Received-SPF: pass (google.com: domain of linux-kernel+bounces-12950-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Precedence: bulk
MIME-Version: 1.0
References: <PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com>
In-Reply-To: <PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com>
From: Dmitry Vyukov <dvyukov@google.com>
Date: Fri, 29 Dec 2023 07:23:13 +0100
Message-ID: <CACT4Y+YFk_7z_n2SyTGAWYBa_HRjMqNwXUO8AiDqHpDy_H2Rsg@mail.gmail.com>
Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in
 cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
To: "Yang, Chenyuan" <cy54@illinois.edu>
Cc: "linux-media@vger.kernel.org" <linux-media@vger.kernel.org>, 
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, 
	"jani.nikula@intel.com" <jani.nikula@intel.com>, 
	"hverkuil-cisco@xs4all.nl" <hverkuil-cisco@xs4all.nl>, 
	"syzkaller@googlegroups.com" <syzkaller@googlegroups.com>, "mchehab@kernel.org" <mchehab@kernel.org>, 
	"Zhao, Zijie" <zijie4@illinois.edu>, "Zhang, Lingming" <lingming@illinois.edu>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, 28 Dec 2023 at 10:58, Yang, Chenyuan <cy54@illinois.edu> wrote:
>
> Hello,
>
> We encountered 5 different crashes in the cec device by using our generat=
ed syscall specification for it, here are the descriptions of these 5 crash=
es and the related files are attached:

Hi Yang,

Nice!

Do you plan to upstream your cec descriptions to syzkaller? That would
be useful.


> 1. KASAN: slab-use-after-free Read in cec_queue_msg_fh (Reproducible)
>
> 2. WARNING: ODEBUG bug in cec_transmit_msg_fh
>
> 3. WARNING in cec_data_cancel
>
> 4. INFO: task hung in cec_claim_log_addrs (Reproducible)
>
> 5. general protection fault in cec_transmit_done_ts
>
>
>
> For =E2=80=9CKASAN: slab-use-after-free Read in cec_queue_msg_fh=E2=80=9D=
, we attached a syzkaller program to reproduce it. This crash is caused by =
` list_add_tail(&entry->list, &fh->msgs);` (https://elixir.bootlin.com/linu=
x/v6.7-rc7/source/drivers/media/cec/core/cec-adap.c#L224), which reads a va=
riable freed by `kfree(fh);` (https://elixir.bootlin.com/linux/v6.7-rc7/sou=
rce/drivers/media/cec/core/cec-api.c#L684). The reproducible program is a S=
yzkaller program, which can be executed following this document: https://gi=
thub.com/google/syzkaller/blob/master/docs/executing_syzkaller_programs.md.
>
>
>
> For =E2=80=9CWARNING: ODEBUG bug in cec_transmit_msg_fh=E2=80=9D, unfortu=
nately we failed to reproduce it but we indeed trigger this crash almost ev=
ery time when we fuzz the cec device only. We attached the report and log f=
or this bug. It tries freeing an active object by using `kfree(data);` (htt=
ps://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-ad=
ap.c#L930).
>
>
>
> For =E2=80=9CWARNING in cec_data_cancel=E2=80=9D, it is an internal warni=
ng used in cec_data_cancel (https://elixir.bootlin.com/linux/v6.7-rc7/sourc=
e/drivers/media/cec/core/cec-adap.c#L365), which checks whether the transmi=
t is the current or pending. Unfortunately, we also don't have the reproduc=
ible program for this bug, but we attach the report and log.
>
>
>
> For =E2=80=9CINFO: task hung in cec_claim_log_addrs=E2=80=9D, the kernel =
hangs when the cec device ` wait_for_completion(&adap->config_completion);`=
 (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/c=
ec-adap.c#L1579). We have a reproducible C program for this.
>
>
>
> For =E2=80=9Cgeneral protection fault in cec_transmit_done_ts=E2=80=9D, t=
he cec device tries derefencing a non-canonical address 0xdffffc00000000e0:=
 0000 [#1], which is related to the invocation ` cec_transmit_attempt_done_=
ts ` (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/co=
re/cec-adap.c#L697). It seems that the address of cec_adapter is totally wr=
ong. We do not have a reproducible program for this bug, but the log and re=
port for it are attached.
>
>
>
> If you have any questions or require more information, please feel free t=
o contact us.
>
>
>
> Best,
>
> Chenyuan
>
> --
> You received this message because you are subscribed to the Google Groups=
 "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to syzkaller+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgi=
d/syzkaller/PH7PR11MB57688E64ADE4FE82E658D86DA09EA%40PH7PR11MB5768.namprd11=
.prod.outlook.com.