| TITLE: KASAN: use-after-free Write in usb_anchor_resume_wakeups |
| |
| [ 136.593735][ C1] ================================================================== |
| [ 136.593749][ C1] BUG: KASAN: use-after-free in register_lock_class+0xeb7/0x1240 |
| [ 136.593755][ C1] Write of size 8 at addr ffff8881ceba71f8 by task kworker/1:1/22 |
| [ 136.593756][ C1] |
| [ 136.593763][ C1] CPU: 1 PID: 22 Comm: kworker/1:1 Not tainted 5.2.0-rc6+ #13 |
| [ 136.593766][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 136.593775][ C1] Workqueue: usb_hub_wq hub_event |
| [ 136.593778][ C1] Call Trace: |
| [ 136.593781][ C1] <IRQ> |
| [ 136.593788][ C1] dump_stack+0xca/0x13e |
| [ 136.593807][ C1] print_address_description+0x67/0x231 |
| [ 136.593838][ C1] __kasan_report.cold+0x1a/0x32 |
| [ 136.593862][ C1] kasan_report+0xe/0x20 |
| [ 136.593867][ C1] register_lock_class+0xeb7/0x1240 |
| [ 136.593883][ C1] __lock_acquire+0x11d/0x5340 |
| [ 136.593899][ C1] lock_acquire+0x100/0x2b0 |
| [ 136.593911][ C1] _raw_spin_lock_irqsave+0x32/0x50 |
| [ 136.593921][ C1] __wake_up_common_lock+0xb0/0x170 |
| [ 136.593944][ C1] usb_anchor_resume_wakeups+0xbe/0xe0 |
| [ 136.593950][ C1] __usb_hcd_giveback_urb+0x1fa/0x470 |
| [ 136.593956][ C1] usb_hcd_giveback_urb+0x34a/0x400 |
| [ 136.593964][ C1] dummy_timer+0x1022/0x2df4 |
| [ 136.594012][ C1] call_timer_fn+0x15e/0x5e0 |
| [ 136.594057][ C1] run_timer_softirq+0x597/0x1410 |
| [ 136.594080][ C1] irq_exit+0x17c/0x1a0 |
| [ 136.594086][ C1] smp_apic_timer_interrupt+0xe2/0x480 |
| [ 136.594092][ C1] apic_timer_interrupt+0xf/0x20 |
| [ 136.594094][ C1] </IRQ> |
| [ 136.594100][ C1] RIP: 0010:console_unlock+0x9db/0xbf0 |
| [ 136.594107][ C1] Code: 00 89 ee 48 c7 c7 e0 eb f2 86 e8 50 a4 03 00 65 ff 0d 51 56 da 7e e9 11 fa ff ff e8 af 43 15 00 e8 ba 69 1a 00 ff 74 24 30 9d <e9> 31 fe ff ff e8 9b 43 15 00 48 8b bc 24 80 00 00 00 c7 05 d9 e6 |
| [ 136.594110][ C1] RSP: 0018:ffff8881d9f8f2c0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 |
| [ 136.594115][ C1] RAX: 0000000000000007 RBX: 0000000000000200 RCX: 1ffff1103b3cc729 |
| [ 136.594119][ C1] RDX: 0000000000000000 RSI: ffff8881d9e63928 RDI: ffff8881d9e63834 |
| [ 136.594122][ C1] RBP: 0000000000000000 R08: ffff8881d9e63000 R09: 0000000000000000 |
| [ 136.594125][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000068 |
| [ 136.594128][ C1] R13: ffffffff828cb580 R14: ffffffff8726a520 R15: dffffc0000000000 |
| [ 136.594157][ C1] vprintk_emit+0x171/0x3e0 |
| [ 136.594162][ C1] dev_vprintk_emit+0x4fc/0x541 |
| [ 136.594238][ C1] dev_printk_emit+0xba/0xf1 |
| [ 136.594259][ C1] __dev_printk+0x1db/0x203 |
| [ 136.594264][ C1] _dev_info+0xd7/0x109 |
| [ 136.594292][ C1] usb_serial_device_remove.cold+0x1e/0x98 |
| [ 136.594303][ C1] device_release_driver_internal+0x206/0x4c0 |
| [ 136.594309][ C1] bus_remove_device+0x2dc/0x4a0 |
| [ 136.594314][ C1] device_del+0x460/0xb80 |
| [ 136.594335][ C1] usb_serial_disconnect+0x20d/0x300 |
