xba4/0x1770 drivers/usb/core/hub.c:2573
hub_port_connect drivers/usb/core/hub.c:5353 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5653 [inline]
hub_event+0x2c36/0x5020 drivers/usb/core/hub.c:5735
process_one_work+0x6cb/0xc00 kernel/workqueue.c:2289
worker_thread+0xb3c/0x1390 kernel/workqueue.c:2436
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Freed by task 513:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:511
____kasan_slab_free+0x131/0x180 mm/kasan/common.c:236
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0xc9/0x1a0 mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0xbb/0x160 mm/slub.c:3674
kfree+0x7a/0xf0 mm/slab_common.c:1007
kvfree+0x35/0x40 mm/util.c:627
netdev_freemem+0x3e/0x60 net/core/dev.c:10542
netdev_release+0x79/0xa0 net/core/net-sysfs.c:1910
device_release+0x9c/0x1d0
kobject_cleanup lib/kobject.c:673 [inline]
kobject_release lib/kobject.c:704 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x163/0x240 lib/kobject.c:721
put_device+0x1f/0x30 drivers/base/core.c:3624
free_netdev+0x3a6/0x490 net/core/dev.c:10735
usbnet_disconnect+0x267/0x3a0 drivers/net/usb/usbnet.c:1632
usb_unbind_interface+0x206/0x8d0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:550 [inline]
__device_release_driver drivers/base/dd.c:1249 [inline]
device_release_driver_internal+0x548/0x870 drivers/base/dd.c:1275
device_release_driver+0x19/0x20 drivers/base/dd.c:1298
bus_remove_device+0x2c7/0x330 drivers/base/bus.c:529
device_del+0x618/0xe90 drivers/base/core.c:3704
usb_disable_device+0x3a4/0x710 drivers/usb/core/message.c:1419
usb_disconnect+0x342/0x880 drivers/usb/core/hub.c:2235
hub_port_connect drivers/usb/core/hub.c:5197 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5653 [inline]
hub_event+0x1f1d/0x5020 drivers/usb/core/hub.c:5735
process_one_work+0x6cb/0xc00 kernel/workqueue.c:2289
process_scheduled_works kernel/workqueue.c:2352 [inline]
worker_thread+0xe64/0x1390 kernel/workqueue.c:2438
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb4/0xc0 mm/kasan/generic.c:481
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:491
insert_work+0x56/0x320 kernel/workqueue.c:1358
__queue_work+0x9e1/0xda0 kernel/workqueue.c:1517
queue_work_on+0xf2/0x170 kernel/workqueue.c:1545
usbnet_link_change+0xe6/0x100
usbnet_probe+0x1be3/0x2580 drivers/net/usb/usbnet.c:1834
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_set_configuration+0x1a91/0x2010 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x240 drivers/usb/core/driver.c:293
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_new_device+0xba4/0x1770 drivers/usb/core/hub.c:2573
hub_port_connect drivers/usb/core/hub.c:5353 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5653 [inline]
hub_event+0x2c36/0x5020 drivers/usb/core/hub.c:5735
process_one_work+0x6cb/0xc00 kernel/workqueue.c:2289
worker_thread+0xb3c/0x1390 kernel/workqueue.c:2436
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff88811ade6000
4096-byte region [ffff88811ade6000, ffff88811ade7000)
The buggy address belongs to the physical page:
page:ffffea00046b7800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ade0
head:ffffea00046b7800 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042140
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1eb/0x1f0 mm/page_alloc.c:2532
prep_new_page mm/page_alloc.c:2539 [inline]
get_page_from_freelist+0x375/0x3f0 mm/page_alloc.c:4288
__alloc_pages+0x3d1/0x7c0 mm/page_alloc.c:5555
allocate_slab+0x76/0x4e0 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0x4da/0x940 mm/slub.c:3180
__slab_alloc+0x5d/0xa0 mm/slub.c:3279
slab_alloc_node mm/slub.c:3364 [inline]
__kmem_cache_alloc_node+0x1f1/0x290 mm/slub.c:3437
kmalloc_trace+0x2a/0xa0 mm/slab_common.c:1045
