KASAN: use-after-free Read in hiddev_disconnect

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 5a67532c usb: gadget: add raw-gadget interface
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=103175e1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9ba75825443d54bd
dashboard link: https://syzkaller.appspot.com/bug?extid=106b378813251e52fc5e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+106b37...@syzkaller.appspotmail.com

usb 2-1: USB disconnect, device number 119
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x31af/0x3b60
kernel/locking/lockdep.c:3828
Read of size 8 at addr ffff8881ca9748a8 by task kworker/1:6/4036

CPU: 1 PID: 4036 Comm: kworker/1:6 Not tainted 5.5.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xef/0x16e lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:374
__kasan_report.cold+0x37/0x85 mm/kasan/report.c:506
kasan_report+0xe/0x20 mm/kasan/common.c:639
__lock_acquire+0x31af/0x3b60 kernel/locking/lockdep.c:3828
lock_acquire+0x130/0x340 kernel/locking/lockdep.c:4485
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
__wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122
hiddev_disconnect+0x154/0x1b4 drivers/hid/usbhid/hiddev.c:937
hid_disconnect+0xb4/0x1a0 drivers/hid/hid-core.c:2008
hid_hw_stop+0x12/0x70 drivers/hid/hid-core.c:2053
cmhid_remove+0x38/0x50 drivers/hid/hid-cmedia.c:140
hid_device_remove+0xed/0x240 drivers/hid/hid-core.c:2294
__device_release_driver drivers/base/dd.c:1132 [inline]
device_release_driver_internal+0x231/0x500 drivers/base/dd.c:1165
bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:532
device_del+0x481/0xd30 drivers/base/core.c:2664
hid_remove_device drivers/hid/hid-core.c:2465 [inline]
hid_destroy_device+0xe1/0x150 drivers/hid/hid-core.c:2484
usbhid_disconnect+0x9f/0xe0 drivers/hid/usbhid/hid-core.c:1413
usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:1134 [inline]
device_release_driver_internal+0x42f/0x500 drivers/base/dd.c:1165
bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:532
device_del+0x481/0xd30 drivers/base/core.c:2664
usb_disable_device+0x23d/0x790 drivers/usb/core/message.c:1237
usb_disconnect+0x293/0x900 drivers/usb/core/hub.c:2200
hub_port_connect drivers/usb/core/hub.c:5035 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5324 [inline]
port_event drivers/usb/core/hub.c:5470 [inline]
hub_event+0x1a1d/0x4300 drivers/usb/core/hub.c:5552
process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 3947:
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:486
kmalloc include/linux/slab.h:556 [inline]
kzalloc include/linux/slab.h:670 [inline]
hiddev_connect+0x242/0x5b0 drivers/hid/usbhid/hiddev.c:890
hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1934
hid_hw_start drivers/hid/hid-core.c:2033 [inline]
hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:2024
cmhid_probe+0x104/0x160 drivers/hid/hid-cmedia.c:123
hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2261
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
hid_add_device drivers/hid/hid-core.c:2417 [inline]
hid_add_device+0x33c/0x9a0 drivers/hid/hid-core.c:2366
usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:361
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_set_configuration+0xe47/0x17d0 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0xaf/0x140 drivers/usb/core/driver.c:266
really_probe+0x290/0xad0 drivers/base/dd.c:548
driver_probe_device+0x223/0x350 drivers/base/dd.c:721
__device_attach_driver+0x1d1/0x290 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430
__device_attach+0x217/0x390 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490
device_add+0x1459/0x1bf0 drivers/base/core.c:2487
usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2537
hub_port_connect drivers/usb/core/hub.c:5184 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5324 [inline]
port_event drivers/usb/core/hub.c:5470 [inline]
hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5552
process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
process_scheduled_works kernel/workqueue.c:2326 [inline]
worker_thread+0x7ab/0xe20 kernel/workqueue.c:2412
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 6508:
save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x117/0x160 mm/kasan/common.c:474
slab_free_hook mm/slub.c:1425 [inline]
slab_free_freelist_hook mm/slub.c:1458 [inline]
slab_free mm/slub.c:3005 [inline]
kfree+0xd5/0x300 mm/slub.c:3957
hiddev_release+0x402/0x520 drivers/hid/usbhid/hiddev.c:232
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:304
entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881ca974800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 168 bytes inside of
512-byte region [ffff8881ca974800, ffff8881ca974a00)
The buggy address belongs to the page:
page:ffffea00072a5d00 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8881ca974780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881ca974800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881ca974880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ca974900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ca974980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: cd234325 usb: gadget: add raw-gadget interface

