BUG: KASAN: use-after-free in xhci_free_virt_devices_depth_first |
||||
Issue description
While running the following script on kevin
while true
do
for i in /sys/bus/platform/drivers/rockchip-dwc3/usb*; do
basename $i > $(dirname $i)/unbind
basename $i > $(dirname $i)/bind
done
sleep 1
done
the following use-after free was seen. Subsequently the system crashed.
[28162.977974] ==================================================================
[28162.985213] BUG: KASAN: use-after-free in xhci_free_virt_devices_depth_first+0x7c/0x140 at addr ffffffc0591799d0
[28162.995376] Read of size 8 by task basename/30771
[28163.000076] =============================================================================
[28163.008245] BUG kmalloc-2048 (Not tainted): kasan: bad access detected
[28163.014764] -----------------------------------------------------------------------------
[28163.014764]
[28163.024404] Disabling lock debugging due to kernel taint
[28163.029718] INFO: Allocated in usb_alloc_dev+0x54/0x488 age=827 cpu=3 pid=13292
[28163.037021] alloc_debug_processing+0x124/0x178
[28163.041551] ___slab_alloc.constprop.58+0x4f4/0x5f8
[28163.046428] __slab_alloc.isra.55.constprop.57+0x44/0x54
[28163.051737] kmem_cache_alloc_trace+0xd4/0x260
[28163.056180] usb_alloc_dev+0x54/0x488
[28163.059842] hub_event+0xb4c/0x12a4
[28163.063332] process_one_work+0x390/0x6b8
[28163.067342] worker_thread+0x480/0x610
[28163.071091] kthread+0x164/0x178
[28163.074319] ret_from_fork+0x10/0x40
[28163.077897] INFO: Freed in usb_release_dev+0x7c/0x8c age=273 cpu=2 pid=30767
[28163.084940] free_debug_processing+0x278/0x37c
[28163.089382] __slab_free+0x84/0x400
[28163.092871] kfree+0x1fc/0x268
[28163.095926] usb_release_dev+0x7c/0x8c
[28163.099675] device_release+0x8c/0xd4
[28163.103340] kobject_release+0x78/0x94
[28163.107089] kobject_put+0x5c/0x68
[28163.110491] put_device+0x24/0x30
[28163.113807] usb_disconnect+0x270/0x28c
[28163.117641] usb_disconnect+0xcc/0x28c
[28163.121391] usb_remove_hcd+0x10c/0x2a8
[28163.125227] xhci_plat_remove+0xbc/0x104
[28163.129150] platform_drv_remove+0x48/0x6c
[28163.133246] __device_release_driver+0x10c/0x1a8
[28163.137864] device_release_driver+0x2c/0x40
[28163.142134] bus_remove_device+0x1d8/0x200
[28163.146231] INFO: Slab 0xffffffbdc164de00 objects=13 used=10 fp=0xffffffc05917c280 flags=0x4080
[28163.154920] INFO: Object 0xffffffc059179300 @offset=4864 fp=0x (null)
[28163.154920]
[28163.163612] Bytes b4 ffffffc0591792f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[28163.173082] Object ffffffc059179300: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
...
[28164.587128] CPU: 4 PID: 30771 Comm: basename Tainted: G B 4.4.52 #507
[28164.594688] Hardware name: Google Kevin (DT)
[28164.598955] Call trace:
[28164.601408] [<ffffffc00020a6b4>] dump_backtrace+0x0/0x190
[28164.606807] [<ffffffc00020a864>] show_stack+0x20/0x28
[28164.611858] [<ffffffc0005d1a94>] dump_stack+0xa4/0xcc
[28164.616910] [<ffffffc0003c9b64>] print_trailer+0x158/0x168
[28164.622394] [<ffffffc0003c9d08>] object_err+0x4c/0x5c
[28164.627444] [<ffffffc0003cfb1c>] kasan_report+0x330/0x4ec
[28164.632842] [<ffffffc0003ced60>] __asan_load8+0x78/0x80
[28164.638068] [<ffffffc00084fd78>] xhci_free_virt_devices_depth_first+0x7c/0x140
[28164.645287] [<ffffffc0008503c8>] xhci_mem_cleanup+0x2ac/0x830
[28164.651031] [<ffffffc0008464cc>] xhci_stop+0x1dc/0x224
[28164.656169] [<ffffffc000806f40>] usb_remove_hcd+0x160/0x2a8
[28164.661741] [<ffffffc00085eab8>] xhci_plat_remove+0xbc/0x104
[28164.667399] [<ffffffc00077ad68>] platform_drv_remove+0x48/0x6c
[28164.673230] [<ffffffc000778648>] __device_release_driver+0x10c/0x1a8
[28164.679581] [<ffffffc000778710>] device_release_driver+0x2c/0x40
[28164.685586] [<ffffffc000777308>] bus_remove_device+0x1d8/0x200
[28164.691416] [<ffffffc0007733cc>] device_del+0x218/0x2d0
[28164.696642] [<ffffffc00077ab50>] platform_device_del+0x2c/0xd4
[28164.702473] [<ffffffc00077ac18>] platform_device_unregister+0x20/0x34
