general protection fault in ath9k_hif_usb_rx_cb (2)
33 views
Skip to first unread message
syzbot
Jul 17, 2020, 2:56:17 PM7/17/20
to andre...@google.com, ath9k...@qca.qualcomm.com, da...@davemloft.net, ku...@kernel.org, kv...@codeaurora.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, linux-w...@vger.kernel.org, net...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 313da01a usb: misc: sisusbvga: Move static const tables ou..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=14226dd0900000
kernel config: https://syzkaller.appspot.com/x/.config?x=999be4eb2478ffa5
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6dde1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc00000001f2: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000f90-0x0000000000000f97]
CPU: 1 PID: 356 Comm: syz-executor.1 Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:627 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0x843/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 00 00 00 49 8d 7f 08 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 51 05 00 00 4d 8b 7f 08 49 8d bf 90 0f 00 00 48 89 f8 48 c1 e8 03 <0f> b6 04 28 84 c0 74 08 3c 03 0f 8e 25 05 00 00 48 8b 44 24 30 0f
RSP: 0018:ffff8881db309920 EFLAGS: 00010002
RAX: 00000000000001f2 RBX: 0000000000000c05 RCX: ffffc900006a8000
RDX: 0000000000040000 RSI: ffffffff82e1f88b RDI: 0000000000000f90
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8881c3e144a3
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000c05 R14: ffff8881d9babb40 R15: 0000000000000000
FS: 0000000002773940(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f052251e740 CR3: 00000001ad63e000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__usb_hcd_giveback_urb+0x32d/0x560 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716
dummy_timer+0x11f2/0x3240 drivers/usb/gadget/udc/dummy_hcd.c:1967
call_timer_fn+0x1ac/0x6e0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers.part.0+0x54c/0x9e0 kernel/time/timer.c:1773
__run_timers kernel/time/timer.c:1745 [inline]
run_timer_softirq+0x80/0x120 kernel/time/timer.c:1786
__do_softirq+0x222/0x95b kernel/softirq.c:292
asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
do_softirq_own_stack+0xed/0x140 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:387 [inline]
__irq_exit_rcu kernel/softirq.c:417 [inline]
irq_exit_rcu+0x150/0x1f0 kernel/softirq.c:429
sysvec_apic_timer_interrupt+0x49/0xc0 arch/x86/kernel/apic/apic.c:1091
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3b/0x40 kernel/locking/spinlock.c:191
Code: e8 ca b5 76 fb 48 89 ef e8 62 a2 77 fb f6 c7 02 75 11 53 9d e8 16 46 95 fb 65 ff 0d cf 0d 52 7a 5b 5d c3 e8 f7 4b 95 fb 53 9d <eb> ed 0f 1f 00 55 48 89 fd 65 ff 05 b5 0d 52 7a 45 31 c9 41 b8 01
RSP: 0018:ffff8881ad7b7c30 EFLAGS: 00000292
RAX: 0000000000243e09 RBX: 0000000000000292 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff85afe139
RBP: ffff8881d57fd4a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8881c6e14b00 R14: 0000000000000000 R15: ffff8881c6e14fd8
do_wait+0x42e/0x9b0 kernel/exit.c:1473
kernel_wait4+0x14c/0x260 kernel/exit.c:1621
__do_sys_wait4+0x13f/0x150 kernel/exit.c:1633
do_syscall_64+0x50/0x90 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x415ffa
Code: Bad RIP value.