| [ 136.594341][ C1] usb_unbind_interface+0x1bd/0x8a0 |
| [ 136.594352][ C1] device_release_driver_internal+0x404/0x4c0 |
| [ 136.594358][ C1] bus_remove_device+0x2dc/0x4a0 |
| [ 136.594363][ C1] device_del+0x460/0xb80 |
| [ 136.594383][ C1] usb_disable_device+0x211/0x690 |
| [ 136.594388][ C1] usb_disconnect+0x284/0x830 |
| [ 136.594394][ C1] hub_event+0x1409/0x3590 |
| [ 136.594407][ C1] process_one_work+0x905/0x1570 |
| [ 136.594414][ C1] ? pwq_dec_nr_in_flight+0x310/0x310 |
| [ 136.594419][ C1] ? do_raw_spin_lock+0x11a/0x280 |
| [ 136.594425][ C1] worker_thread+0x7ab/0xe20 |
| [ 136.594432][ C1] ? process_one_work+0x1570/0x1570 |
| [ 136.594438][ C1] kthread+0x30b/0x410 |
| [ 136.594443][ C1] ? kthread_park+0x1a0/0x1a0 |
| [ 136.594448][ C1] ret_from_fork+0x24/0x30 |
| [ 136.594450][ C1] |
| [ 136.594453][ C1] Allocated by task 107: |
| [ 136.594467][ C1] save_stack+0x1b/0x80 |
| [ 136.594473][ C1] __kasan_kmalloc.constprop.0+0xbf/0xd0 |
| [ 136.594478][ C1] xpad_probe+0x24b/0x1b20 |
| [ 136.594484][ C1] usb_probe_interface+0x305/0x7a0 |
| [ 136.594490][ C1] really_probe+0x281/0x660 |
| [ 136.594496][ C1] driver_probe_device+0x104/0x210 |
| [ 136.594501][ C1] __device_attach_driver+0x1c2/0x220 |
| [ 136.594506][ C1] bus_for_each_drv+0x15c/0x1e0 |
| [ 136.594511][ C1] __device_attach+0x217/0x360 |
| [ 136.594516][ C1] bus_probe_device+0x1e4/0x290 |
| [ 136.594520][ C1] device_add+0xae6/0x16f0 |
| [ 136.594525][ C1] usb_set_configuration+0xdf6/0x1670 |
| [ 136.594529][ C1] generic_probe+0x9d/0xd5 |
| [ 136.594534][ C1] usb_probe_device+0x99/0x100 |
| [ 136.594539][ C1] really_probe+0x281/0x660 |
| [ 136.594544][ C1] driver_probe_device+0x104/0x210 |
| [ 136.594549][ C1] __device_attach_driver+0x1c2/0x220 |
| [ 136.594554][ C1] bus_for_each_drv+0x15c/0x1e0 |
| [ 136.594559][ C1] __device_attach+0x217/0x360 |
| [ 136.594564][ C1] bus_probe_device+0x1e4/0x290 |
| [ 136.594568][ C1] device_add+0xae6/0x16f0 |
| [ 136.594573][ C1] usb_new_device.cold+0x8c1/0x1016 |
| [ 136.594578][ C1] hub_event+0x1ada/0x3590 |
| [ 136.594584][ C1] process_one_work+0x905/0x1570 |
| [ 136.594589][ C1] worker_thread+0x7ab/0xe20 |
| [ 136.594593][ C1] kthread+0x30b/0x410 |
| [ 136.594598][ C1] ret_from_fork+0x24/0x30 |
| [ 136.594599][ C1] |
| [ 136.594601][ C1] Freed by task 2834: |
| [ 136.594606][ C1] save_stack+0x1b/0x80 |
| [ 136.594612][ C1] __kasan_slab_free+0x130/0x180 |
| [ 136.594616][ C1] kfree+0xd7/0x280 |
| [ 136.594621][ C1] xpad_disconnect+0x1cb/0x4a3 |
| [ 136.594625][ C1] usb_unbind_interface+0x1bd/0x8a0 |
| [ 136.594631][ C1] device_release_driver_internal+0x404/0x4c0 |
| [ 136.594636][ C1] bus_remove_device+0x2dc/0x4a0 |
| [ 136.594640][ C1] device_del+0x460/0xb80 |
| [ 136.594645][ C1] usb_disable_device+0x211/0x690 |
| [ 136.594649][ C1] usb_disconnect+0x284/0x830 |
| [ 136.594654][ C1] hub_event+0x1409/0x3590 |
| [ 136.594659][ C1] process_one_work+0x905/0x1570 |
| [ 136.594665][ C1] worker_thread+0x96/0xe20 |