[28164.708911] [<ffffffc000824764>] dwc3_host_exit+0xbc/0xd0
[28164.714308] [<ffffffc0008206ac>] dwc3_remove+0x90/0xe4
[28164.719446] [<ffffffc00077ad68>] platform_drv_remove+0x48/0x6c
[28164.725277] [<ffffffc000778648>] __device_release_driver+0x10c/0x1a8
[28164.731627] [<ffffffc000778710>] device_release_driver+0x2c/0x40
[28164.737631] [<ffffffc000777308>] bus_remove_device+0x1d8/0x200
[28164.743462] [<ffffffc0007733cc>] device_del+0x218/0x2d0
[28164.748686] [<ffffffc00077ab50>] platform_device_del+0x2c/0xd4
[28164.754518] [<ffffffc00077ac18>] platform_device_unregister+0x20/0x34
[28164.760957] [<ffffffc00099ad90>] of_platform_device_destroy+0x8c/0xf4
[28164.767396] [<ffffffc000772350>] device_for_each_child+0x88/0xbc
[28164.773400] [<ffffffc00099acdc>] of_platform_depopulate+0x54/0x7c
[28164.779491] [<ffffffc000825830>] dwc3_rockchip_remove+0x94/0x158
[28164.785496] [<ffffffc00077ad68>] platform_drv_remove+0x48/0x6c
[28164.791329] [<ffffffc000778648>] __device_release_driver+0x10c/0x1a8
[28164.797681] [<ffffffc000778710>] device_release_driver+0x2c/0x40
[28164.803686] [<ffffffc000776958>] unbind_store+0x88/0xc4
[28164.808910] [<ffffffc000775384>] drv_attr_store+0x54/0x64
[28164.814308] [<ffffffc000472388>] sysfs_kf_write+0x9c/0xb0
,
Mar 9 2017
,
Nov 3 2017
Also see https://bugs.96boards.org/show_bug.cgi?id=535 and https://android-review.googlesource.com/#/c/kernel/hikey-linaro/+/528775/. Turns out the problem is not really use-after-free but a not completely initialized device.
,
Nov 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/a973ea452fe074a8e85ee49faaf678bfbf6be06e commit a973ea452fe074a8e85ee49faaf678bfbf6be06e Author: Yu Chen <chenyu56@huawei.com> Date: Thu Nov 09 03:48:58 2017 FROMLIST: usb:xhci fix panic in xhci_free_virt_devices_depth_first Check vdev->real_port 0 to avoid panic [ 9.261347] [<ffffff800884a390>] xhci_free_virt_devices_depth_first+0x58/0x108 [ 9.261352] [<ffffff800884a814>] xhci_mem_cleanup+0x1bc/0x570 [ 9.261355] [<ffffff8008842de8>] xhci_stop+0x140/0x1c8 [ 9.261365] [<ffffff80087ed304>] usb_remove_hcd+0xfc/0x1d0 [ 9.261369] [<ffffff80088551c4>] xhci_plat_remove+0x6c/0xa8 [ 9.261377] [<ffffff80086e928c>] platform_drv_remove+0x2c/0x70 [ 9.261384] [<ffffff80086e6ea0>] __device_release_driver+0x80/0x108 [ 9.261387] [<ffffff80086e7a1c>] device_release_driver+0x2c/0x40 [ 9.261392] [<ffffff80086e5f28>] bus_remove_device+0xe0/0x120 [ 9.261396] [<ffffff80086e2e34>] device_del+0x114/0x210 [ 9.261399] [<ffffff80086e9e00>] platform_device_del+0x30/0xa0 [ 9.261403] [<ffffff8008810bdc>] dwc3_otg_work+0x204/0x488 [ 9.261407] [<ffffff80088133fc>] event_work+0x304/0x5b8 [ 9.261414] [<ffffff80080e31b0>] process_one_work+0x148/0x490 [ 9.261417] [<ffffff80080e3548>] worker_thread+0x50/0x4a0 [ 9.261421] [<ffffff80080e9ea0>] kthread+0xe8/0x100 [ 9.261427] [<ffffff8008083680>] ret_from_fork+0x10/0x50 The problem can occur if xhci_plat_remove() is called shortly after xhci_plat_probe(). While xhci_free_virt_devices_depth_first been called before the device has been setup and get real_port initialized. The problem occurred on Hikey960 and was reproduced by Guenter Roeck on Kevin with chromeos-4.4. BUG= 700041 TEST=Build and run Change-Id: Ia397872a9bf9b527586bff126f1634411c02603b Cc: Guenter Roeck <groeck@google.com> Signed-off-by: Fan Ning <fanning4@hisilicon.com> Signed-off-by: Li Rui <lirui39@hisilicon.com> Signed-off-by: yangdi <yangdi10@hisilicon.com> Signed-off-by: Yu Chen <chenyu56@huawei.com> Reviewed-by: Guenter Roeck <groeck@chromium.org> Signed-off-by: Guenter Roeck <groeck@chromium.org> (am from https://patchwork.kernel.org/patch/10045623/) Reviewed-on: https://chromium-review.googlesource.com/757457 Reviewed-by: Dylan Reid <dgreid@chromium.org> [modify] https://crrev.com/a973ea452fe074a8e85ee49faaf678bfbf6be06e/drivers/usb/host/xhci-mem.c
,
Nov 9 2017
|
||||
►
Sign in to add a comment |
||||
Comment 1 by groeck@chromium.org
, Mar 9 2017133 KB
133 KB View Download