RSP: 002b:00007ffd2403c368 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000023821 RCX: 0000000000415ffa
RDX: 0000000040000001 RSI: 00007ffd2403c3a0 RDI: ffffffffffffffff
RBP: 0000000000000060 R08: 0000000000000001 R09: 0000000002773940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd2403c3a0 R14: 0000000000023821 R15: 00007ffd2403c3b0
Modules linked in:
---[ end trace 1a7827ecbdcfd2ad ]---
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:627 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0x843/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 00 00 00 49 8d 7f 08 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 51 05 00 00 4d 8b 7f 08 49 8d bf 90 0f 00 00 48 89 f8 48 c1 e8 03 <0f> b6 04 28 84 c0 74 08 3c 03 0f 8e 25 05 00 00 48 8b 44 24 30 0f
RSP: 0018:ffff8881db309920 EFLAGS: 00010002
RAX: 00000000000001f2 RBX: 0000000000000c05 RCX: ffffc900006a8000
RDX: 0000000000040000 RSI: ffffffff82e1f88b RDI: 0000000000000f90
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8881c3e144a3
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000c05 R14: ffff8881d9babb40 R15: 0000000000000000
FS: 0000000002773940(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f052251e740 CR3: 00000001ad63e000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 313da01a usb: misc: sisusbvga: Move static const tables ou..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=14226dd0900000
kernel config: https://syzkaller.appspot.com/x/.config?x=999be4eb2478ffa5
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6dde1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc00000001f2: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000f90-0x0000000000000f97]
CPU: 1 PID: 356 Comm: syz-executor.1 Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:627 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0x843/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 00 00 00 49 8d 7f 08 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 51 05 00 00 4d 8b 7f 08 49 8d bf 90 0f 00 00 48 89 f8 48 c1 e8 03 <0f> b6 04 28 84 c0 74 08 3c 03 0f 8e 25 05 00 00 48 8b 44 24 30 0f
RSP: 0018:ffff8881db309920 EFLAGS: 00010002
RAX: 00000000000001f2 RBX: 0000000000000c05 RCX: ffffc900006a8000
RDX: 0000000000040000 RSI: ffffffff82e1f88b RDI: 0000000000000f90
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8881c3e144a3
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000c05 R14: ffff8881d9babb40 R15: 0000000000000000
FS: 0000000002773940(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f052251e740 CR3: 00000001ad63e000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__usb_hcd_giveback_urb+0x32d/0x560 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716
dummy_timer+0x11f2/0x3240 drivers/usb/gadget/udc/dummy_hcd.c:1967
call_timer_fn+0x1ac/0x6e0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers.part.0+0x54c/0x9e0 kernel/time/timer.c:1773
__run_timers kernel/time/timer.c:1745 [inline]
run_timer_softirq+0x80/0x120 kernel/time/timer.c:1786
__do_softirq+0x222/0x95b kernel/softirq.c:292
asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
do_softirq_own_stack+0xed/0x140 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:387 [inline]
__irq_exit_rcu kernel/softirq.c:417 [inline]
irq_exit_rcu+0x150/0x1f0 kernel/softirq.c:429
sysvec_apic_timer_interrupt+0x49/0xc0 arch/x86/kernel/apic/apic.c:1091
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3b/0x40 kernel/locking/spinlock.c:191
Code: e8 ca b5 76 fb 48 89 ef e8 62 a2 77 fb f6 c7 02 75 11 53 9d e8 16 46 95 fb 65 ff 0d cf 0d 52 7a 5b 5d c3 e8 f7 4b 95 fb 53 9d <eb> ed 0f 1f 00 55 48 89 fd 65 ff 05 b5 0d 52 7a 45 31 c9 41 b8 01
RSP: 0018:ffff8881ad7b7c30 EFLAGS: 00000292
RAX: 0000000000243e09 RBX: 0000000000000292 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff85afe139
RBP: ffff8881d57fd4a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8881c6e14b00 R14: 0000000000000000 R15: ffff8881c6e14fd8
do_wait+0x42e/0x9b0 kernel/exit.c:1473
kernel_wait4+0x14c/0x260 kernel/exit.c:1621
__do_sys_wait4+0x13f/0x150 kernel/exit.c:1633
do_syscall_64+0x50/0x90 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x415ffa
Code: Bad RIP value.
