From patchwork Tue Jan 12 04:55:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Zhang, Qiang" X-Patchwork-Id: 361613 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.6 required=3.0 tests=BAYES_00, CHARSET_FARAWAY_HEADER, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03E4FC433DB for ; Tue, 12 Jan 2021 04:57:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BFCC222D2B for ; Tue, 12 Jan 2021 04:57:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731877AbhALE5N (ORCPT ); Mon, 11 Jan 2021 23:57:13 -0500 Received: from mail-dm6nam11on2042.outbound.protection.outlook.com ([40.107.223.42]:4001 "EHLO NAM11-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728910AbhALE5M (ORCPT ); Mon, 11 Jan 2021 23:57:12 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XVI6bc+8olBddzzpRYbc1GZPernzLr6r99DJAwemA/rDzvADAuioveOmZoRLCs7FvLsUQzQWBlZfe6Ivy6r3nuoRhtrupx4y2clx4UArJ7TFLMvQxJ/zki6oJkuPEe4csUeqowhbL+kft84S8fLn4ZEtttPtrt6D+nXTdXjDnll/KibSElSPXiL3xg+swNDxN02VfmJ6BWpbePhL/tVd8o6vIfYI5OBaR5ZygsLIeuc9gBfPljMDHACf/pu2NQ+Uy3c2PUhGKuxjZ25pcAOSsHjN5acCYOZS5Fo0b5wHpPKuiHUXbZiUQxo3rZ7oWTU6gqoK+wQFfsWSwjQVr03JYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eZgnS66YdR1rkBzVw3yeIOYdtSnTVSqDJg4UmVqmaY4=; b=Avzq0mt8S/gN9QJFfx0UdCbcp+ZoabnDULDSz4fL5L1PTUFpWUakeqBcd1HLFb/gNmltiZUO8SuAA/oLG808MZs69edV0FjyqhuBPdhSKz6+/yeHJwcB3WZR6cwI8JF6F9mRPBmRiYLPUkiK4MSWLOR0sa5u9dVPVL3lVXs68pQ94INvr4InZ0R7bySAnsKQzDse3vjjsh07DFhwWpEu+QDeEm+a+gjnR8JF/zXyXYHde1xEBGRwmcCqAOtdjsXdv3A5eeByvOSq78kLxtzzVIfhopZX1XajK7j9v1H1dFgqjbQh0TF6FpnM0+UbJxJ+8KpTxnH5p6L0YipZrxc9HA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriversystems.onmicrosoft.com; s=selector2-windriversystems-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eZgnS66YdR1rkBzVw3yeIOYdtSnTVSqDJg4UmVqmaY4=; b=cz+9BF3rL/n1XalN8OG67ONH7eYnIvsivh68tvqeJNJT0EwNZtJGclS+a7m0gSCJV1Um8WNoMvrs/Tbppz+TTkj5G7lHUCtaPKWIssaQc/XVqHFbgVBa05MVBhhTjeLYPSFj3bjx4p1yxfaGlS+5EEMVAusaiB05geAyflMSrAY= Received: from BYAPR11MB2632.namprd11.prod.outlook.com (2603:10b6:a02:c4::17) by BY5PR11MB4242.namprd11.prod.outlook.com (2603:10b6:a03:1c1::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3742.6; Tue, 12 Jan 2021 04:55:55 +0000 Received: from BYAPR11MB2632.namprd11.prod.outlook.com ([fe80::94a4:4e15:ab64:5006]) by BYAPR11MB2632.namprd11.prod.outlook.com ([fe80::94a4:4e15:ab64:5006%5]) with mapi id 15.20.3742.012; Tue, 12 Jan 2021 04:55:55 +0000 From: "Zhang, Qiang" To: syzbot , "a.darwish@linutronix.de" , "allen.lkml@gmail.com" , "andreyknvl@google.com" , "dvyukov@google.com" , "elver@google.com" , "gregkh@linuxfoundation.org" , "gustavoars@kernel.org" , "linux-kernel@vger.kernel.org" , "linux-usb@vger.kernel.org" , "syzkaller-bugs@googlegroups.com" , "tglx@linutronix.de" Subject: =?gb2312?b?u9i4tDogS0FTQU46IHVzZS1hZnRlci1mcmVlIFJlYWQgaW4gdXNi?= =?gb2312?b?X2FuY2hvcl9yZXN1bWVfd2FrZXVwcyAoMik=?