KASAN: stack-out-of-bounds Write in ath9k_hif_usb_rx_cb

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 0fa84af8 Merge tag 'usb-serial-5.7-rc1' of https://git.ker..
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=159a0583e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a782c087b1f425c6
dashboard link: https://syzkaller.appspot.com/bug?extid=d403396d4df67ad0bd5f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=177a266de00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1579f947e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d40339...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:626 [inline]
BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_cb+0xdf6/0xf70 drivers/net/wireless/ath/ath9k/hif_usb.c:666
Write of size 8 at addr ffff8881db309a28 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xef/0x16e lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:374
__kasan_report.cold+0x37/0x77 mm/kasan/report.c:506
kasan_report+0xe/0x20 mm/kasan/common.c:641
ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:626 [inline]
ath9k_hif_usb_rx_cb+0xdf6/0xf70 drivers/net/wireless/ath/ath9k/hif_usb.c:666
__usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1713
dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Qiujun Huang]

#syz test: https://github.com/google/kasan.git usb-fuzzer

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

828/au0828-video.o
AR drivers/media/usb/msi2500/built-in.a
CC drivers/media/dvb-frontends/isl6423.o
CC drivers/media/rc/keymaps/rc-nec-terratec-cinergy-xs.o
CC drivers/media/usb/gspca/mars.o
CC drivers/hid/hid-lg4ff.o
CC drivers/gpu/drm/drm_vblank.o
CC drivers/gpu/drm/drm_syncobj.o
CC drivers/gpu/drm/drm_lease.o
AR drivers/staging/rtl8712/built-in.a
CC drivers/media/usb/dvb-usb/dw2102.o
AR drivers/staging/built-in.a
CC drivers/media/dvb-frontends/ec100.o
CC drivers/media/dvb-frontends/ds3000.o
CC drivers/media/rc/keymaps/rc-norwood.o
CC drivers/media/dvb-frontends/ts2020.o
CC drivers/media/usb/gspca/mr97310a.o
CC drivers/media/usb/dvb-usb/dtv5100.o
CC drivers/gpu/drm/drm_writeback.o
CC drivers/hid/hid-lg-g15.o
AR drivers/media/usb/cpia2/built-in.a
CC drivers/media/usb/dvb-usb/cinergyT2-core.o
CC drivers/media/usb/gspca/nw80x.o
CC drivers/media/usb/pvrusb2/pvrusb2-i2c-core.o
CC drivers/media/usb/usbvision/usbvision-core.o
CC drivers/media/usb/stk1160/stk1160-core.o
CC drivers/media/usb/stk1160/stk1160-v4l.o
CC drivers/media/usb/dvb-usb/cinergyT2-fe.o
CC drivers/media/usb/cx231xx/cx231xx-video.o
CC drivers/media/usb/usbvision/usbvision-video.o