kmalloc include/linux/slab.h:553 [inline]
kzalloc include/linux/slab.h:689 [inline]
kobject_uevent_env+0x265/0x730 lib/kobject_uevent.c:524
kobject_uevent+0x1f/0x30 lib/kobject_uevent.c:642
device_add+0xa27/0xed0 drivers/base/core.c:3498
usb_set_configuration+0x1a91/0x2010 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x240 drivers/usb/core/driver.c:293
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1459 [inline]
free_pcp_prepare+0x4d0/0x4e0 mm/page_alloc.c:1532
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x70/0x530 mm/page_alloc.c:3483
free_the_page mm/page_alloc.c:770 [inline]
__free_pages+0xd8/0x100 mm/page_alloc.c:5641
__free_slab+0xd2/0x1b0 mm/slub.c:2016
free_slab mm/slub.c:2031 [inline]
discard_slab mm/slub.c:2037 [inline]
__unfreeze_partials+0x17d/0x1b0 mm/slub.c:2586
put_cpu_partial+0xa9/0x100 mm/slub.c:2662
__slab_free+0x203/0x280 mm/slub.c:3538
do_slab_free mm/slub.c:3615 [inline]
___cache_free+0xc6/0xd0 mm/slub.c:3668
qlink_free+0x4d/0x90 mm/kasan/quarantine.c:168
qlist_free_all+0x5a/0xd0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x15a/0x180 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x24/0x80 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:737 [inline]
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x18f/0x300 mm/slub.c:3422
vm_area_alloc+0x24/0xe0 kernel/fork.c:458
mmap_region+0xdd9/0x1ea0 mm/mmap.c:2605
do_mmap+0x895/0xe50 mm/mmap.c:1412
Memory state around the buggy address:
ffff88811ade6a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811ade6a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88811ade6b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88811ade6b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811ade6c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: c3eb11fb Merge tag 'pci-v6.1-fixes-3' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=14a76889880000
kernel config: https://syzkaller.appspot.com/x/.config?x=58411d412696ef71
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in worker_thread
==================================================================
BUG: KASAN: use-after-free in worker_thread+0xb0e/0x1390 kernel/workqueue.c:2434
Read of size 8 at addr ffff88811ade6b30 by task kworker/1:7/1356
CPU: 1 PID: 1356 Comm: kworker/1:7 Not tainted 6.1.0-rc6-syzkaller-00015-gc3eb11fbb826 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: 0x0 (events)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_report+0x164/0x510 mm/kasan/report.c:395
kasan_report+0x13f/0x170 mm/kasan/report.c:495
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351
worker_thread+0xb0e/0x1390 kernel/workqueue.c:2434
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Allocated by task 513:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:52
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:500
____kasan_kmalloc mm/kasan/common.c:371 [inline]
__kasan_kmalloc+0x9c/0xb0 mm/kasan/common.c:380
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:955 [inline]
__kmalloc_node+0xb0/0x1e0 mm/slab_common.c:962
kmalloc_node include/linux/slab.h:579 [inline]
kvmalloc_node+0x72/0x190 mm/util.c:581
kvmalloc include/linux/slab.h:706 [inline]
kvzalloc include/linux/slab.h:714 [inline]
alloc_netdev_mqs+0x8c/0xd50 net/core/dev.c:10588
alloc_etherdev_mqs+0x36/0x40 net/ethernet/eth.c:394
usbnet_probe+0x186/0x2580 drivers/net/usb/usbnet.c:1693
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_set_configuration+0x1a91/0x2010 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x240 drivers/usb/core/driver.c:293
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_new_device+0xba4/0x1770 drivers/usb/core/hub.c:2573
hub_port_connect drivers/usb/core/hub.c:5353 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5653 [inline]
