From patchwork Tue Jan 12 03:28:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Zhang, Qiang" X-Patchwork-Id: 361614 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.6 required=3.0 tests=BAYES_00, CHARSET_FARAWAY_HEADER, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07844C433E0 for ; Tue, 12 Jan 2021 03:29:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BCD3022D6E for ; Tue, 12 Jan 2021 03:29:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727036AbhALD3H (ORCPT ); Mon, 11 Jan 2021 22:29:07 -0500 Received: from mail-eopbgr690051.outbound.protection.outlook.com ([40.107.69.51]:13358 "EHLO NAM04-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726843AbhALD3G (ORCPT ); Mon, 11 Jan 2021 22:29:06 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E48Lj7uiRUp+PujFIym77EqKlbyoN9A3xw50AJQouxNll3Wg9ZE4/KaPQayTbe7WmC86aquXOQPbL6InutZnBsp6W83U1XgAWrOcw4otcW0lo8EzbLJmJodOJefC3TQYIHt3x+aeWAe9aM9pPu1mKdWTKR5+wVhhs66Q3zhBdfTeAn+hxzqkkAMB1Xl5wN9EW99chq1RJ+ZKv6CPV5RMkOPOmZtTi668YZHxxHD1fosgEPt+v6K8WcihXn9Z4YhHoCjWWuKt6s3PTB9p+7cAnz3+q7uPjUPwz8G5x/Etwjb2I+qYkkmSILq7YSrJak14u8byFrA3edAh9qXqLVXhrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RJVXtk8rPuLkZj0pguorZSYtXb7JVceIzYmZIhPiUho=; b=jK0Vrle+10ViPh5f4VQBr5eBDl6I6712mK7vNmCeYTlZpkzlBN2HBqO/nFuhnhfvVkiLZxKZMY+LUxpKefLmL2uNvp3qtuE3CozOoJowJia885ANH0M118dP10xEd73cyBBLWc1IILiSNjajUE43glDTdFiYTPAWxHv5zbkxoj51m8xbOJ2JSKTMaeonTeQIC01wfibphZgevKLYsVrgob90Puc7T7NQy7fjgaC9ABtMN/MFhYQhhpEI/sKj8ZK8Hrwc+mTzKzTHdZHtsxWMQjgdtehhOMphjxxiDPJ5vlyqTexd7BpsZm5K2jxwYBGuvnweKnO0Ht5RC1fRueTIIQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriversystems.onmicrosoft.com; s=selector2-windriversystems-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RJVXtk8rPuLkZj0pguorZSYtXb7JVceIzYmZIhPiUho=; b=p/O93FW8vTIbbeWT86zhRxtaZ5mZmobJzSzX6tZDRNhH2yaClGK3p1ttXn41QCxKfDEPjsar+Wn4liOU+3K0O/HzhzmBotPiN5i4bMddEfF2+u2WcO+x10nzKg9Z8Q01N4EgyCKTs/PaSMitlPje0p2C1HA4TxaxTJJoqhBqTC4= Received: from BYAPR11MB2632.namprd11.prod.outlook.com (2603:10b6:a02:c4::17) by BYAPR11MB3767.namprd11.prod.outlook.com (2603:10b6:a03:fd::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3742.6; Tue, 12 Jan 2021 03:28:21 +0000 Received: from BYAPR11MB2632.namprd11.prod.outlook.com ([fe80::94a4:4e15:ab64:5006]) by BYAPR11MB2632.namprd11.prod.outlook.com ([fe80::94a4:4e15:ab64:5006%5]) with mapi id 15.20.3742.012; Tue, 12 Jan 2021 03:28:21 +0000 From: "Zhang, Qiang" To: syzbot , "a.darwish@linutronix.de" , "allen.lkml@gmail.com" , "andreyknvl@google.com" , "dvyukov@google.com" , "elver@google.com" , "gregkh@linuxfoundation.org" , "gustavoars@kernel.org" , "linux-kernel@vger.kernel.org" , "linux-usb@vger.kernel.org" , "syzkaller-bugs@googlegroups.com" , "tglx@linutronix.de" Subject: =?gb2312?b?u9i4tDogS0FTQU46IHVzZS1hZnRlci1mcmVlIFJlYWQgaW4gdXNi?