RSP: 002b:00007ffd2403c368 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000023821 RCX: 0000000000415ffa
RDX: 0000000040000001 RSI: 00007ffd2403c3a0 RDI: ffffffffffffffff
RBP: 0000000000000060 R08: 0000000000000001 R09: 0000000002773940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd2403c3a0 R14: 0000000000023821 R15: 00007ffd2403c3b0
Modules linked in:
---[ end trace 1a7827ecbdcfd2ad ]---
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:627 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0x843/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 00 00 00 49 8d 7f 08 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 51 05 00 00 4d 8b 7f 08 49 8d bf 90 0f 00 00 48 89 f8 48 c1 e8 03 <0f> b6 04 28 84 c0 74 08 3c 03 0f 8e 25 05 00 00 48 8b 44 24 30 0f
RSP: 0018:ffff8881db309920 EFLAGS: 00010002
RAX: 00000000000001f2 RBX: 0000000000000c05 RCX: ffffc900006a8000
RDX: 0000000000040000 RSI: ffffffff82e1f88b RDI: 0000000000000f90
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8881c3e144a3
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000c05 R14: ffff8881d9babb40 R15: 0000000000000000
FS: 0000000002773940(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f052251e740 CR3: 00000001ad63e000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Jul 17, 2020, 5:50:15 PM7/17/20
to andre...@google.com, ath9k...@qca.qualcomm.com, da...@davemloft.net, ku...@kernel.org, kv...@codeaurora.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, linux-w...@vger.kernel.org, net...@vger.kernel.org, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 313da01a usb: misc: sisusbvga: Move static const tables ou..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=15d1cde7100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=178d2680900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6dde1...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc00000001f3: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000f98-0x0000000000000f9f]
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.8.0-rc3-syzkaller #0
RIP: 0010:ath9k_hif_usb_rx_cb+0xc4d/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 48 c1 ea 03 80 3c 02 00 0f 85 0e 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb 9c 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffff8881db309920 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82e1fa3e
RDX: 00000000000001f3 RSI: ffffffff82e1fcb9 RDI: 0000000000000f9c
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8881d8fc442b
R10: 0000000000004e00 R11: 1ffffffff123bba9 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881d8fc4000 R15: ffff8881c8b5cf40
FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt+0x72/0x90 drivers/acpi/processor_idle.c:112
Code: 74 06 5b e9 60 c8 8f fb e8 5b c8 8f fb e8 a6 53 95 fb e9 0c 00 00 00 e8 4c c8 8f fb 0f 00 2d c5 e5 74 00 e8 40 c8 8f fb fb f4 <fa> e8 98 4d 95 fb 5b e9 32 c8 8f fb 48 89 df e8 fa 72 b9 fb eb ab
RSP: 0018:ffff8881da22fc80 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8881da213200 RSI: ffffffff85afd9a0 RDI: ffffffff85afd98a
RBP: ffff8881d8cca864 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8881d8cca864
R13: 1ffff1103b445f99 R14: ffff8881d8cca865 R15: 0000000000000001
acpi_idle_do_entry+0x15c/0x1b0 drivers/acpi/processor_idle.c:525
acpi_idle_enter+0x3f0/0xa50 drivers/acpi/processor_idle.c:651
cpuidle_enter_state+0xff/0x870 drivers/cpuidle/cpuidle.c:235
cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:346
call_cpuidle kernel/sched/idle.c:126 [inline]
cpuidle_idle_call kernel/sched/idle.c:214 [inline]
do_idle+0x3d6/0x5a0 kernel/sched/idle.c:276
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:372
start_secondary+0x2d2/0x3c0 arch/x86/kernel/smpboot.c:268
secondary_startup_64+0xb6/0xc0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace e2f028e5d5706562 ]---
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:580 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xc4d/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 48 c1 ea 03 80 3c 02 00 0f 85 0e 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb 9c 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffff8881db309920 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82e1fa3e
RDX: 00000000000001f3 RSI: ffffffff82e1fcb9 RDI: 0000000000000f9c
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8881d8fc442b
R10: 0000000000004e00 R11: 1ffffffff123bba9 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881d8fc4000 R15: ffff8881c8b5cf40
FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
HEAD commit: 313da01a usb: misc: sisusbvga: Move static const tables ou..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
kernel config: https://syzkaller.appspot.com/x/.config?x=999be4eb2478ffa5
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11edde20900000