hub_event+0x2c36/0x5020 drivers/usb/core/hub.c:5735
process_one_work+0x6cb/0xc00 kernel/workqueue.c:2289
worker_thread+0xb3c/0x1390 kernel/workqueue.c:2436
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Freed by task 513:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:511
____kasan_slab_free+0x131/0x180 mm/kasan/common.c:236
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0xc9/0x1a0 mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0xbb/0x160 mm/slub.c:3674
kfree+0x7a/0xf0 mm/slab_common.c:1007
kvfree+0x35/0x40 mm/util.c:627
netdev_freemem+0x3e/0x60 net/core/dev.c:10542
netdev_release+0x79/0xa0 net/core/net-sysfs.c:1910
device_release+0x9c/0x1d0
kobject_cleanup lib/kobject.c:673 [inline]
kobject_release lib/kobject.c:704 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x163/0x240 lib/kobject.c:721
put_device+0x1f/0x30 drivers/base/core.c:3624
free_netdev+0x3a6/0x490 net/core/dev.c:10735
usbnet_disconnect+0x267/0x3a0 drivers/net/usb/usbnet.c:1632
usb_unbind_interface+0x206/0x8d0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:550 [inline]
__device_release_driver drivers/base/dd.c:1249 [inline]
device_release_driver_internal+0x548/0x870 drivers/base/dd.c:1275
device_release_driver+0x19/0x20 drivers/base/dd.c:1298
bus_remove_device+0x2c7/0x330 drivers/base/bus.c:529
device_del+0x618/0xe90 drivers/base/core.c:3704
usb_disable_device+0x3a4/0x710 drivers/usb/core/message.c:1419
usb_disconnect+0x342/0x880 drivers/usb/core/hub.c:2235
hub_port_connect drivers/usb/core/hub.c:5197 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5653 [inline]
hub_event+0x1f1d/0x5020 drivers/usb/core/hub.c:5735
process_one_work+0x6cb/0xc00 kernel/workqueue.c:2289
process_scheduled_works kernel/workqueue.c:2352 [inline]
worker_thread+0xe64/0x1390 kernel/workqueue.c:2438
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Last potentially related work creation:
__kasan_record_aux_stack+0xb4/0xc0 mm/kasan/generic.c:481
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:491
insert_work+0x56/0x320 kernel/workqueue.c:1358
__queue_work+0x9e1/0xda0 kernel/workqueue.c:1517
queue_work_on+0xf2/0x170 kernel/workqueue.c:1545
usbnet_link_change+0xe6/0x100
usbnet_probe+0x1be3/0x2580 drivers/net/usb/usbnet.c:1834
usb_probe_interface+0x632/0xae0 drivers/usb/core/driver.c:396
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_set_configuration+0x1a91/0x2010 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x240 drivers/usb/core/driver.c:293
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
driver_probe_device+0x54/0x3d0 drivers/base/dd.c:808
__device_attach_driver+0x2dd/0x490 drivers/base/dd.c:936
bus_for_each_drv+0x18a/0x210 drivers/base/bus.c:427
__device_attach+0x322/0x530 drivers/base/dd.c:1008
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1057
bus_probe_device+0xb9/0x1e0 drivers/base/bus.c:487
device_add+0xb15/0xed0 drivers/base/core.c:3517
usb_new_device+0xba4/0x1770 drivers/usb/core/hub.c:2573
hub_port_connect drivers/usb/core/hub.c:5353 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5653 [inline]
hub_event+0x2c36/0x5020 drivers/usb/core/hub.c:5735
process_one_work+0x6cb/0xc00 kernel/workqueue.c:2289
worker_thread+0xb3c/0x1390 kernel/workqueue.c:2436
kthread+0x26b/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff88811ade6000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 2864 bytes inside of
4096-byte region [ffff88811ade6000, ffff88811ade7000)
The buggy address belongs to the physical page:
page:ffffea00046b7800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ade0
head:ffffea00046b7800 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042140