= =?gb2312?b?X2FuY2hvcl9yZXN1bWVfd2FrZXVwcyAoMik=?= Thread-Topic: KASAN: use-after-free Read in usb_anchor_resume_wakeups (2) Thread-Index: AQHW6DTOANg5ojbivkuHK2yBWpzQ5qojUtdn Date: Tue, 12 Jan 2021 03:28:21 +0000 Message-ID: References: <00000000000078b53f05b8a2286b@google.com> In-Reply-To: <00000000000078b53f05b8a2286b@google.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: syzkaller.appspotmail.com; dkim=none (message not signed) header.d=none; syzkaller.appspotmail.com; dmarc=none action=none header.from=windriver.com; x-originating-ip: [60.247.85.82] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 522f4661-6294-4175-da77-08d8b6aa1c97 x-ms-traffictypediagnostic: BYAPR11MB3767: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 9XNLFdowqQk1OongpawbpiGxSaRjqC/N1SYGz6aUhRIDr4NdBY8gja5F7mkkN6FuXem9hx8qwNCWeT4SAtBQniVjV6kZXYsFdaF9CIsfmIktCw7VAmbhH2jxXed9iwjd0qq2U+oLseYfs8exp1jtntKfKj1/hLz6c2dELpfdis1kIws0xLnDCeabkfw90Is8KbzBqFJeEK/ItfCj1GFtLC0K0GFqh+XqdfAfu+WTjTl6ZTc2UxsQZrmgtYAqpGQBq0YPPRdOWUNojtE7rsUW9c8hNNNm43h15CTGTBYvcd7Y2Wja1dOBODI6IwP/eFrEroTdFcBVOiLrdoTZ5d3TwheQ82VB60lT05cZNPuG5CZqU/jOokTt6zVGFkqXHPDRf6Jhwifa7gpSSRrgvQv77489m9znOR8FyabM9InrSSbeq7fko0hSTFe0MCfispp1edo+NHjuNtX+GjyrPnvfJH1pSX58G02RytWm96WIZHV61jC9fUiMzG8sqRQ1vnFaNFVWoETZzHXAH+nDRuuprxBZRI0DHUlXdVlo933P3gA= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB2632.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(346002)(396003)(39850400004)(136003)(366004)(110136005)(86362001)(186003)(5660300002)(83380400001)(6506007)(71200400001)(224303003)(478600001)(316002)(966005)(76116006)(26005)(55016002)(7696005)(66946007)(2906002)(66556008)(91956017)(52536014)(66446008)(921005)(8936002)(30864003)(9686003)(64756008)(33656002)(7416002)(66476007)(99710200001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?gb2312?b?UGp5SUh4VTdlYlcrVlgxMDlv?= =?gb2312?b?RDJWNXZKdjYydGdNY1Z6Yi8wSWtRZFBXbFh5cUJpZmt0VWZjQ2pl?= =?gb2312?b?ZWVxNGVZNVJUR3lNRGtnWXVqSnJKNUVhMzRsZGhMK0xYUnpLUDJh?= =?gb2312?b?NDdseVc5NmMyVVRwQk5pTjdlM1pmWGRFREpwTHBaVU9yQW84YzRH?= =?gb2312?b?S2FzSzZqYXhMUFE3UzZCVktHT0twcFlGbGE1UzFSbkNUT1daQ1hy?= =?gb2312?b?b2N6V05kWTNtRHNzYVZNekRjQ3ZtVnpKbFhrcEdic3hCUEFCdk5S?= =?gb2312?b?c0x0ZVdtUWYzZHlOczFZU0YwN3hTV3JnTm8xYzlWeGJxR2pRWnJ3?= =?gb2312?b?QnFHUlBhK2U5VHdvUlF6ejA4OHkzb1VPVFRXenpBUU5tUzl2eEFq?= =?gb2312?b?Q1d1MGtpS09nR1NmdzVFVXVqQXJsd2J4b3lHbXdFQnRjUE0rOUZM?= =?gb2312?b?TXRqWTIrRjU0TzlWaVFFNi8xSVZHVVE0UHRON1l5MkYrMU1JV1dI?= =?gb2312?b?bmVWYWdLa1RQUm54SnFTbG9lcVNNeWtVSFZHYkdyd0VRQUNuR2Vv?= =?gb2312?b?all2UzdrZDZOblJqSDVhVE84VC9jSytDMHN3MHhnUmFJZzlrTndj?