CC drivers/media/usb/usbvision/usbvision-i2c.o
CC drivers/media/usb/usbvision/usbvision-cards.o
CC drivers/media/usb/au0828/au0828-vbi.o
CC drivers/media/usb/au0828/au0828-input.o
CC drivers/media/rc/keymaps/rc-npgtech.o
CC drivers/media/usb/stk1160/stk1160-video.o
CC drivers/media/usb/tm6000/tm6000-cards.o
CC drivers/media/usb/tm6000/tm6000-core.o
CC drivers/media/usb/tm6000/tm6000-i2c.o
CC drivers/media/usb/tm6000/tm6000-video.o
CC drivers/media/rc/keymaps/rc-odroid.o
CC drivers/media/usb/pvrusb2/pvrusb2-audio.o
CC drivers/media/usb/gspca/ov519.o
CC drivers/hid/hid-logitech-dj.o
CC drivers/media/usb/pvrusb2/pvrusb2-encoder.o
AR drivers/media/usb/hdpvr/built-in.a
CC drivers/media/usb/gspca/ov534.o
CC drivers/hid/hid-logitech-hidpp.o
CC drivers/media/usb/stk1160/stk1160-i2c.o
CC drivers/hid/hid-magicmouse.o
CC drivers/gpu/drm/i915/display/intel_crt.o
CC drivers/media/rc/keymaps/rc-pctv-sedna.o
CC drivers/hid/hid-mf.o
CC drivers/gpu/drm/drm_client.o
CC drivers/gpu/drm/drm_client_modeset.o
CC drivers/gpu/drm/drm_atomic_uapi.o
CC drivers/gpu/drm/drm_hdcp.o
CC drivers/media/usb/tm6000/tm6000-stds.o
CC drivers/media/usb/cx231xx/cx231xx-i2c.o
CC drivers/media/dvb-frontends/mb86a20s.o
CC drivers/media/usb/gspca/ov534_9.o
CC drivers/media/usb/cx231xx/cx231xx-cards.o
CC drivers/media/rc/keymaps/rc-pinnacle-color.o
CC drivers/media/usb/cx231xx/cx231xx-core.o
CC drivers/gpu/drm/drm_ioc32.o
CC drivers/media/usb/cx231xx/cx231xx-avcore.o
CC drivers/media/usb/tm6000/tm6000-input.o
CC drivers/media/usb/pvrusb2/pvrusb2-video-v4l.o
CC drivers/media/usb/pvrusb2/pvrusb2-eeprom.o
CC drivers/media/usb/stk1160/stk1160-ac97.o
CC drivers/media/usb/dvb-usb/az6027.o
CC drivers/gpu/drm/drm_gem_shmem_helper.o
CC drivers/gpu/drm/drm_panel.o
CC drivers/media/rc/keymaps/rc-pinnacle-grey.o
CC drivers/media/usb/pvrusb2/pvrusb2-main.o
CC drivers/gpu/drm/drm_agpsupport.o
CC drivers/hid/hid-microsoft.o
CC drivers/media/usb/em28xx/em28xx-core.o
CC drivers/media/usb/em28xx/em28xx-i2c.o
AR drivers/media/usb/au0828/built-in.a
CC drivers/media/usb/tm6000/tm6000-alsa.o
CC drivers/media/usb/tm6000/tm6000-dvb.o
CC drivers/gpu/drm/drm_pci.o
CC drivers/media/usb/dvb-usb/technisat-usb2.o
CC drivers/media/usb/em28xx/em28xx-cards.o
CC drivers/media/usb/cx231xx/cx231xx-417.o
CC drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.o
AR drivers/media/usb/stk1160/built-in.a
CC drivers/gpu/drm/drm_debugfs.o
CC drivers/media/usb/gspca/pac207.o
CC drivers/gpu/drm/i915/display/intel_ddi.o
CC drivers/media/usb/em28xx/em28xx-camera.o
CC drivers/media/usb/pvrusb2/pvrusb2-hdw.o