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 513, tgid 513 (kworker/1:5), ts 77674567599, free_ts 75509116937
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1eb/0x1f0 mm/page_alloc.c:2532
prep_new_page mm/page_alloc.c:2539 [inline]
get_page_from_freelist+0x375/0x3f0 mm/page_alloc.c:4288
__alloc_pages+0x3d1/0x7c0 mm/page_alloc.c:5555
allocate_slab+0x76/0x4e0 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0x4da/0x940 mm/slub.c:3180
__slab_alloc+0x5d/0xa0 mm/slub.c:3279
slab_alloc_node mm/slub.c:3364 [inline]
__kmem_cache_alloc_node+0x1f1/0x290 mm/slub.c:3437
kmalloc_trace+0x2a/0xa0 mm/slab_common.c:1045
kmalloc include/linux/slab.h:553 [inline]
kzalloc include/linux/slab.h:689 [inline]
kobject_uevent_env+0x265/0x730 lib/kobject_uevent.c:524
kobject_uevent+0x1f/0x30 lib/kobject_uevent.c:642
device_add+0xa27/0xed0 drivers/base/core.c:3498
usb_set_configuration+0x1a91/0x2010 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x240 drivers/usb/core/driver.c:293
really_probe+0x2af/0x910 drivers/base/dd.c:639
__driver_probe_device+0x1b4/0x280 drivers/base/dd.c:778
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1459 [inline]
free_pcp_prepare+0x4d0/0x4e0 mm/page_alloc.c:1532
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x70/0x530 mm/page_alloc.c:3483
free_the_page mm/page_alloc.c:770 [inline]
__free_pages+0xd8/0x100 mm/page_alloc.c:5641
__free_slab+0xd2/0x1b0 mm/slub.c:2016
free_slab mm/slub.c:2031 [inline]
discard_slab mm/slub.c:2037 [inline]
__unfreeze_partials+0x17d/0x1b0 mm/slub.c:2586
put_cpu_partial+0xa9/0x100 mm/slub.c:2662
__slab_free+0x203/0x280 mm/slub.c:3538
do_slab_free mm/slub.c:3615 [inline]
___cache_free+0xc6/0xd0 mm/slub.c:3668
qlink_free+0x4d/0x90 mm/kasan/quarantine.c:168
qlist_free_all+0x5a/0xd0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x15a/0x180 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x24/0x80 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:737 [inline]
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x18f/0x300 mm/slub.c:3422
vm_area_alloc+0x24/0xe0 kernel/fork.c:458
mmap_region+0xdd9/0x1ea0 mm/mmap.c:2605
do_mmap+0x895/0xe50 mm/mmap.c:1412
Memory state around the buggy address:
ffff88811ade6a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88811ade6b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88811ade6b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811ade6c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: c3eb11fb Merge tag 'pci-v6.1-fixes-3' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=14a76889880000
kernel config: https://syzkaller.appspot.com/x/.config?x=58411d412696ef71
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Jun Nie
Nov 25, 2022, 3:23:50 AM11/25/22
to syzkaller-android-bugs
#syz test: https://android.googlesource.com/kernel/common 7217df81279835a7a
syzbot
Nov 25, 2022, 6:40:21 AM11/25/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
commit: 7217df81 Linux 5.15.60
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=123d9403880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b5c2d53c388810f
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
commit: 7217df81 Linux 5.15.60
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=123d9403880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b5c2d53c388810f
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Jun Nie
Nov 25, 2022, 9:45:01 PM11/25/22
to syzkaller-android-bugs
#syz test: https://android.googlesource.com/kernel/common a24f05f7ced7
syzbot
Nov 26, 2022, 12:12:17 AM11/26/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:PERMISSIONS_ERROR ErrorDetails:[] Location: Message:Required 'read' permission for 'ci2-android-5-15-test-job-test-job-image.tar.gz' ForceSendFields:[] NullFields:[]}.
