Re: [syzbot] general protection fault in hidraw_release

"On Thu, 3 Feb 2022 at 09:43, Hillf Danton [off-list ref] wrote:

On Thu, 3 Feb 2022 07:09:52 +0100 Dmitry Vyukov wrote:

quoted

On Thu, 3 Feb 2022 at 05:02, Hillf Danton [off-list ref] wrote:

quoted

On Tue, 01 Feb 2022 23:19:25 -0800

quoted

syzbot has found a reproducer for the following issue on:

HEAD commit:    9f7fb8de5d9b Merge tag 'spi-fix-v5.17-rc2' of git://git.ke..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1653b6cbb00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3e56c9b92aaaee24
dashboard link: https://syzkaller.appspot.com/bug?extid=953a33deaf38c66a915e
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15fff530700000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=106469f0700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+953a33deaf38c66a915e@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0xf0 lib/list_debug.c:51
Read of size 8 at addr ffff8880143e8eb0 by task syz-executor753/4862

CPU: 0 PID: 4862 Comm: syz-executor753 Not tainted 5.17.0-rc2-syzkaller-00039-g9f7fb8de5d9b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
 __list_del_entry_valid+0xe0/0xf0 lib/list_debug.c:51
 __list_del_entry include/linux/list.h:134 [inline]
 list_del include/linux/list.h:148 [inline]

What is difficult to follow is syzbot instead did not complain at the spin_lock
prior to list_del in regard to uaf.

Any light on the difficulty is welcome.

Hi Hillf,

Hi Dmitry

Thanks for taking a look at it.

quoted

If you mean these lock/unlock:

Yes I did.

quoted

spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
list_del(&list->node);
spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);

They seem to operate on a global hidraw_table locks.
I would assume only this file is corrupted/bad, but the global lock
table is fine.

0/ in  hidraw_connect()

        dev = kzalloc(sizeof(struct hidraw), GFP_KERNEL);
        ...
        spin_lock_init(&dev->list_lock);
        dev->minor = minor;

1/ in hidraw_open()

        down_read(&minors_rwsem);
        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                err = -ENODEV;
                goto out_unlock;
        }

        dev = hidraw_table[minor];
        ...
        spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
        list_add_tail(&list->node, &hidraw_table[minor]->list);
        spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);

3/ in drop_ref()

        hidraw_table[hidraw->minor] = NULL;
        kfree(hidraw);

4/ in __list_del_entry_valid()

51      CHECK_DATA_CORRUPTION(prev->next != entry,


Given the kfree in 3/ can explain
"Read of size 8 at addr ffff8880143e8eb0 by task syz-executor753/4862",
I failed to work out how syzbot survived locking hidraw->list_lock after
scratching scalp twenty minutes in fear of unlnown hardware glitch. But
that fear does not have any chance for making sense given the reproducer
in your toolkit.

The kernel may have survived locking hidraw->list_lock because it's a
racy use-after-free: use and free happened in different tasks. So
based on timing the task can start using freed memory at any line of
code.
Note sometimes it also manifests as "general protection fault in
hidraw_release". Races frequently have different manifestations.

quoted

quoted

quoted

 hidraw_release+0xd5/0x370 drivers/hid/hidraw.c:353
 __fput+0x286/0x9f0 fs/file_table.c:311
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0xb29/0x2a30 kernel/exit.c:806
 do_group_exit+0xd2/0x2f0 kernel/exit.c:935
 __do_sys_exit_group kernel/exit.c:946 [inline]
 __se_sys_exit_group kernel/exit.c:944 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f4256d1c749
Code: Unable to access opcode bytes at RIP 0x7f4256d1c71f.
RSP: 002b:00007fffddc9a4e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f4256d913f0 RCX: 00007f4256d1c749
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00007fffddc9a560
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4256d913f0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
 </TASK>