CC drivers/media/usb/usbtv/usbtv-core.o
CC drivers/media/usb/go7007/go7007-v4l2.o
CC drivers/media/dvb-frontends/ix2505v.o
CC drivers/hid/hid-monterey.o
CC drivers/gpu/drm/drm_debugfs_crc.o
CC drivers/media/rc/keymaps/rc-pixelview.o
CC drivers/media/usb/pvrusb2/pvrusb2-v4l2.o
CC drivers/gpu/drm/drm_mipi_dsi.o
CC drivers/gpu/drm/i915/display/intel_dp.o
CC drivers/media/usb/pvrusb2/pvrusb2-ctrl.o
CC drivers/media/usb/pvrusb2/pvrusb2-std.o
CC drivers/media/dvb-frontends/cxd2820r_core.o
AR drivers/media/usb/tm6000/built-in.a
CC drivers/media/rc/keymaps/rc-pixelview-mk12.o
AR drivers/media/usb/usbvision/built-in.a
CC drivers/gpu/drm/drm_panel_orientation_quirks.o
CC drivers/media/usb/em28xx/em28xx-video.o
CC drivers/gpu/drm/i915/display/intel_dp_aux_backlight.o
CC drivers/media/usb/usbtv/usbtv-video.o
CC drivers/media/usb/cx231xx/cx231xx-pcb-cfg.o
CC drivers/gpu/drm/i915/display/intel_dp_link_training.o
CC drivers/media/usb/go7007/go7007-driver.o
CC drivers/media/usb/cx231xx/cx231xx-vbi.o
AR drivers/media/usb/dvb-usb/built-in.a
CC drivers/media/rc/keymaps/rc-pixelview-002t.o
CC drivers/gpu/drm/i915/display/intel_dp_mst.o
CC drivers/hid/hid-multitouch.o
CC drivers/media/usb/em28xx/em28xx-vbi.o
CC drivers/media/usb/em28xx/em28xx-audio.o
CC drivers/media/rc/keymaps/rc-pixelview-new.o
CC drivers/hid/hid-nti.o
CC drivers/media/usb/pvrusb2/pvrusb2-devattr.o
CC drivers/media/usb/em28xx/em28xx-dvb.o
CC drivers/hid/hid-ntrig.o
CC drivers/media/usb/em28xx/em28xx-input.o
CC drivers/media/usb/go7007/go7007-i2c.o
CC drivers/media/rc/keymaps/rc-powercolor-real-angel.o
CC drivers/media/rc/keymaps/rc-proteus-2309.o
CC drivers/media/usb/go7007/go7007-fw.o
CC drivers/media/rc/keymaps/rc-purpletv.o
CC drivers/media/usb/pvrusb2/pvrusb2-context.o
CC drivers/media/usb/pvrusb2/pvrusb2-io.o
CC drivers/media/dvb-frontends/cxd2820r_c.o
CC drivers/hid/hid-ortek.o
CC drivers/hid/hid-prodikeys.o
CC drivers/media/usb/as102/as102_drv.o
CC drivers/media/usb/as102/as102_fw.o
CC drivers/media/usb/as102/as10x_cmd.o
CC drivers/media/rc/keymaps/rc-pv951.o
CC drivers/media/rc/keymaps/rc-hauppauge.o
CC drivers/media/usb/usbtv/usbtv-audio.o
CC drivers/gpu/drm/i915/display/intel_dsi.o
CC drivers/media/rc/keymaps/rc-rc6-mce.o
CC drivers/hid/hid-pl.o
CC drivers/gpu/drm/i915/display/intel_dsi_dcs_backlight.o
CC drivers/media/usb/go7007/snd-go7007.o
CC drivers/media/usb/cx231xx/cx231xx-input.o
CC drivers/media/usb/gspca/pac7302.o
CC drivers/media/usb/gspca/pac7311.o
CC drivers/media/usb/cx231xx/cx231xx-dvb.o
CC drivers/media/usb/cx231xx/cx231xx-audio.o