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3656368541=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at 52fdf57a8
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=52fdf57a86cb556640e5ebcc234bc826ff249546 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20221123-090939'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=52fdf57a86cb556640e5ebcc234bc826ff249546 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20221123-090939'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=52fdf57a86cb556640e5ebcc234bc826ff249546 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20221123-090939'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"52fdf57a86cb556640e5ebcc234bc826ff249546\"
Tested on:
commit: a24f05f7 block/bio: remove duplicate append pages code
git tree: https://android.googlesource.com/kernel/common
kernel config: https://syzkaller.appspot.com/x/.config?x=5616e3c257bccc36
syzbot tried to test the proposed patch but the build/boot failed:
failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:PERMISSIONS_ERROR ErrorDetails:[] Location: Message:Required 'read' permission for 'ci2-android-5-15-test-job-test-job-image.tar.gz' ForceSendFields:[] NullFields:[]}.
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3656368541=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at 52fdf57a8
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=52fdf57a86cb556640e5ebcc234bc826ff249546 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20221123-090939'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=52fdf57a86cb556640e5ebcc234bc826ff249546 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20221123-090939'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=52fdf57a86cb556640e5ebcc234bc826ff249546 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20221123-090939'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"52fdf57a86cb556640e5ebcc234bc826ff249546\"
Tested on:
commit: a24f05f7 block/bio: remove duplicate append pages code
git tree: https://android.googlesource.com/kernel/common
kernel config: https://syzkaller.appspot.com/x/.config?x=5616e3c257bccc36
Jun Nie
Nov 26, 2022, 8:30:08 AM11/26/22
to syzkaller-android-bugs
syz test: https://android.googlesource.com/kernel/common 6d8e185bf9de
Jun Nie
Nov 26, 2022, 8:59:18 AM11/26/22
to syzkaller-android-bugs
#syz test: https://android.googlesource.com/kernel/common 6d8e185bf9de
syzbot
Nov 26, 2022, 10:41:19 AM11/26/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
commit: 6d8e185b blk-mq: don't create hctx debugfs dir until q..
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=17cc0973880000
kernel config: https://syzkaller.appspot.com/x/.config?x=5616e3c257bccc36
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Jun Nie
Nov 27, 2022, 8:18:12 PM11/27/22
to syzkaller-android-bugs
#syz test: https://android.googlesource.com/kernel/common 70f70d54f06b
syzbot
Nov 27, 2022, 9:50:14 PM11/27/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
commit: 70f70d54 block: ensure iov_iter advances for added pages
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=132e1687880000
Jun Nie
Nov 28, 2022, 4:20:37 AM11/28/22
to syzkaller-android-bugs
#syz test: https://android.googlesource.com/kernel/common 0b7f5d7a4d2a
syzbot
Nov 28, 2022, 8:23:17 AM11/28/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
commit: 0b7f5d7a block: don't allow the same type rq_qos add m..
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=153d7ca1880000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7dda5902cc6c42d
Jun Nie
Nov 28, 2022, 10:38:45 AM11/28/22
to syzkaller-android-bugs
syzbot
Nov 28, 2022, 6:00:20 PM11/28/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
commit: 374bf3fc Linux 5.15.61
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+fba752...@syzkaller.appspotmail.com
Tested on:
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=140df303880000
kernel config: https://syzkaller.appspot.com/x/.config?x=282092948e0868b3
Jun Nie
Dec 14, 2022, 4:45:00 AM12/14/22
to syzbot, syzkaller-a...@googlegroups.com
#syz test: https://android.googlesource.com/kernel/common 83399dcc1f2502c
Test the commit that just before the bad commit in android side when
before merge happens.
Test the commit that just before the bad commit in android side when
before merge happens.