= Thread-Topic: KASAN: use-after-free Read in usb_anchor_resume_wakeups (2) Thread-Index: AQHW6DTOANg5ojbivkuHK2yBWpzQ5qojUtdngAAYPrU= Date: Tue, 12 Jan 2021 04:55:55 +0000 Message-ID: References: <00000000000078b53f05b8a2286b@google.com>, In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: syzkaller.appspotmail.com; dkim=none (message not signed) header.d=none; syzkaller.appspotmail.com; dmarc=none action=none header.from=windriver.com; x-originating-ip: [60.247.85.82] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d2e6000b-dbb2-4ccc-88a3-08d8b6b6587b x-ms-traffictypediagnostic: BY5PR11MB4242: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fQuX7jTzp7ftmWDve3EE6Y8S014L7/lpCLFrkWlo7gvBgkEibonFhvOlhZmfZOTg8rDKYkxZalBD39lTqwPis/OGjbQDhMjPqcWwi6/2RVafw7vBrOeV+kt0WPa3wJAKoGsgOQjY4yLOsDi2HRP8aJogZl4HAfyPnP1WN8PxzRFBEArc9vtsw4d5S4OHNp8IWGJKp3J5csS3rFREB8+z5iuyIVo5GrhO/zmsH9vWFDr1aENI1FiIp788z+O84RkB0yPf+u+BDxUyame9+ZE6p0KjGJTSm4RU/g+shbwFX+1p+ZscXl7QLM93CqDhoK1urjfixLwNcxevKXxToCrg/CPjIoUShgi8d3MnLjG4WCMKU7ckIkMVhOUx2TeZMnxKJU2ucfi8lDbRrBQtoIGpkZcgH1Qp3zmtT+oFVKSbfnspdmVgpLR8+LS6ZZ0aqeJL4z9F46kbgs4Eme+1h+Mg6EJXp6c51saiu2t7ooCblVY5RJ8Z/qEwe3aZFHghgB/8XS30DG16HfGVJPDywKOYJ3ycY9rztDxc68e1kwwpz0A= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB2632.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(376002)(136003)(346002)(396003)(39850400004)(33656002)(2940100002)(316002)(86362001)(6506007)(966005)(186003)(26005)(8936002)(30864003)(921005)(66446008)(66556008)(5660300002)(2906002)(478600001)(91956017)(83380400001)(64756008)(76116006)(71200400001)(110136005)(7416002)(55016002)(66476007)(66946007)(7696005)(52536014)(9686003)(224303003)(99710200001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?gb2312?b?Y2R3eXh1T3ZaZTBFd3dDYnBi?= =?gb2312?b?QzV2bVY4N2dXeFdYd1kzQ29Ib3dLc2JBTXk4SHdPdlkxN2xTcmt3?= =?gb2312?b?c0VndFNqZWFrOFFuU0QybkgyWjZYUnkrUHpQcnpIVHlOTnJ6SnEw?= =?gb2312?b?dG5pbVUrSk5pcVZxZGtHN0kwZ3FWb2FwMFBCVll0cGtsdFh4SEhT?= =?gb2312?b?b2FlTFkwMDZWQ1d0NG9NcUp0b2M0NS9KejRrNzlDcE9pZGVQS25O?= =?gb2312?b?Zzg1NFhJMms1cG1oLzhJNks2b2NUbFFqdEpoWWR4Z0d2ZWNSYWJy?= =?gb2312?b?VURmL0F1WHRvcG5HMENrRnRsR3BJK2k0SHZRQXYvUDQwaVdGQjZO?= =?gb2312?b?VGhkNVhqam5rcGc4c0lyeXJVMWErRTlKTnZ1dHlsVVNQRkc2dk1I?= =?gb2312?b?QkREL0xkdHIveldCa01scEdyR2RDT1h1ZVBrQVprVGtVN0xtQ2tr?= =?gb2312?b?WW41U0JIaExrRlNWL2x0blI1YVF2SjNIQkhJVWdzTXUxQ3duaW9D?= =?gb2312?b?Ly93UDg1b2ltVDhGSk15RU1pTWJzSTBZZjFXMHFFMWJRTE04YVp2?= =?gb2312?b?dHArbmJaN2JKWUFWVXQ1VFlzcDZpeWdveGs4RGdveFdqU3RwNkxJ?= =?gb2312?b?Sm56T1d2YlkzOUh1V0VYUnU0UFJPZWpnU28rc0l5eDBJNVpKRVA3?= =?gb2312?b?SFIxTW11ZXFWZlhTUDVRODVITEE5Qlk2djNJdlFvYzl4OWJtNWY0?= =?gb2312?b?Zkd1NTBRZFQvbms3U0g4S240Tklwb3JreTd1N0psbzd4blp4Q3Ax?= =?gb2312?b?bkhMaWpQaVVTOHpxdmN6TnVXV2dDR1g0cU11cnMvRkxjc2YyVHkv?= =?gb2312?b?UWZaRGxTTVR1SWFqcXF3SUR2TUlGeS81MzFuczN1MkxId1RRNFJu?