CC drivers/media/usb/go7007/go7007-usb.o
CC drivers/gpu/drm/i915/display/intel_dsi_vbt.o
CC drivers/media/rc/keymaps/rc-real-audio-220-32-keys.o
CC drivers/media/usb/pvrusb2/pvrusb2-ioread.o
CC drivers/media/rc/keymaps/rc-reddo.o
CC drivers/media/dvb-frontends/cxd2820r_t.o
CC drivers/media/rc/keymaps/rc-snapstream-firefly.o
CC drivers/media/usb/pulse8-cec/pulse8-cec.o
CC drivers/media/usb/go7007/go7007-loader.o
CC drivers/media/usb/rainshadow-cec/rainshadow-cec.o
CC drivers/hid/hid-penmount.o
CC drivers/hid/hid-petalynx.o
CC drivers/gpu/drm/i915/display/intel_dvo.o
CC drivers/hid/hid-picolcd_core.o
CC drivers/media/usb/gspca/se401.o
CC drivers/media/usb/as102/as10x_cmd_stream.o
AR drivers/media/usb/usbtv/built-in.a
CC drivers/media/rc/keymaps/rc-streamzap.o
CC drivers/gpu/drm/i915/display/intel_gmbus.o
CC drivers/gpu/drm/i915/display/intel_hdmi.o
CC drivers/gpu/drm/i915/display/intel_lspcon.o
CC drivers/media/usb/pvrusb2/pvrusb2-cx2584x-v4l.o
CC drivers/media/rc/keymaps/rc-tango.o
CC drivers/gpu/drm/i915/display/intel_lvds.o
CC drivers/media/usb/pvrusb2/pvrusb2-wm8775.o
CC drivers/media/usb/gspca/sn9c2028.o
CC drivers/media/usb/go7007/s2250-board.o
CC drivers/media/usb/as102/as102_usb_drv.o
CC drivers/media/usb/as102/as10x_cmd_cfg.o
CC drivers/media/usb/pvrusb2/pvrusb2-cs53l32a.o
CC drivers/hid/hid-picolcd_fb.o
CC drivers/media/usb/pvrusb2/pvrusb2-dvb.o
CC drivers/media/usb/pvrusb2/pvrusb2-sysfs.o
CC drivers/media/rc/keymaps/rc-tanix-tx3mini.o
CC drivers/media/dvb-frontends/cxd2820r_t2.o
AR drivers/media/usb/rainshadow-cec/built-in.a
CC drivers/gpu/drm/i915/display/intel_panel.o
CC drivers/media/rc/keymaps/rc-tanix-tx5max.o
CC drivers/gpu/drm/i915/display/intel_sdvo.o
CC drivers/media/dvb-frontends/cxd2841er.o
AR drivers/media/usb/pulse8-cec/built-in.a
CC drivers/media/rc/keymaps/rc-tbs-nec.o
CC drivers/media/rc/keymaps/rc-technisat-ts35.o
AR drivers/media/usb/em28xx/built-in.a
CC drivers/media/rc/keymaps/rc-technisat-usb2.o
CC drivers/gpu/drm/i915/display/intel_tv.o
CC drivers/media/usb/gspca/sn9c20x.o
CC drivers/media/usb/gspca/sonixb.o
CC drivers/media/usb/gspca/sonixj.o
CC drivers/media/rc/keymaps/rc-terratec-cinergy-c-pci.o
CC drivers/media/rc/keymaps/rc-terratec-cinergy-s2-hd.o
AR drivers/media/usb/cx231xx/built-in.a
CC drivers/gpu/drm/i915/display/intel_vdsc.o
CC drivers/hid/hid-picolcd_backlight.o
CC drivers/hid/hid-picolcd_lcd.o
CC drivers/hid/hid-picolcd_leds.o
CC drivers/media/rc/keymaps/rc-terratec-cinergy-xs.o
AR drivers/media/usb/as102/built-in.a
CC drivers/media/rc/keymaps/rc-terratec-slim.o