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (GCC) 10.1.0-syz 20200507
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=178d2680900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6dde1...@syzkaller.appspotmail.com
KASAN: null-ptr-deref in range [0x0000000000000f98-0x0000000000000f9f]
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:580 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xc4d/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 48 c1 ea 03 80 3c 02 00 0f 85 0e 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb 9c 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffff8881db309920 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82e1fa3e
RDX: 00000000000001f3 RSI: ffffffff82e1fcb9 RDI: 0000000000000f9c
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8881d8fc442b
R10: 0000000000004e00 R11: 1ffffffff123bba9 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881d8fc4000 R15: ffff8881c8b5cf40
FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556e7bf7d8d8 CR3: 00000001c3194000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__usb_hcd_giveback_urb+0x32d/0x560 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716
dummy_timer+0x11f2/0x3240 drivers/usb/gadget/udc/dummy_hcd.c:1967
call_timer_fn+0x1ac/0x6e0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers.part.0+0x54c/0x9e0 kernel/time/timer.c:1773
__run_timers kernel/time/timer.c:1745 [inline]
run_timer_softirq+0x80/0x120 kernel/time/timer.c:1786
__do_softirq+0x222/0x95b kernel/softirq.c:292
asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
do_softirq_own_stack+0xed/0x140 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:387 [inline]
__irq_exit_rcu kernel/softirq.c:417 [inline]
irq_exit_rcu+0x150/0x1f0 kernel/softirq.c:429
sysvec_apic_timer_interrupt+0x49/0xc0 arch/x86/kernel/apic/apic.c:1091
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__usb_hcd_giveback_urb+0x32d/0x560 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716
dummy_timer+0x11f2/0x3240 drivers/usb/gadget/udc/dummy_hcd.c:1967
call_timer_fn+0x1ac/0x6e0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers.part.0+0x54c/0x9e0 kernel/time/timer.c:1773
__run_timers kernel/time/timer.c:1745 [inline]
run_timer_softirq+0x80/0x120 kernel/time/timer.c:1786
__do_softirq+0x222/0x95b kernel/softirq.c:292
asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
do_softirq_own_stack+0xed/0x140 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:387 [inline]
__irq_exit_rcu kernel/softirq.c:417 [inline]
irq_exit_rcu+0x150/0x1f0 kernel/softirq.c:429
sysvec_apic_timer_interrupt+0x49/0xc0 arch/x86/kernel/apic/apic.c:1091
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt+0x72/0x90 drivers/acpi/processor_idle.c:112
Code: 74 06 5b e9 60 c8 8f fb e8 5b c8 8f fb e8 a6 53 95 fb e9 0c 00 00 00 e8 4c c8 8f fb 0f 00 2d c5 e5 74 00 e8 40 c8 8f fb fb f4 <fa> e8 98 4d 95 fb 5b e9 32 c8 8f fb 48 89 df e8 fa 72 b9 fb eb ab
RSP: 0018:ffff8881da22fc80 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8881da213200 RSI: ffffffff85afd9a0 RDI: ffffffff85afd98a
RBP: ffff8881d8cca864 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8881d8cca864
R13: 1ffff1103b445f99 R14: ffff8881d8cca865 R15: 0000000000000001
acpi_idle_do_entry+0x15c/0x1b0 drivers/acpi/processor_idle.c:525
acpi_idle_enter+0x3f0/0xa50 drivers/acpi/processor_idle.c:651
cpuidle_enter_state+0xff/0x870 drivers/cpuidle/cpuidle.c:235
cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:346
call_cpuidle kernel/sched/idle.c:126 [inline]
cpuidle_idle_call kernel/sched/idle.c:214 [inline]
do_idle+0x3d6/0x5a0 kernel/sched/idle.c:276
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:372
start_secondary+0x2d2/0x3c0 arch/x86/kernel/smpboot.c:268
secondary_startup_64+0xb6/0xc0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace e2f028e5d5706562 ]---
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:580 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xc4d/0xf80 drivers/net/wireless/ath/ath9k/hif_usb.c:671
Code: 48 c1 ea 03 80 3c 02 00 0f 85 0e 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb 9c 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffff8881db309920 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82e1fa3e
RDX: 00000000000001f3 RSI: ffffffff82e1fcb9 RDI: 0000000000000f9c
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8881d8fc442b
R10: 0000000000004e00 R11: 1ffffffff123bba9 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881d8fc4000 R15: ffff8881c8b5cf40
FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556e7bf7d8d8 CR3: 00000001c3194000 CR4: 00000000001406e0
Hillf Danton
May 23, 2022, 7:07:12 AM5/23/22
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Fri, 17 Jul 2020 14:50:14 -0700
To fix uaf, free device after deinit.
