Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
From:   Kyungtae Kim <kt0755@gmail.com>
Date:   Sun, 21 Jun 2020 14:06:38 -0400
Message-ID: <CAEAjamtFJJaj=Xn9Jb2T3wPm3eVb=SUFMnhFCCd3zULNy_FBUw@mail.gmail.com>
Subject: KASAN: use-after-free Read in gs_flush_chars
To:     Felipe Balbi <balbi@kernel.org>,
        Greg KH <gregkh@linuxfoundation.org>,
        =?UTF-8?B?TWljaGHFgiBNaXJvc8WCYXc=?= <mirq-linux@rere.qmqm.pl>,
        Sergey Organov <sorganov@gmail.com>,
        Fabrice Gasnier <fabrice.gasnier@st.com>
Cc:     USB list <linux-usb@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller <syzkaller@googlegroups.com>,
        Dave Tian <dave.jing.tian@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

We report a bug (in linux-5.7) found by FuzzUSB (a modified version
of syzkaller)

The bug happened when accessing a deallocated instance of gs_port.
While spinning a lock in gs_flush_chars(),
port is allowed to be freed in gser_free_inst().
This ends up tringgering an memory error.

To fix this, it needs to check if port is is still in use, in particular,
lock spinning, when deallocating it.

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x44f1/0x4aa0
kernel/locking/lockdep.c:4225
Read of size 8 at addr ffff88803bf5d398 by task syz-executor.7/3903

CPU: 3 PID: 3903 Comm: syz-executor.7 Not tainted 5.7.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xce/0x128 lib/dump_stack.c:118
 print_address_description.constprop.6+0x1f/0x410 mm/kasan/report.c:382
 __kasan_report+0x106/0x140 mm/kasan/report.c:511
 kasan_report+0x38/0x50 mm/kasan/common.c:625
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:146
 __lock_acquire+0x44f1/0x4aa0 kernel/locking/lockdep.c:4225
 lock_acquire+0x18d/0xbe0 kernel/locking/lockdep.c:4934
 __raw_spin_lock_irqsave ./include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159
 gs_flush_chars+0x45/0xb0 drivers/usb/gadget/function/u_serial.c:764
 n_tty_write+0x685/0xe70 drivers/tty/n_tty.c:2350
 do_tty_write drivers/tty/tty_io.c:962 [inline]
 tty_write+0x462/0x970 drivers/tty/tty_io.c:1046
 __vfs_write+0x85/0x110 fs/read_write.c:495
 vfs_write+0x1d3/0x520 fs/read_write.c:559
 ksys_write+0x190/0x220 fs/read_write.c:612
 __do_sys_write fs/read_write.c:624 [inline]
 __se_sys_write fs/read_write.c:621 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:621
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x453769
Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7f29106c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000453769
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004c0ed1
R13: 00000000004d8fa0 R14: 00007f7f291076d4 R15: 00000000ffffffff

Allocated by task 2445:
 save_stack+0x21/0x50 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:495
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:509
 kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2824
 kmalloc ./include/linux/slab.h:555 [inline]
 kzalloc ./include/linux/slab.h:669 [inline]
 gs_port_alloc drivers/usb/gadget/function/u_serial.c:1142 [inline]
 gserial_alloc_line_no_console+0xdc/0x920
drivers/usb/gadget/function/u_serial.c:1222
 gserial_alloc_line+0x17/0x70 drivers/usb/gadget/function/u_serial.c:1256
 gser_alloc_inst+0x8d/0xf0 drivers/usb/gadget/function/f_serial.c:327
 try_get_usb_function_instance+0xf8/0x1c0 drivers/usb/gadget/functions.c:28
 usb_get_function_instance+0x17/0x80 drivers/usb/gadget/functions.c:44
 function_make+0xfa/0x3c0 drivers/usb/gadget/configfs.c:600
 configfs_mkdir+0x458/0xaf0 fs/configfs/dir.c:1344
 vfs_mkdir+0x3aa/0x670 fs/namei.c:3625
 do_mkdirat+0x12b/0x220 fs/namei.c:3648
 __do_sys_mkdir fs/namei.c:3664 [inline]
 __se_sys_mkdir fs/namei.c:3662 [inline]
 __x64_sys_mkdir+0x5c/0x80 fs/namei.c:3662
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

Freed by task 3905:
 save_stack+0x21/0x50 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0x135/0x190 mm/kasan/common.c:456
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:465
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1488 [inline]
 slab_free mm/slub.c:3045 [inline]
 kfree+0xf7/0x410 mm/slub.c:4026
 gserial_free_port+0x124/0x250 drivers/usb/gadget/function/u_serial.c:1186
 gserial_free_line+0x12b/0x270 drivers/usb/gadget/function/u_serial.c:1203
 gser_free_inst+0x3d/0x50 drivers/usb/gadget/function/f_serial.c:313
 usb_put_function_instance+0x86/0xb0 drivers/usb/gadget/functions.c:77
 serial_attr_release+0x15/0x20 drivers/usb/gadget/function/f_serial.c:262
 config_item_cleanup fs/configfs/item.c:130 [inline]
 config_item_release fs/configfs/item.c:139 [inline]
 kref_put ./include/linux/kref.h:65 [inline]
 config_item_put.part.0+0x191/0x250 fs/configfs/item.c:151
 config_item_put+0x1f/0x30 fs/configfs/item.c:150
 configfs_rmdir+0x58e/0x870 fs/configfs/dir.c:1555
 vfs_rmdir+0x168/0x490 fs/namei.c:3688
 do_rmdir+0x2f2/0x3a0 fs/namei.c:3750
 __do_sys_rmdir fs/namei.c:3768 [inline]
 __se_sys_rmdir fs/namei.c:3766 [inline]
 __x64_sys_rmdir+0x36/0x40 fs/namei.c:3766
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

The buggy address belongs to the object at ffff88803bf5d000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 920 bytes inside of
 2048-byte region [ffff88803bf5d000, ffff88803bf5d800)
The buggy address belongs to the page:
page:ffffea0000efd600 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 head:ffffea0000efd600 order:3 compound_mapcount:0
compound_pincount:0
flags: 0x100000000010200(slab|head)
raw: 0100000000010200 0000000000000000 0000000100000001 ffff88806c00e080
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88803bf5d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88803bf5d300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88803bf5d380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff88803bf5d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88803bf5d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================