CC drivers/hid/hid-picolcd_cir.o
AR drivers/media/usb/go7007/built-in.a
CC drivers/media/rc/keymaps/rc-terratec-slim-2.o
CC drivers/media/dvb-frontends/drxk_hard.o
CC drivers/media/rc/keymaps/rc-tevii-nec.o
CC drivers/media/rc/keymaps/rc-tivo.o
CC drivers/hid/hid-picolcd_debugfs.o
CC drivers/hid/hid-plantronics.o
CC drivers/gpu/drm/i915/display/vlv_dsi.o
CC drivers/media/rc/keymaps/rc-total-media-in-hand.o
CC drivers/media/usb/gspca/spca500.o
CC drivers/media/usb/gspca/spca501.o
CC drivers/gpu/drm/i915/display/vlv_dsi_pll.o
CC drivers/media/usb/gspca/spca505.o
CC drivers/media/usb/gspca/spca506.o
CC drivers/gpu/drm/i915/oa/i915_oa_hsw.o
CC drivers/media/dvb-frontends/tda18271c2dd.o
CC drivers/hid/hid-primax.o
CC drivers/media/usb/gspca/spca508.o
CC drivers/hid/hid-retrode.o
CC drivers/gpu/drm/i915/oa/i915_oa_chv.o
CC drivers/gpu/drm/i915/oa/i915_oa_bdw.o
CC drivers/media/rc/keymaps/rc-total-media-in-hand-02.o
CC drivers/media/rc/keymaps/rc-trekstor.o
CC drivers/media/rc/keymaps/rc-tt-1500.o
CC drivers/gpu/drm/i915/oa/i915_oa_sklgt2.o
CC drivers/gpu/drm/i915/oa/i915_oa_sklgt3.o
CC drivers/gpu/drm/i915/oa/i915_oa_sklgt4.o
CC drivers/hid/hid-roccat.o
CC drivers/media/usb/gspca/spca561.o
CC drivers/media/rc/keymaps/rc-twinhan-dtv-cab-ci.o
CC drivers/media/dvb-frontends/si2165.o
CC drivers/media/usb/gspca/spca1528.o
CC drivers/media/rc/keymaps/rc-twinhan1027.o
CC drivers/media/dvb-frontends/a8293.o
CC drivers/gpu/drm/i915/oa/i915_oa_bxt.o
CC drivers/gpu/drm/i915/oa/i915_oa_kblgt2.o
CC drivers/media/dvb-frontends/sp2.o
CC drivers/hid/hid-roccat-common.o
CC drivers/hid/hid-roccat-arvo.o
CC drivers/hid/hid-roccat-isku.o
CC drivers/hid/hid-roccat-kone.o
CC drivers/hid/hid-roccat-koneplus.o
CC drivers/hid/hid-roccat-konepure.o
CC drivers/media/rc/keymaps/rc-vega-s9x.o
CC drivers/media/usb/gspca/sq905.o
CC drivers/media/dvb-frontends/tda10071.o
CC drivers/media/dvb-frontends/rtl2830.o
CC drivers/hid/hid-roccat-kovaplus.o
CC drivers/hid/hid-roccat-lua.o
CC drivers/hid/hid-roccat-pyra.o
CC drivers/media/rc/keymaps/rc-videomate-m1f.o
CC drivers/gpu/drm/i915/oa/i915_oa_kblgt3.o
CC drivers/media/dvb-frontends/rtl2832.o
AR drivers/media/usb/pvrusb2/built-in.a
CC drivers/hid/hid-roccat-ryos.o
CC drivers/gpu/drm/i915/oa/i915_oa_glk.o
CC drivers/hid/hid-roccat-savu.o
CC drivers/gpu/drm/i915/oa/i915_oa_cflgt2.o
CC drivers/gpu/drm/i915/oa/i915_oa_cflgt3.o
CC drivers/media/rc/keymaps/rc-videomate-s350.o
CC drivers/gpu/drm/i915/oa/i915_oa_cnl.o
CC drivers/media/rc/keymaps/rc-videomate-tv-pvr.o
CC drivers/media/usb/gspca/sq905c.o
CC drivers/media/usb/gspca/sq930x.o