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff -pur a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
--- a/drivers/net/wireless/ath/ath9k/htc.h 2022-05-23 17:56:42.787981400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc.h 2022-05-23 18:30:13.191877100 +0800
@@ -629,6 +629,7 @@ static inline void ath9k_led_work(struct
}
#endif
+void ath9k_htc_free_device(struct htc_target *htc_handle);
int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
u16 devid, char *product, u32 drv_info);
void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
diff -pur a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c 2022-05-23 17:22:52.048310400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c 2022-05-23 18:29:08.034130600 +0800
@@ -949,12 +949,12 @@ int ath9k_htc_probe_device(struct htc_ta
ret = ath9k_htc_wait_for_target(priv);
if (ret)
- goto err_free;
+ return ret;
priv->wmi = ath9k_init_wmi(priv);
if (!priv->wmi) {
ret = -EINVAL;
- goto err_free;
+ return ret;
}
ret = ath9k_init_htc_services(priv, devid, drv_info);
@@ -972,11 +972,15 @@ err_init:
hif_dev = (struct hif_device_usb *)htc_handle->hif_dev;
ath9k_hif_usb_dealloc_urbs(hif_dev);
ath9k_destroy_wmi(priv);
-err_free:
- ieee80211_free_hw(hw);
return ret;
}
+void ath9k_htc_free_device(struct htc_target *htc_handle)
+{
+ if (htc_handle->drv_priv)
+ ieee80211_free_hw(htc_handle->drv_priv->hw);
+}
+
void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
{
if (htc_handle->drv_priv) {
@@ -987,7 +991,6 @@ void ath9k_htc_disconnect_device(struct
ath9k_deinit_device(htc_handle->drv_priv);
ath9k_stop_wmi(htc_handle->drv_priv);
- ieee80211_free_hw(htc_handle->drv_priv->hw);
}
}
diff -pur a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c 2022-05-23 17:50:45.509466400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c 2022-05-23 18:25:26.908397600 +0800
@@ -498,6 +498,7 @@ struct htc_target *ath9k_htc_hw_alloc(vo
void ath9k_htc_hw_free(struct htc_target *htc)
{
+ ath9k_htc_free_device(htc);
kfree(htc);
}
--
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff -pur a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
--- a/drivers/net/wireless/ath/ath9k/htc.h 2022-05-23 17:56:42.787981400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc.h 2022-05-23 18:30:13.191877100 +0800
@@ -629,6 +629,7 @@ static inline void ath9k_led_work(struct
}
#endif
+void ath9k_htc_free_device(struct htc_target *htc_handle);
int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
u16 devid, char *product, u32 drv_info);
void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
diff -pur a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c 2022-05-23 17:22:52.048310400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c 2022-05-23 18:29:08.034130600 +0800
@@ -949,12 +949,12 @@ int ath9k_htc_probe_device(struct htc_ta
ret = ath9k_htc_wait_for_target(priv);
if (ret)
- goto err_free;
+ return ret;
priv->wmi = ath9k_init_wmi(priv);
if (!priv->wmi) {
ret = -EINVAL;
- goto err_free;
+ return ret;
}
ret = ath9k_init_htc_services(priv, devid, drv_info);
@@ -972,11 +972,15 @@ err_init:
hif_dev = (struct hif_device_usb *)htc_handle->hif_dev;
ath9k_hif_usb_dealloc_urbs(hif_dev);
ath9k_destroy_wmi(priv);
-err_free:
- ieee80211_free_hw(hw);
return ret;
}
+void ath9k_htc_free_device(struct htc_target *htc_handle)
+{
+ if (htc_handle->drv_priv)
+ ieee80211_free_hw(htc_handle->drv_priv->hw);
+}
+
void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
{
if (htc_handle->drv_priv) {
@@ -987,7 +991,6 @@ void ath9k_htc_disconnect_device(struct
ath9k_deinit_device(htc_handle->drv_priv);
ath9k_stop_wmi(htc_handle->drv_priv);
- ieee80211_free_hw(htc_handle->drv_priv->hw);
}
}
diff -pur a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c 2022-05-23 17:50:45.509466400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c 2022-05-23 18:25:26.908397600 +0800
@@ -498,6 +498,7 @@ struct htc_target *ath9k_htc_hw_alloc(vo
void ath9k_htc_hw_free(struct htc_target *htc)
{
+ ath9k_htc_free_device(htc);