git tree: https://github.com/google/kasan.git usb-fuzzer

console output: https://syzkaller.appspot.com/x/log.txt?x=176dd6bee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb745005307bc641

dashboard link: https://syzkaller.appspot.com/bug?extid=106b378813251e52fc5e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14c6f9c9e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=170766bee00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+106b37...@syzkaller.appspotmail.com

usb 3-1: USB disconnect, device number 4
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x31af/0x3b60 kernel/locking/lockdep.c:3827
Read of size 8 at addr ffff8881cb1974a8 by task kworker/0:1/12

CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.5.0-rc7-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xef/0x16e lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:374
__kasan_report.cold+0x37/0x85 mm/kasan/report.c:506
kasan_report+0xe/0x20 mm/kasan/common.c:639

__lock_acquire+0x31af/0x3b60 kernel/locking/lockdep.c:3827
lock_acquire+0x130/0x340 kernel/locking/lockdep.c:4484

__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
__wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122
hiddev_disconnect+0x154/0x1b4 drivers/hid/usbhid/hiddev.c:937
hid_disconnect+0xb4/0x1a0 drivers/hid/hid-core.c:2008
hid_hw_stop+0x12/0x70 drivers/hid/hid-core.c:2053
cmhid_remove+0x38/0x50 drivers/hid/hid-cmedia.c:140
hid_device_remove+0xed/0x240 drivers/hid/hid-core.c:2294
__device_release_driver drivers/base/dd.c:1132 [inline]
device_release_driver_internal+0x231/0x500 drivers/base/dd.c:1165
bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:532
device_del+0x481/0xd30 drivers/base/core.c:2664
hid_remove_device drivers/hid/hid-core.c:2465 [inline]
hid_destroy_device+0xe1/0x150 drivers/hid/hid-core.c:2484
usbhid_disconnect+0x9f/0xe0 drivers/hid/usbhid/hid-core.c:1413
usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:1134 [inline]
device_release_driver_internal+0x42f/0x500 drivers/base/dd.c:1165
bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:532
device_del+0x481/0xd30 drivers/base/core.c:2664
usb_disable_device+0x23d/0x790 drivers/usb/core/message.c:1237

usb_disconnect+0x293/0x900 drivers/usb/core/hub.c:2201
hub_port_connect drivers/usb/core/hub.c:5036 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5325 [inline]
port_event drivers/usb/core/hub.c:5471 [inline]
hub_event+0x1a1d/0x4300 drivers/usb/core/hub.c:5553

process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 12:

usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2538
hub_port_connect drivers/usb/core/hub.c:5185 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5325 [inline]
port_event drivers/usb/core/hub.c:5471 [inline]
hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5553

process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
worker_thread+0x96/0xe20 kernel/workqueue.c:2410
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 1853:

save_stack+0x1b/0x80 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x117/0x160 mm/kasan/common.c:474
slab_free_hook mm/slub.c:1425 [inline]
slab_free_freelist_hook mm/slub.c:1458 [inline]
slab_free mm/slub.c:3005 [inline]
kfree+0xd5/0x300 mm/slub.c:3957
hiddev_release+0x402/0x520 drivers/hid/usbhid/hiddev.c:232
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:304
entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881cb197400

which belongs to the cache kmalloc-512 of size 512
The buggy address is located 168 bytes inside of

512-byte region [ffff8881cb197400, ffff8881cb197600)

The buggy address belongs to the page:

page:ffffea00072c6500 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0

raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff8881cb197380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881cb197400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881cb197480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881cb197500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881cb197580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

[Hillf Danton]

Sat, 25 Jan 2020 13:43:09 -0800
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: cd234325 usb: gadget: add raw-gadget interface

> git tree: https://github.com/google/kasan.git usb-fuzzer

> console output: https://syzkaller.appspot.com/x/log.txt?x=176dd6bee00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=bb745005307bc641