= =?gb2312?b?SHRJaEI0bjI3cGJzY2VicjE1Q3lwRXRTS1h5cEg1dlZyNHNKUmY3?= =?gb2312?b?R3BWamZSaEsxbG1IV1FFWXZYaTZNSjZqc3Z5NmdtUGhTNlBKaXZi?= =?gb2312?b?ZmJkYlV6ZEpUTGNncEVhSkxnREt1K0pSMGQ2UUlQMkZodUpGVExX?= =?gb2312?b?dnEvbVkyd21rWDRXdUovRHUySzBEOG9iU1dSc0hSVFhSR0NpbVhM?= =?gb2312?b?U0NPd1dDbUs0MWdsdGZyejdBZHpmSFJXQllkd1loQnZQZXdnNXU2?= =?gb2312?b?UHZmVVd3RmNacytiTHMrZjE3S3N2aHdPQm9uUlBlbmpjZkNQWFRS?= =?gb2312?b?UDNIeVltQmliY0xna2ZDd0JqUnFobzBxRHpJMXh5QVlWMCtSV2Fk?= =?gb2312?b?TnpLNy9PNHF6VU9xVzlqRWY0R1dwa3JiaGpvN1MzVUhZZWF6aVNJ?= =?gb2312?b?WDN5dlJkNUxHWFR2ajY2QWZhYTFGd21nT2FRRUxtdVVHdHhVNU8w?= =?gb2312?b?OXYzQnVDU2hCRT0=?= x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB2632.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: d2e6000b-dbb2-4ccc-88a3-08d8b6b6587b X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jan 2021 04:55:55.6439 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: EKriY4hTrRxOZ9XPMRfm26xV02zGZoIRGt7Dc0QzxouIv7We4T3do+erJAseAo2PEdT23TwOuX7to5ccNe3xrOS01zfE5N0v0wQdEd5O6nw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4242 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org ================================================================== BUG: KASAN: use-after-free in register_lock_class+0xecc/0x1100 kernel/locking/lockdep.c:1291 Read of size 2 at addr ffff888137488092 by task systemd-udevd/7474 CPU: 1 PID: 7474 Comm: systemd-udevd Not tainted 5.11.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:230 __kasan_report mm/kasan/report.c:396 [inline] kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413 register_lock_class+0xecc/0x1100 kernel/locking/lockdep.c:1291 __lock_acquire+0x101/0x54f0 kernel/locking/lockdep.c:4711 lock_acquire kernel/locking/lockdep.c:5437 [inline] lock_acquire+0x288/0x700 kernel/locking/lockdep.c:5402 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x36/0x50 kernel/locking/spinlock.c:159 __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137 usb_anchor_resume_wakeups drivers/usb/core/urb.c:937 [inline] usb_anchor_resume_wakeups+0xbe/0xe0 drivers/usb/core/urb.c:930 __usb_hcd_giveback_urb+0x2df/0x5c0 drivers/usb/core/hcd.c:1661 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1728 dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971 call_timer_fn+0x1a5/0x630 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x67c/0xa10 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0x80/0x120 kernel/time/timer.c:1744 __do_softirq+0x1b7/0x977 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu kernel/softirq.c:420 [inline] irq_exit_rcu+0x110/0x1a0 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:197 Code: 81 e1 00 01 00 00 65 48 8b 14 25 40 ef 01 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 dc 13 00 00 85 c0 74 2b 8b 82 b8 13 00 00 <83> f8 02 75 20 48 8b 8a c0 13 00 00 8b 92 bc 13 00 00 48 8b 01 48 RSP: 