= =?gb2312?b?ejUxRUhkQis0MHdxdzV3b09XZkNFbXdLaE4zNU1FNDVJVXlvRUxo?= =?gb2312?b?N0dWTjJoV0MveCs0VGdGSnhKOWFIbFc5OEVEaEtqdU02Y3VMaENt?= =?gb2312?b?U291eEZrSWlqTCtSeXdESE9TK1kvTjl0Y3ZqUUVUby9TU0pndTVx?= =?gb2312?b?NmRTb2lTTldKWW5CS3dlVTNHTVppRXZZbTFRNHk5dzFzMFFKLzZU?= =?gb2312?b?eTZ0SFBPN2VwbEhkeG1jc3hCUTFLQ2Uxbndvc0tyU2dzc1VWdXhw?= =?gb2312?b?ZE9ObW9kT2xOTmlRY3FHaDhjWU9OVHZjbHMxNWQ2clBQSlZyTUFn?= =?gb2312?b?ZFVSY2EzbjRJRFcxZUd0VUc0Nld4UTRIanl0cHhLNGptWmJzUzRt?= =?gb2312?b?eFE5ZW8yMjlGZjg5MkVwNzZOaUpVcWxCRkZoN09WbjFWUm05dXBm?= =?gb2312?b?cDdyamJBYWFPaDFzR0tuTDlrbTl3eWZEb0FuejVmZHgxVGNKejhr?= =?gb2312?b?dG5rdlpia24zSmgxelZidFNHaGdmM0ovM2I2elJTazBaclNTeFRJ?= =?gb2312?b?dzRUY2VKMUp2VTcvelczaVVkZnBOOUZCallHNkFPa3NLdjhFM3ZT?= =?gb2312?b?Z3A5RXVLVHFoVjc3dTE0T09GNkpHWHA4S3VuZEN6WXVuOG44bk1N?= =?gb2312?b?VUZyUjRua2tiT3lKRXBpV0s4MlVtUWlLeEQ5dXhEYUhwbnZxQ2Yr?= =?gb2312?b?Qk1qbUtLVWtTakVZZUs2UHp6WGU1bHdrL0xWMDBDWEdTYXZ1MlUz?= =?gb2312?b?dnpPdmJvZlNwTT0=?= x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR11MB2632.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 522f4661-6294-4175-da77-08d8b6aa1c97 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jan 2021 03:28:21.2355 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: PU/IDdo3GdIezsKFZNOD6Z9kKj2xvSAGoJbh9CMaGHQP6uMLkzbUCqfxc3EBKww8YJFYaF8XoqClhC8pCUK5kURRIdJAKp6ruvMMU4kokSU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR11MB3767 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org ================================================================== BUG: KASAN: use-after-free in register_lock_class+0xecc/0x1100 kernel/locking/lockdep.c:1291 Read of size 2 at addr ffff888137488092 by task systemd-udevd/7474 CPU: 1 PID: 7474 Comm: systemd-udevd Not tainted 5.11.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:230 __kasan_report mm/kasan/report.c:396 [inline] kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413 register_lock_class+0xecc/0x1100 kernel/locking/lockdep.c:1291 __lock_acquire+0x101/0x54f0 kernel/locking/lockdep.c:4711 lock_acquire kernel/locking/lockdep.c:5437 [inline] lock_acquire+0x288/0x700 kernel/locking/lockdep.c:5402 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x36/0x50 kernel/locking/spinlock.c:159 __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:137 usb_anchor_resume_wakeups drivers/usb/core/urb.c:937 [inline] usb_anchor_resume_wakeups+0xbe/0xe0 drivers/usb/core/urb.c:930 __usb_hcd_giveback_urb+0x2df/0x5c0 drivers/usb/core/hcd.c:1661 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1728 dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971 call_timer_fn+0x1a5/0x630 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x67c/0xa10 