> dashboard link: https://syzkaller.appspot.com/bug?extid=106b378813251e52fc5e
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)

> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14c6f9c9e00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=170766bee00000
>

> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+106b37...@syzkaller.appspotmail.com
>

> usb 3-1: USB disconnect, device number 4

> ==================================================================

> BUG: KASAN: use-after-free in __lock_acquire+0x31af/0x3b60 kernel/locking/lockdep.c:3827
> Read of size 8 at addr ffff8881cb1974a8 by task kworker/0:1/12
>

> CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.5.0-rc7-syzkaller #0

> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xef/0x16e lib/dump_stack.c:118
> print_address_description.constprop.0.cold+0xd3/0x314 mm/kasan/report.c:374
> __kasan_report.cold+0x37/0x85 mm/kasan/report.c:506
> kasan_report+0xe/0x20 mm/kasan/common.c:639

> __lock_acquire+0x31af/0x3b60 kernel/locking/lockdep.c:3827
> lock_acquire+0x130/0x340 kernel/locking/lockdep.c:4484

> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
> __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122
> hiddev_disconnect+0x154/0x1b4 drivers/hid/usbhid/hiddev.c:937
> hid_disconnect+0xb4/0x1a0 drivers/hid/hid-core.c:2008
> hid_hw_stop+0x12/0x70 drivers/hid/hid-core.c:2053
> cmhid_remove+0x38/0x50 drivers/hid/hid-cmedia.c:140
> hid_device_remove+0xed/0x240 drivers/hid/hid-core.c:2294
> __device_release_driver drivers/base/dd.c:1132 [inline]
> device_release_driver_internal+0x231/0x500 drivers/base/dd.c:1165
> bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:532
> device_del+0x481/0xd30 drivers/base/core.c:2664
> hid_remove_device drivers/hid/hid-core.c:2465 [inline]
> hid_destroy_device+0xe1/0x150 drivers/hid/hid-core.c:2484
> usbhid_disconnect+0x9f/0xe0 drivers/hid/usbhid/hid-core.c:1413
> usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
> __device_release_driver drivers/base/dd.c:1134 [inline]
> device_release_driver_internal+0x42f/0x500 drivers/base/dd.c:1165
> bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:532
> device_del+0x481/0xd30 drivers/base/core.c:2664
> usb_disable_device+0x23d/0x790 drivers/usb/core/message.c:1237

> usb_disconnect+0x293/0x900 drivers/usb/core/hub.c:2201
> hub_port_connect drivers/usb/core/hub.c:5036 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5325 [inline]
> port_event drivers/usb/core/hub.c:5471 [inline]
> hub_event+0x1a1d/0x4300 drivers/usb/core/hub.c:5553

> process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
> worker_thread+0x96/0xe20 kernel/workqueue.c:2410
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>

> Allocated by task 12:

> usb_new_device.cold+0x540/0xcd0 drivers/usb/core/hub.c:2538
> hub_port_connect drivers/usb/core/hub.c:5185 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5325 [inline]
> port_event drivers/usb/core/hub.c:5471 [inline]
> hub_event+0x21cb/0x4300 drivers/usb/core/hub.c:5553

> process_one_work+0x945/0x15c0 kernel/workqueue.c:2264
> worker_thread+0x96/0xe20 kernel/workqueue.c:2410
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>

> Freed by task 1853:

> save_stack+0x1b/0x80 mm/kasan/common.c:72
> set_track mm/kasan/common.c:80 [inline]
> kasan_set_free_info mm/kasan/common.c:335 [inline]
> __kasan_slab_free+0x117/0x160 mm/kasan/common.c:474
> slab_free_hook mm/slub.c:1425 [inline]
> slab_free_freelist_hook mm/slub.c:1458 [inline]
> slab_free mm/slub.c:3005 [inline]
> kfree+0xd5/0x300 mm/slub.c:3957
> hiddev_release+0x402/0x520 drivers/hid/usbhid/hiddev.c:232
> __fput+0x2d7/0x840 fs/file_table.c:280
> task_work_run+0x13f/0x1c0 kernel/task_work.c:113
> tracehook_notify_resume include/linux/tracehook.h:188 [inline]
> exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:164
> prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
> syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
> do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:304
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>

> The buggy address belongs to the object at ffff8881cb197400

> which belongs to the cache kmalloc-512 of size 512
> The buggy address is located 168 bytes inside of

> 512-byte region [ffff8881cb197400, ffff8881cb197600)

> The buggy address belongs to the page:

> page:ffffea00072c6500 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0

> raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002500
> raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:

> ffff8881cb197380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881cb197400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >ffff8881cb197480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff8881cb197500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881cb197580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================

To fix uaf, axe reference to hiddev without lock protection.