syzbot
Dec 14, 2022, 9:59:18 AM12/14/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in cdc_ncm_fill_tx_frame
skbuff: skb_over_panic: text:ffffffff83237399 len:184 put:172 head:ffff888125abb800 data:ffff888125abb800 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 26 Comm: kworker/1:0 Not tainted 5.15.60-syzkaller-04887-g83399dcc1f25 #0
RIP: 0010:skb_panic+0x14c/0x150 net/core/skbuff.c:113
Code: c7 60 5f be 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 31 c0 53 41 56 41 55 41 54 e8 43 de dc 00 48 83 c4 20 <0f> 0b 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 4c
RSP: 0018:ffffc900001b6c78 EFLAGS: 00010286
RAX: 0000000000000087 RBX: ffffffff85be5fe0 RCX: e8f3e56c512fab00
RDX: 0000000000000000 RSI: 0000000000000603 RDI: 0000000000000000
RBP: ffffc900001b6cc0 R08: ffffffff815838a9 R09: 0000000000000003
R10: fffff52000036cf9 R11: 1ffff92000036cf8 R12: ffff888125abb800
R13: 00000000000000b8 R14: 0000000000000080 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe87ef9c58 CR3: 000000010edcf000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
skb_over_panic net/core/skbuff.c:118 [inline]
skb_put+0x153/0x210 net/core/skbuff.c:2039
skb_put_zero include/linux/skbuff.h:2368 [inline]
cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]
cdc_ncm_fill_tx_frame+0x1229/0x3db0 drivers/net/usb/cdc_ncm.c:1308
cdc_ncm_tx_fixup+0xa2/0xf0
usbnet_start_xmit+0x116/0x1ae0 drivers/net/usb/usbnet.c:1370
__netdev_start_xmit include/linux/netdevice.h:5043 [inline]
netdev_start_xmit include/linux/netdevice.h:5057 [inline]
xmit_one+0x16a/0x480 net/core/dev.c:3597
dev_hard_start_xmit+0xad/0x1c0 net/core/dev.c:3613
sch_direct_xmit+0x295/0x9b0 net/sched/sch_generic.c:342
__dev_xmit_skb+0xb93/0x1650 net/core/dev.c:3824
__dev_queue_xmit+0x8f3/0x1b50 net/core/dev.c:4192
dev_queue_xmit+0x17/0x20 net/core/dev.c:4260
neigh_resolve_output+0x6d3/0x780 net/core/neighbour.c:1497
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xffe/0x1710 net/ipv6/ip6_output.c:126
__ip6_finish_output+0x674/0x850 net/ipv6/ip6_output.c:191
ip6_finish_output+0x20b/0x220 net/ipv6/ip6_output.c:201
NF_HOOK_COND include/linux/netfilter.h:299 [inline]
ip6_output+0x211/0x4c0 net/ipv6/ip6_output.c:224
dst_output include/net/dst.h:450 [inline]
NF_HOOK include/linux/netfilter.h:310 [inline]
ndisc_send_skb+0x779/0xce0 net/ipv6/ndisc.c:508
ndisc_send_ns+0x629/0x810 net/ipv6/ndisc.c:650
addrconf_dad_work+0xb08/0x1680 net/ipv6/addrconf.c:4191
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
worker_thread+0xb3e/0x1340 kernel/workqueue.c:2460
---[ end trace 9f23d7870f9b0a78 ]---
RIP: 0010:skb_panic+0x14c/0x150 net/core/skbuff.c:113
Code: c7 60 5f be 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 31 c0 53 41 56 41 55 41 54 e8 43 de dc 00 48 83 c4 20 <0f> 0b 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 4c
RSP: 0018:ffffc900001b6c78 EFLAGS: 00010286
RAX: 0000000000000087 RBX: ffffffff85be5fe0 RCX: e8f3e56c512fab00
RDX: 0000000000000000 RSI: 0000000000000603 RDI: 0000000000000000
RBP: ffffc900001b6cc0 R08: ffffffff815838a9 R09: 0000000000000003
R10: fffff52000036cf9 R11: 1ffff92000036cf8 R12: ffff888125abb800
R13: 00000000000000b8 R14: 0000000000000080 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe87ef9c58 CR3: 000000000620f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 83399dcc Merge 5.15.60 into android13-5.15-lts
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=103ee0ab880000
kernel config: https://syzkaller.appspot.com/x/.config?x=7d7631ec26cb9ac4
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