Allocated by task 20:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 ____kasan_kmalloc mm/kasan/common.c:515 [inline]
 ____kasan_kmalloc mm/kasan/common.c:474 [inline]
 __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524
 kasan_kmalloc include/linux/kasan.h:270 [inline]
 kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3567
 kmalloc include/linux/slab.h:581 [inline]
 kzalloc include/linux/slab.h:715 [inline]
 hidraw_connect+0x4b/0x440 drivers/hid/hidraw.c:543
 hid_connect+0x5be/0xbc0 drivers/hid/hid-core.c:1960
 hid_hw_start drivers/hid/hid-core.c:2059 [inline]
 hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:2050
 hid_generic_probe drivers/hid/hid-generic.c:67 [inline]
 hid_generic_probe+0x6d/0x90 drivers/hid/hid-generic.c:56
 hid_device_probe+0x2bd/0x3f0 drivers/hid/hid-core.c:2380
 call_driver_probe drivers/base/dd.c:517 [inline]
 really_probe+0x245/0xcc0 drivers/base/dd.c:596
 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:752
 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:782
 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:899
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
 __device_attach+0x228/0x4a0 drivers/base/dd.c:970
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
 device_add+0xc17/0x1ee0 drivers/base/core.c:3405
 hid_add_device+0x344/0x9d0 drivers/hid/hid-core.c:2530
 uhid_device_add_worker+0x36/0x60 drivers/hid/uhid.c:73
 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
 worker_thread+0x657/0x1110 kernel/workqueue.c:2454
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 4861:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:366 [inline]
 ____kasan_slab_free mm/kasan/common.c:328 [inline]
 __kasan_slab_free+0xee/0x130 mm/kasan/common.c:374
 kasan_slab_free include/linux/kasan.h:236 [inline]
 __cache_free mm/slab.c:3437 [inline]
 kfree+0xf6/0x290 mm/slab.c:3794
 drop_ref+0x28f/0x390 drivers/hid/hidraw.c:335
 hidraw_release+0x255/0x370 drivers/hid/hidraw.c:357
 __fput+0x286/0x9f0 fs/file_table.c:311
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0xb29/0x2a30 kernel/exit.c:806
 do_group_exit+0xd2/0x2f0 kernel/exit.c:935
 __do_sys_exit_group kernel/exit.c:946 [inline]
 __se_sys_exit_group kernel/exit.c:944 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff8880143e8e00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 176 bytes inside of
 192-byte region [ffff8880143e8e00, ffff8880143e8ec0)
The buggy address belongs to the page:
page:ffffea000050fa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x143e8
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea000050f188 ffffea000050fc48 ffff888010c40000
raw: 0000000000000000 ffff8880143e8000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, ts 2151082992, free_ts 0
 prep_new_page mm/page_alloc.c:2434 [inline]
 get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389
 __alloc_pages_node include/linux/gfp.h:572 [inline]
 kmem_getpages mm/slab.c:1378 [inline]
 cache_grow_begin+0x75/0x350 mm/slab.c:2584
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957
 ____cache_alloc mm/slab.c:3040 [inline]
 ____cache_alloc mm/slab.c:3023 [inline]
 __do_cache_alloc mm/slab.c:3267 [inline]
 slab_alloc mm/slab.c:3308 [inline]
 kmem_cache_alloc_trace+0x380/0x4a0 mm/slab.c:3565
 kmalloc include/linux/slab.h:581 [inline]
 kzalloc include/linux/slab.h:715 [inline]
 call_usermodehelper_setup+0x9d/0x340 kernel/umh.c:365
 kobject_uevent_env+0xf28/0x1600 lib/kobject_uevent.c:614
 kernel_add_sysfs_param kernel/params.c:816 [inline]
 param_sysfs_builtin kernel/params.c:851 [inline]
 param_sysfs_init+0x367/0x43b kernel/params.c:970
 do_one_initcall+0x103/0x650 init/main.c:1300
 do_initcall_level init/main.c:1373 [inline]
 do_initcalls init/main.c:1389 [inline]
 do_basic_setup init/main.c:1408 [inline]
 kernel_init_freeable+0x6b1/0x73a init/main.c:1613
 kernel_init+0x1a/0x1d0 init/main.c:1502
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8880143e8d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8880143e8e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

quoted

ffff8880143e8e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc

                                     ^
 ffff8880143e8f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880143e8f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================