kfree(htc);
}
--
syzbot
May 23, 2022, 7:27:14 AM5/23/22
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in ath9k_hif_usb_rx_cb
general protection fault, probably for non-canonical address 0xdffffc00000001f6: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000fb0-0x0000000000000fb7]
CPU: 3 PID: 33 Comm: ksoftirqd/3 Not tainted 5.18.0-syzkaller-00380-g4b0986a3613c-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:589 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xcfd/0x10d0 drivers/net/wireless/ath/ath9k/hif_usb.c:687
Code: 48 c1 ea 03 80 3c 02 00 0f 85 cc 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb b4 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffffc900007cf808 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: 00000000000001f6 RSI: ffffffff8526ff89 RDI: 0000000000000fb4
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8526fcef R11: 0000000000004e00 R12: 0000000000000000
R13: ffff88804dc60000 R14: ffff88802c54f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1737
__run_timers kernel/time/timer.c:1715 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1750
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:589 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xcfd/0x10d0 drivers/net/wireless/ath/ath9k/hif_usb.c:687
Code: 48 c1 ea 03 80 3c 02 00 0f 85 cc 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb b4 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffffc900007cf808 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: 00000000000001f6 RSI: ffffffff8526ff89 RDI: 0000000000000fb4
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8526fcef R11: 0000000000004e00 R12: 0000000000000000
R13: ffff88804dc60000 R14: ffff88802c54f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
Code disassembly (best guess):
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 cc 03 00 00 jne 0x3da
e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
15: fc ff df
18: 48 8b 5b 08 mov 0x8(%rbx),%rbx
1c: 48 8d bb b4 0f 00 00 lea 0xfb4(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 f8 mov %rdi,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 d0 cmp %dl,%al
39: 7c 09 jl 0x44
3b: 84 d2 test %dl,%dl
3d: 74 05 je 0x44
3f: e8 .byte 0xe8
Tested on:
commit: 4b0986a3 Linux 5.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17a7f4e5f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=55eba09345624206
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=177a69c3f00000
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in ath9k_hif_usb_rx_cb
general protection fault, probably for non-canonical address 0xdffffc00000001f6: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000fb0-0x0000000000000fb7]
CPU: 3 PID: 33 Comm: ksoftirqd/3 Not tainted 5.18.0-syzkaller-00380-g4b0986a3613c-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:589 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xcfd/0x10d0 drivers/net/wireless/ath/ath9k/hif_usb.c:687
Code: 48 c1 ea 03 80 3c 02 00 0f 85 cc 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb b4 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffffc900007cf808 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: 00000000000001f6 RSI: ffffffff8526ff89 RDI: 0000000000000fb4
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8526fcef R11: 0000000000004e00 R12: 0000000000000000
R13: ffff88804dc60000 R14: ffff88802c54f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d696b46600 CR3: 00000000247b2000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1737
__run_timers kernel/time/timer.c:1715 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1750
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:589 [inline]
RIP: 0010:ath9k_hif_usb_rx_cb+0xcfd/0x10d0 drivers/net/wireless/ath/ath9k/hif_usb.c:687
Code: 48 c1 ea 03 80 3c 02 00 0f 85 cc 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 08 48 8d bb b4 0f 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8
RSP: 0018:ffffc900007cf808 EFLAGS: 00010007