0018:ffffc90005f875b0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff888116d85040 RSI: ffffffff81dabe81 RDI: 0000000000000003 RBP: ffff888102c2bf00 R08: 0000000000000000 R09: 0000000000000003 R10: ffffffff81dabeba R11: 0000000000000010 R12: 0000000000000002 R13: 00000000000001cc R14: dffffc0000000000 R15: 0000000000000000 tomoyo_domain_quota_is_ok+0x2f1/0x550 security/tomoyo/util.c:1093 tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x33e/0x380 security/tomoyo/file.c:777 tomoyo_file_open security/tomoyo/tomoyo.c:313 [inline] tomoyo_file_open+0xa3/0xd0 security/tomoyo/tomoyo.c:308 security_file_open+0x52/0x4f0 security/security.c:1576 do_dentry_open+0x353/0x1090 fs/open.c:804 do_open fs/namei.c:3254 [inline] path_openat+0x1b9a/0x2730 fs/namei.c:3371 do_filp_open+0x17e/0x3c0 fs/namei.c:3398 do_sys_openat2+0x16d/0x420 fs/open.c:1172 do_sys_open fs/open.c:1188 [inline] __do_sys_open fs/open.c:1196 [inline] __se_sys_open fs/open.c:1192 [inline] __x64_sys_open+0x119/0x1c0 fs/open.c:1192 do_syscall_64+0x2d/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f97523546f0 Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 19 30 2c 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe 9d 01 00 48 89 04 24 RSP: 002b:00007ffda8db42a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000560343083730 RCX: 00007f97523546f0 RDX: 00000000000001b6 RSI: 0000000000080000 RDI: 00007ffda8db4450 RBP: 0000000000000008 R08: 0000000000000008 R09: 0000000000000001 R10: 0000000000080000 R11: 0000000000000246 R12: 000056034175268a R13: 0000000000000001 R14: 000056034308c587 R15: 00007ffda8db44c0 >Hi > >When usb's device disconnect, we call usb_wait_anchor_empty_timeout , >if timeout , will kill urb, however，if not timeout, we also need to kill urb. >I didn't test the patch, you can test it. > >diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c >index 0687f0ed60b8..4233686d458d 100644 >--- a/drivers/input/joystick/xpad.c >+++ b/drivers/input/joystick/xpad.c >@@ -1130,7 +1130,8 @@ static void xpad_stop_output(struct usb_xpad *xpad) > dev_warn(&xpad->intf->dev, > "timed out waiting for output URB to complete, killing\n"); > usb_kill_anchored_urbs(&xpad->irq_out_anchor); >- } >+ } else >+ usb_kill_urb(xpad->irq_out); > } > } Hi syzbot Sorry, please ignore the previous modification suggestions. When usb's device disconnect, we call usb_wait_anchor_empty_timeout , if timeout , will kill urb, however,whether there is a timeout or not, we will need to kill urb. diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c index 0687f0ed60b8..c0d8d4b9138b 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -1131,6 +1131,7 @@ static void xpad_stop_output(struct usb_xpad *xpad) "timed out waiting for output URB to complete, killing\n"); usb_kill_anchored_urbs(&xpad->irq_out_anchor); } + usb_kill_urb(xpad->irq_out); } }