lkml.org 
[lkml]   [2019]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectKASAN: use-after-free Read in p54u_load_firmware_cb
    From
    Hello,

    syzbot found the following crash on:

    HEAD commit: 43151d6c usb-fuzzer: main usb gadget fuzzer driver
    git tree: https://github.com/google/kasan.git usb-fuzzer
    console output: https://syzkaller.appspot.com/x/log.txt?x=142b312ca00000
    kernel config: https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234
    dashboard link: https://syzkaller.appspot.com/bug?extid=200d4bb11b23d929335f
    compiler: gcc (GCC) 9.0.0 20181231 (experimental)

    Unfortunately, I don't have any reproducer for this crash yet.

    IMPORTANT: if you fix the bug, please add the following tag to the commit:
    Reported-by: syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com

    usb 4-1: Direct firmware load for isl3887usb failed with error -2
    usb 4-1: Firmware not found.
    ==================================================================
    BUG: KASAN: use-after-free in p54u_load_firmware_cb.cold+0x97/0x13a
    drivers/net/wireless/intersil/p54/p54usb.c:936
    Read of size 8 at addr ffff888098bf3588 by task kworker/0:1/12

    CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc3-319004-g43151d6 #6
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
    Google 01/01/2011
    Workqueue: events request_firmware_work_func
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0xe8/0x16e lib/dump_stack.c:113
    print_address_description+0x6c/0x236 mm/kasan/report.c:187
    kasan_report.cold+0x1a/0x3c mm/kasan/report.c:317
    p54u_load_firmware_cb.cold+0x97/0x13a
    drivers/net/wireless/intersil/p54/p54usb.c:936
    request_firmware_work_func+0x12d/0x249
    drivers/base/firmware_loader/main.c:785
    process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
    worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
    kthread+0x313/0x420 kernel/kthread.c:253
    ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

    The buggy address belongs to the page:
    page:ffffea000262fcc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
    flags: 0xfff00000000000()
    raw: 00fff00000000000 0000000000000000 ffffffff02620101 0000000000000000
    raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
    ffff888098bf3480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    ffff888098bf3500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    > ffff888098bf3580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    ^
    ffff888098bf3600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    ffff888098bf3680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    ==================================================================


    ---
    This bug is generated by a bot. It may contain errors.
    See https://goo.gl/tpsmEJ for more information about syzbot.
    syzbot engineers can be reached at syzkaller@googlegroups.com.

    syzbot will keep track of this bug report. See:
    https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

    \
     
     \ /
      Last update: 2019-05-06 13:17    [W:7.298 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site