--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -932,11 +932,10 @@ void hiddev_disconnect(struct hid_device
hiddev->exist = 0;

if (hiddev->open) {
- mutex_unlock(&hiddev->existancelock);
hid_hw_close(hiddev->hid);
wake_up_interruptible(&hiddev->wait);
- } else {
mutex_unlock(&hiddev->existancelock);
+ } else {
kfree(hiddev);
}
}

[Dan Carpenter]

I already fixed this bug in an earlier thread.

Syzbot always reports a use after free as two separate bugs, a read
after free and a write after free. It's too much hassle to mark all
the duplicates.

regards,
dan carpenter

[Andrey Konovalov]

#syz dup: KASAN: use-after-free Write in hiddev_disconnect

[Hillf Danton]

On Mon, 27 Jan 2020 12:28:50 +0300 Dan Carpenter wrote:
>
> I already fixed this bug in an earlier thread.
>

Great news! Double thanks to you for fixing it :)

[Dmitry Vyukov]

On Mon, Jan 27, 2020 at 10:29 AM Dan Carpenter <dan.ca...@oracle.com> wrote:
>

> I already fixed this bug in an earlier thread.
>
> Syzbot always reports a use after free as two separate bugs, a read
> after free and a write after free. It's too much hassle to mark all
> the duplicates.

+syzkaller mailing list

Hi Dan,

Not that it happens always, but, yes, it happens for racy bugs (for
single-threaded the type of the first access is usually
deterministic). Worse, sometimes they show up as GPF, unable to handle
kernel paging request, null-ptr-deref, user-memory-access, especially
for crashes that happen very frequently so that syzbot starts catching
long tail of more weird/unlucky incarnations.

The exact string is under our full control and can be changed. We did
some refinements to strings/grouping lots of times. I considered if
all of these should be grouped together and reported just as, say,
"bad-access in [function name]". However, the problem is that changes
to the strings/grouping will affect _all_ existing bugs: they will be
re-reported under new names, then old will be suspected to be fixed
(stopped happening), fix bisected, some closed as obsolete, some
concluded to be still happening, etc. And we have 300+ for upstream
(https://syzkaller.appspot.com/upstream) + 4 LTS versions + 4 Android
versions + a bunch of internal kernels + all users of syzkaller for
linux out there. So this will produce a whole lot of churn for
hundreds of people. The ones that we changed just affected
significantly fewer bugs (e.g. a new bug type).

I don't know what's the right solution at this point...
Changing the title will include lots of churn.
Marking as dups is too much hassle.
Not marking as dups will lead to hundreds of lots bugs and/or lots of
wasted time for people to rescan list of open bugs again and again,
missed backports, etc.

[Dan Carpenter]

One possible option would be to list the similar bugs at the start of
the bug report.

See also:

KASAN: use-after-free Write in hiddev_disconnect

https://syzkaller.appspot.com/bug?extid=784ccb935f9900cc7c9e

Then we could just copy and paste to the "#syz dup:" command. The
bitmap_port_list() stuff was reported something like 15 times so it was
really complicated to track. Hopefully if it were easier to mark things
as duplicate that would help.

regards,
dan carpenter

[Dmitry Vyukov]

Interesting. This should be doable. I've filed
https://github.com/google/syzkaller/issues/1575 to keep track of this.
If it detects potential dups, then it could auto-dup as well, but it's
not completely trivial (some things are mentioned on the issue).
But note it won't help if the bug happens in different functions (e.g.
I think lots of bitmap_port_list were actually in different
functions). And this is also common for racy bugs -- a racy free
catches use in another thread at different locations.