skbuff: skb_over_panic: text:ffffffff83237399 len:184 put:172 head:ffff888125abb800 data:ffff888125abb800 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 26 Comm: kworker/1:0 Not tainted 5.15.60-syzkaller-04887-g83399dcc1f25 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:skb_panic+0x14c/0x150 net/core/skbuff.c:113
Code: c7 60 5f be 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 31 c0 53 41 56 41 55 41 54 e8 43 de dc 00 48 83 c4 20 <0f> 0b 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 4c
RSP: 0018:ffffc900001b6c78 EFLAGS: 00010286
RAX: 0000000000000087 RBX: ffffffff85be5fe0 RCX: e8f3e56c512fab00
RDX: 0000000000000000 RSI: 0000000000000603 RDI: 0000000000000000
RBP: ffffc900001b6cc0 R08: ffffffff815838a9 R09: 0000000000000003
R10: fffff52000036cf9 R11: 1ffff92000036cf8 R12: ffff888125abb800
R13: 00000000000000b8 R14: 0000000000000080 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe87ef9c58 CR3: 000000010edcf000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
skb_over_panic net/core/skbuff.c:118 [inline]
skb_put+0x153/0x210 net/core/skbuff.c:2039
skb_put_zero include/linux/skbuff.h:2368 [inline]
cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]
cdc_ncm_fill_tx_frame+0x1229/0x3db0 drivers/net/usb/cdc_ncm.c:1308
cdc_ncm_tx_fixup+0xa2/0xf0
usbnet_start_xmit+0x116/0x1ae0 drivers/net/usb/usbnet.c:1370
__netdev_start_xmit include/linux/netdevice.h:5043 [inline]
netdev_start_xmit include/linux/netdevice.h:5057 [inline]
xmit_one+0x16a/0x480 net/core/dev.c:3597
dev_hard_start_xmit+0xad/0x1c0 net/core/dev.c:3613
sch_direct_xmit+0x295/0x9b0 net/sched/sch_generic.c:342
__dev_xmit_skb+0xb93/0x1650 net/core/dev.c:3824
__dev_queue_xmit+0x8f3/0x1b50 net/core/dev.c:4192
dev_queue_xmit+0x17/0x20 net/core/dev.c:4260
neigh_resolve_output+0x6d3/0x780 net/core/neighbour.c:1497
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xffe/0x1710 net/ipv6/ip6_output.c:126
__ip6_finish_output+0x674/0x850 net/ipv6/ip6_output.c:191
ip6_finish_output+0x20b/0x220 net/ipv6/ip6_output.c:201
NF_HOOK_COND include/linux/netfilter.h:299 [inline]
ip6_output+0x211/0x4c0 net/ipv6/ip6_output.c:224
dst_output include/net/dst.h:450 [inline]
NF_HOOK include/linux/netfilter.h:310 [inline]
ndisc_send_skb+0x779/0xce0 net/ipv6/ndisc.c:508
ndisc_send_ns+0x629/0x810 net/ipv6/ndisc.c:650
addrconf_dad_work+0xb08/0x1680 net/ipv6/addrconf.c:4191
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
worker_thread+0xb3e/0x1340 kernel/workqueue.c:2460
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
</TASK>
Modules linked in:
ret_from_fork+0x1f/0x30
</TASK>
---[ end trace 9f23d7870f9b0a78 ]---
RIP: 0010:skb_panic+0x14c/0x150 net/core/skbuff.c:113
Code: c7 60 5f be 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 31 c0 53 41 56 41 55 41 54 e8 43 de dc 00 48 83 c4 20 <0f> 0b 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 4c
RSP: 0018:ffffc900001b6c78 EFLAGS: 00010286
RAX: 0000000000000087 RBX: ffffffff85be5fe0 RCX: e8f3e56c512fab00
RDX: 0000000000000000 RSI: 0000000000000603 RDI: 0000000000000000
RBP: ffffc900001b6cc0 R08: ffffffff815838a9 R09: 0000000000000003
R10: fffff52000036cf9 R11: 1ffff92000036cf8 R12: ffff888125abb800
R13: 00000000000000b8 R14: 0000000000000080 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe87ef9c58 CR3: 000000000620f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 83399dcc Merge 5.15.60 into android13-5.15-lts
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=103ee0ab880000
kernel config: https://syzkaller.appspot.com/x/.config?x=7d7631ec26cb9ac4
Jun Nie
Dec 14, 2022, 10:30:59 PM12/14/22
to syzbot, syzkaller-a...@googlegroups.com
#syz test: https://android.googlesource.com/kernel/common 83399dcc1f2502c
Test the commit that just before the bad commit in android side when
before merge happens. With a possible fix patch to fix noisy bug.