CC drivers/gpu/drm/i915/oa/i915_oa_icl.o
CC drivers/gpu/drm/i915/oa/i915_oa_tgl.o
CC drivers/hid/hid-rmi.o
CC drivers/gpu/drm/i915/i915_perf.o
CC drivers/media/usb/gspca/sunplus.o
CC drivers/media/dvb-frontends/rtl2832_sdr.o
CC drivers/hid/hid-saitek.o
CC drivers/hid/hid-samsung.o
CC drivers/media/dvb-frontends/m88rs2000.o
CC drivers/media/dvb-frontends/af9033.o
CC drivers/media/rc/keymaps/rc-wetek-hub.o
CC drivers/media/usb/gspca/stk014.o
CC drivers/media/rc/keymaps/rc-wetek-play2.o
CC drivers/media/dvb-frontends/as102_fe.o
CC drivers/gpu/drm/i915/i915_gpu_error.o
CC drivers/media/dvb-frontends/tc90522.o
CC drivers/media/dvb-frontends/gp8psk-fe.o
CC drivers/media/rc/keymaps/rc-winfast.o
CC drivers/hid/hid-sjoy.o
CC drivers/hid/hid-sony.o
CC drivers/gpu/drm/i915/i915_vgpu.o
CC drivers/media/rc/keymaps/rc-winfast-usbii-deluxe.o
CC drivers/hid/hid-speedlink.o
CC drivers/media/rc/keymaps/rc-su3000.o
CC drivers/media/dvb-frontends/zd1301_demod.o
CC drivers/media/rc/keymaps/rc-xbox-dvd.o
CC drivers/media/usb/gspca/stk1135.o
CC drivers/hid/hid-steelseries.o
CC drivers/hid/hid-sunplus.o
CC drivers/media/usb/gspca/stv0680.o
CC drivers/hid/hid-gaff.o
CC drivers/hid/hid-tmff.o
CC drivers/media/rc/keymaps/rc-x96max.o
CC drivers/media/rc/keymaps/rc-zx-irdec.o
CC drivers/hid/hid-tivo.o
CC drivers/hid/hid-topseed.o
CC drivers/media/usb/gspca/t613.o
CC drivers/media/usb/gspca/topro.o
CC drivers/media/usb/gspca/tv8532.o
CC drivers/media/usb/gspca/touptek.o
CC drivers/hid/hid-uclogic-core.o
CC drivers/hid/hid-twinhan.o
CC drivers/hid/hid-uclogic-rdesc.o
CC drivers/media/usb/gspca/vc032x.o
CC drivers/media/usb/gspca/xirlink_cit.o
CC drivers/hid/hid-uclogic-params.o
CC drivers/media/usb/gspca/vicam.o
CC drivers/hid/hid-udraw-ps3.o
CC drivers/hid/hid-led.o
CC drivers/hid/hid-xinmo.o
AR drivers/media/rc/keymaps/built-in.a
CC drivers/hid/hid-zpff.o
AR drivers/media/rc/built-in.a
CC drivers/hid/hid-zydacron.o
CC drivers/media/usb/gspca/zc3xx.o
CC drivers/hid/wacom_wac.o
CC drivers/hid/wacom_sys.o
CC drivers/hid/hid-waltop.o
CC drivers/hid/hid-wiimote-core.o
CC drivers/hid/hid-wiimote-modules.o
CC drivers/hid/hid-wiimote-debug.o
CC drivers/hid/hid-sensor-hub.o
CC drivers/hid/hid-sensor-custom.o
AR drivers/media/dvb-frontends/built-in.a
AR drivers/media/usb/gspca/built-in.a
AR drivers/media/usb/built-in.a
AR drivers/media/built-in.a
AR drivers/gpu/drm/i915/built-in.a
AR drivers/gpu/drm/built-in.a
AR drivers/gpu/built-in.a
AR drivers/hid/built-in.a
Makefile:1683: recipe for target 'drivers' failed
make: *** [drivers] Error 2