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: 00000000000001f6 RSI: ffffffff8526ff89 RDI: 0000000000000fb4
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8526fcef R11: 0000000000004e00 R12: 0000000000000000
R13: ffff88804dc60000 R14: ffff88802c54f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d696b46600 CR3: 00000000247b2000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Code disassembly (best guess):
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 cc 03 00 00 jne 0x3da
e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
15: fc ff df
18: 48 8b 5b 08 mov 0x8(%rbx),%rbx
1c: 48 8d bb b4 0f 00 00 lea 0xfb4(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 f8 mov %rdi,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 d0 cmp %dl,%al
39: 7c 09 jl 0x44
3b: 84 d2 test %dl,%dl
3d: 74 05 je 0x44
3f: e8 .byte 0xe8
Tested on:
commit: 4b0986a3 Linux 5.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17a7f4e5f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=55eba09345624206
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=177a69c3f00000
Hillf Danton
May 23, 2022, 8:49:12 AM5/23/22
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, 23 May 2022 04:27:13 -0700
v1, To fix uaf, free device after deinit.
v2, handle urb only if device is successfully initialized.
diff -pur a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c 2022-05-23 20:22:13.116199100 +0800
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c 2022-05-23 20:35:56.214334900 +0800
@@ -669,6 +669,8 @@ static void ath9k_hif_usb_rx_cb(struct u
if (!hif_dev)
goto free;
+ if (!(hif_dev->flags & HIF_USB_READY))
+ goto free;
switch (urb->status) {
case 0:
v2, handle urb only if device is successfully initialized.
diff -pur a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c 2022-05-23 20:22:13.116199100 +0800
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c 2022-05-23 20:35:56.214334900 +0800
@@ -669,6 +669,8 @@ static void ath9k_hif_usb_rx_cb(struct u
if (!hif_dev)
goto free;
+ if (!(hif_dev->flags & HIF_USB_READY))
+ goto free;
switch (urb->status) {
case 0:
syzbot
May 23, 2022, 9:12:07 AM5/23/22
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+c6dde1...@syzkaller.appspotmail.com
Tested on:
commit: 4b0986a3 Linux 5.18
git tree: upstream
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+c6dde1...@syzkaller.appspotmail.com
Tested on:
commit: 4b0986a3 Linux 5.18
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=55eba09345624206
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=10c01fc3f00000
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: testing is done by a robot and is best-effort only.
Hillf Danton
May 23, 2022, 9:31:59 AM5/23/22
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, 23 May 2022 04:27:13 -0700
v1, To fix uaf, free device after deinit.
v2, handle urb only if device is successfully initialized.
v3, see if it works to only check device ready.
v2, handle urb only if device is successfully initialized.
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff -pur a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c 2022-05-23 20:22:13.116199100 +0800
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c 2022-05-23 20:35:56.214334900 +0800
@@ -669,6 +669,8 @@ static void ath9k_hif_usb_rx_cb(struct u
if (!hif_dev)
goto free;
+ if (!(hif_dev->flags & HIF_USB_READY))
+ goto free;
switch (urb->status) {
case 0:
syzbot
May 23, 2022, 9:55:09 AM5/23/22
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+c6dde1...@syzkaller.appspotmail.com
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+c6dde1...@syzkaller.appspotmail.com
Tested on:
commit: 4b0986a3 Linux 5.18
git tree: upstream
commit: 4b0986a3 Linux 5.18
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=55eba09345624206
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=176788def00000
dashboard link: https://syzkaller.appspot.com/bug?extid=c6dde1f690b60e0b9fbe
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Reply all
Reply to author
Forward
0 new messages