Test the commit that just before the bad commit in android side when
syzbot
Dec 15, 2022, 6:31:18 AM12/15/22
to jun...@linaro.org, syzkaller-a...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in cdc_ncm_fill_tx_frame
skbuff: skb_over_panic: text:ffffffff83237399 len:184 put:172 head:ffff88812673b800 data:ffff88812673b800 tail:0xb8 end:0x80 dev:<NULL>
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in cdc_ncm_fill_tx_frame
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 512 Comm: kworker/1:5 Not tainted 5.15.60-syzkaller-04887-g83399dcc1f25-dirty #0
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: mld mld_ifc_work
RIP: 0010:skb_panic+0x14c/0x150 net/core/skbuff.c:113
Code: c7 60 62 be 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 31 c0 53 41 56 41 55 41 54 e8 13 dd dc 00 48 83 c4 20 <0f> 0b 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 4c
RSP: 0018:ffffc90000f16e78 EFLAGS: 00010286
RAX: 0000000000000087 RBX: ffffffff85be62e0 RCX: 5b93b080ef200a00
RDX: 0000000000000000 RSI: 0000000000000603 RDI: 0000000000000000
RBP: ffffc90000f16ec0 R08: ffffffff815838a9 R09: ffffed103ee265e8
R10: ffffed103ee265e8 R11: 1ffff1103ee265e7 R12: ffff88812673b800
R13: 00000000000000b8 R14: 0000000000000080 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556f340ea300 CR3: 0000000117419000 CR4: 00000000003506a0
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
mld_send_cr net/ipv6/mcast.c:2121 [inline]
mld_ifc_work+0x84f/0xc30 net/ipv6/mcast.c:2653
process_one_work+0x6db/0xc00 kernel/workqueue.c:2313
worker_thread+0xb3e/0x1340 kernel/workqueue.c:2460
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
</TASK>
Modules linked in:
---[ end trace 9583a104e7a083cc ]---
worker_thread+0xb3e/0x1340 kernel/workqueue.c:2460
kthread+0x41c/0x500 kernel/kthread.c:319
ret_from_fork+0x1f/0x30
</TASK>
Modules linked in:
RIP: 0010:skb_panic+0x14c/0x150 net/core/skbuff.c:113
Code: c7 60 62 be 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 31 c0 53 41 56 41 55 41 54 e8 13 dd dc 00 48 83 c4 20 <0f> 0b 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 4c
RSP: 0018:ffffc90000f16e78 EFLAGS: 00010286
RAX: 0000000000000087 RBX: ffffffff85be62e0 RCX: 5b93b080ef200a00
RDX: 0000000000000000 RSI: 0000000000000603 RDI: 0000000000000000
RBP: ffffc90000f16ec0 R08: ffffffff815838a9 R09: ffffed103ee265e8
R10: ffffed103ee265e8 R11: 1ffff1103ee265e7 R12: ffff88812673b800
R13: 00000000000000b8 R14: 0000000000000080 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556f340ea300 CR3: 000000000620f000 CR4: 00000000003506a0
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 83399dcc Merge 5.15.60 into android13-5.15-lts
git tree: https://android.googlesource.com/kernel/common
console output: https://syzkaller.appspot.com/x/log.txt?x=164ad9e7880000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 83399dcc Merge 5.15.60 into android13-5.15-lts
git tree: https://android.googlesource.com/kernel/common
kernel config: https://syzkaller.appspot.com/x/.config?x=7d7631ec26cb9ac4
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1765df1f880000
dashboard link: https://syzkaller.appspot.com/bug?extid=fba752ecc3518c5219a0
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Reply all
Reply to author
Forward
0 new messages