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12e89493e00000


Tested on:

commit: 0fa84af8 Merge tag 'usb-serial-5.7-rc1' of https://git.ker..
git tree: https://github.com/google/kasan.git usb-fuzzer

dashboard link: https://syzkaller.appspot.com/bug?extid=d403396d4df67ad0bd5f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=14aafcb7e00000

[Qiujun Huang]

#syz test: https://github.com/google/kasan.git usb-fuzzer

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer still triggered crash:
KASAN: use-after-free Read in htc_connect_service

usb 4-1: Service connection timeout for: 256
==================================================================
BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:134 [inline]
BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:1042 [inline]
BUG: KASAN: use-after-free in kfree_skb+0x32/0x3d0 net/core/skbuff.c:692
Read of size 4 at addr ffff8881c7ec2d54 by task kworker/0:5/3237

CPU: 0 PID: 3237 Comm: kworker/0:5 Not tainted 5.6.0-rc7-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Workqueue: events request_firmware_work_func
Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xef/0x16e lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:374
__kasan_report.cold+0x37/0x77 mm/kasan/report.c:506
kasan_report+0xe/0x20 mm/kasan/common.c:641

check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x152/0x1c0 mm/kasan/generic.c:192
atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
refcount_read include/linux/refcount.h:134 [inline]
skb_unref include/linux/skbuff.h:1042 [inline]
kfree_skb+0x32/0x3d0 net/core/skbuff.c:692
htc_connect_service.cold+0xa9/0x109 drivers/net/wireless/ath/ath9k/htc_hst.c:282
ath9k_wmi_connect+0xd2/0x1a0 drivers/net/wireless/ath/ath9k/wmi.c:265
ath9k_init_htc_services.constprop.0+0xb4/0x650 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
ath9k_htc_probe_device+0x25a/0x1d80 drivers/net/wireless/ath/ath9k/htc_drv_init.c:959
ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
ath9k_hif_usb_firmware_cb+0x26b/0x500 drivers/net/wireless/ath/ath9k/hif_usb.c:1192
request_firmware_work_func+0x126/0x242 drivers/base/firmware_loader/main.c:976
process_one_work+0x94b/0x1620 kernel/workqueue.c:2266
worker_thread+0x96/0xe20 kernel/workqueue.c:2412
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 3237:
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:515 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:488
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2786 [inline]
kmem_cache_alloc_node+0xdc/0x330 mm/slub.c:2822
__alloc_skb+0xba/0x5a0 net/core/skbuff.c:198
alloc_skb include/linux/skbuff.h:1081 [inline]
htc_connect_service+0x2cc/0x840 drivers/net/wireless/ath/ath9k/htc_hst.c:257
ath9k_wmi_connect+0xd2/0x1a0 drivers/net/wireless/ath/ath9k/wmi.c:265
ath9k_init_htc_services.constprop.0+0xb4/0x650 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
ath9k_htc_probe_device+0x25a/0x1d80 drivers/net/wireless/ath/ath9k/htc_drv_init.c:959
ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
ath9k_hif_usb_firmware_cb+0x26b/0x500 drivers/net/wireless/ath/ath9k/hif_usb.c:1192
request_firmware_work_func+0x126/0x242 drivers/base/firmware_loader/main.c:976
process_one_work+0x94b/0x1620 kernel/workqueue.c:2266
worker_thread+0x96/0xe20 kernel/workqueue.c:2412
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 0:
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:337 [inline]
__kasan_slab_free+0x117/0x160 mm/kasan/common.c:476
slab_free_hook mm/slub.c:1444 [inline]
slab_free_freelist_hook mm/slub.c:1477 [inline]
slab_free mm/slub.c:3034 [inline]
kmem_cache_free+0x9b/0x360 mm/slub.c:3050
kfree_skbmem net/core/skbuff.c:622 [inline]
kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:616
__kfree_skb net/core/skbuff.c:679 [inline]
kfree_skb net/core/skbuff.c:696 [inline]
kfree_skb+0x102/0x3d0 net/core/skbuff.c:690
ath9k_htc_txcompletion_cb+0x1f8/0x2b0 drivers/net/wireless/ath/ath9k/htc_hst.c:356
hif_usb_regout_cb+0x10b/0x1b0 drivers/net/wireless/ath/ath9k/hif_usb.c:90

__usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1713
dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786

__do_softirq+0x21e/0x950 kernel/softirq.c:292

The buggy address belongs to the object at ffff8881c7ec2c80
which belongs to the cache skbuff_head_cache of size 224
The buggy address is located 212 bytes inside of
224-byte region [ffff8881c7ec2c80, ffff8881c7ec2d60)
The buggy address belongs to the page:
page:ffffea00071fb080 refcount:1 mapcount:0 mapping:ffff8881da16b400 index:0x0
flags: 0x200000000000200(slab)
raw: 0200000000000200 dead000000000100 dead000000000122 ffff8881da16b400
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8881c7ec2c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881c7ec2c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881c7ec2d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff8881c7ec2d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8881c7ec2e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Tested on:

commit: 0fa84af8 Merge tag 'usb-serial-5.7-rc1' of https://git.ker..
git tree: https://github.com/google/kasan.git usb-fuzzer

console output: https://syzkaller.appspot.com/x/log.txt?x=17c2dadbe00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a782c087b1f425c6

dashboard link: https://syzkaller.appspot.com/bug?extid=d403396d4df67ad0bd5f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=14b7b40be00000

[Qiujun Huang]

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger crash:

Reported-and-tested-by: syzbot+d40339...@syzkaller.appspotmail.com

Tested on:

commit: 0fa84af8 Merge tag 'usb-serial-5.7-rc1' of https://git.ker..
git tree: https://github.com/google/kasan.git usb-fuzzer

kernel config: https://syzkaller.appspot.com/x/.config?x=a782c087b1f425c6
dashboard link: https://syzkaller.appspot.com/bug?extid=d403396d4df67ad0bd5f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=15bd0cfbe00000

Note: testing is done by a robot and is best-effort only.