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0x80/0x120 kernel/time/timer.c:1744 __do_softirq+0x1b7/0x977 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu kernel/softirq.c:420 [inline] irq_exit_rcu+0x110/0x1a0 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:197 Code: 81 e1 00 01 00 00 65 48 8b 14 25 40 ef 01 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 dc 13 00 00 85 c0 74 2b 8b 82 b8 13 00 00 <83> f8 02 75 20 48 8b 8a c0 13 00 00 8b 92 bc 13 00 00 48 8b 01 48 RSP: 0018:ffffc90005f875b0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff888116d85040 RSI: ffffffff81dabe81 RDI: 0000000000000003 RBP: ffff888102c2bf00 R08: 0000000000000000 R09: 0000000000000003 R10: ffffffff81dabeba R11: 0000000000000010 R12: 0000000000000002 R13: 00000000000001cc R14: dffffc0000000000 R15: 0000000000000000 tomoyo_domain_quota_is_ok+0x2f1/0x550 security/tomoyo/util.c:1093 tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x33e/0x380 security/tomoyo/file.c:777 tomoyo_file_open security/tomoyo/tomoyo.c:313 [inline] tomoyo_file_open+0xa3/0xd0 security/tomoyo/tomoyo.c:308 security_file_open+0x52/0x4f0 security/security.c:1576 do_dentry_open+0x353/0x1090 fs/open.c:804 do_open fs/namei.c:3254 [inline] path_openat+0x1b9a/0x2730 fs/namei.c:3371 do_filp_open+0x17e/0x3c0 fs/namei.c:3398 do_sys_openat2+0x16d/0x420 fs/open.c:1172 do_sys_open fs/open.c:1188 [inline] __do_sys_open fs/open.c:1196 [inline] __se_sys_open fs/open.c:1192 [inline] __x64_sys_open+0x119/0x1c0 fs/open.c:1192 do_syscall_64+0x2d/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f97523546f0 Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 19 30 2c 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe 9d 01 00 48 89 04 24 RSP: 002b:00007ffda8db42a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000560343083730 RCX: 00007f97523546f0 RDX: 00000000000001b6 RSI: 0000000000080000 RDI: 00007ffda8db4450 RBP: 0000000000000008 R08: 0000000000000008 R09: 0000000000000001 R10: 0000000000080000 R11: 0000000000000246 R12: 000056034175268a R13: 0000000000000001 R14: 000056034308c587 R15: 00007ffda8db44c0 Hi When usb's device disconnect, we call usb_wait_anchor_empty_timeout , if timeout , will kill urb, however，if not timeout, we also need to kill urb. I didn't test the patch, you can test it. diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c index 0687f0ed60b8..4233686d458d 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -1130,7 +1130,8 @@ static void xpad_stop_output(struct usb_xpad *xpad) dev_warn(&xpad->intf->dev, "timed out waiting for output URB to complete, killing\n"); usb_kill_anchored_urbs(&xpad->irq_out_anchor); - } + } else + usb_kill_urb(xpad->irq_out); } }