| [ 136.594669][ C1] kthread+0x30b/0x410 |
| [ 136.594674][ C1] ret_from_fork+0x24/0x30 |
| [ 136.594675][ C1] |
| [ 136.594679][ C1] The buggy address belongs to the object at ffff8881ceba7180 |
| [ 136.594679][ C1] which belongs to the cache kmalloc-1k of size 1024 |
| [ 136.594684][ C1] The buggy address is located 120 bytes inside of |
| [ 136.594684][ C1] 1024-byte region [ffff8881ceba7180, ffff8881ceba7580) |
| [ 136.594685][ C1] The buggy address belongs to the page: |
| [ 136.594691][ C1] page:ffffea00073ae900 refcount:1 mapcount:0 mapping:ffff8881dac02a00 index:0x0 compound_mapcount: 0 |
| [ 136.594698][ C1] flags: 0x200000000010200(slab|head) |
| [ 136.594707][ C1] raw: 0200000000010200 dead000000000100 dead000000000200 ffff8881dac02a00 |
| [ 136.594713][ C1] raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000 |
| [ 136.594715][ C1] page dumped because: kasan: bad access detected |
| [ 136.594716][ C1] |
| [ 136.594718][ C1] Memory state around the buggy address: |
| [ 136.594723][ C1] ffff8881ceba7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb |
| [ 136.594727][ C1] ffff8881ceba7100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc |
| [ 136.594731][ C1] >ffff8881ceba7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb |
| [ 136.594733][ C1] ^ |
| [ 136.594738][ C1] ffff8881ceba7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb |
| [ 136.594742][ C1] ffff8881ceba7280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb |
| [ 136.594744][ C1] ================================================================== |
| [ 136.594746][ C1] Disabling lock debugging due to kernel taint |
| [ 136.594749][ C1] Kernel panic - not syncing: panic_on_warn set ... |
| [ 136.594755][ C1] CPU: 1 PID: 22 Comm: kworker/1:1 Tainted: G B 5.2.0-rc6+ #13 |
| [ 136.594758][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 136.594764][ C1] Workqueue: usb_hub_wq hub_event |
| [ 136.594766][ C1] Call Trace: |
| [ 136.594768][ C1] <IRQ> |
| [ 136.594773][ C1] dump_stack+0xca/0x13e |
| [ 136.594778][ C1] panic+0x292/0x6c9 |
| [ 136.594783][ C1] ? __warn_printk+0xf3/0xf3 |
| [ 136.594788][ C1] ? lock_downgrade+0x630/0x630 |
| [ 136.594795][ C1] ? print_shadow_for_address+0xb8/0x114 |
| [ 136.594801][ C1] ? trace_hardirqs_off+0x50/0x1c0 |
| [ 136.594806][ C1] ? register_lock_class+0xeb7/0x1240 |
| [ 136.594812][ C1] end_report+0x43/0x49 |
| [ 136.594817][ C1] ? register_lock_class+0xeb7/0x1240 |
| [ 136.594823][ C1] __kasan_report.cold+0xd/0x32 |
| [ 136.594828][ C1] ? register_lock_class+0xeb7/0x1240 |
| [ 136.594834][ C1] kasan_report+0xe/0x20 |
| [ 136.594853][ C1] register_lock_class+0xeb7/0x1240 |
| [ 136.594859][ C1] ? is_dynamic_key+0x1b0/0x1b0 |
| [ 136.594864][ C1] ? dev_vprintk_emit+0x4fc/0x541 |
| [ 136.594868][ C1] __lock_acquire+0x11d/0x5340 |
| [ 136.594874][ C1] ? mark_held_locks+0xe0/0xe0 |
| [ 136.594879][ C1] ? mark_held_locks+0xe0/0xe0 |
| [ 136.594884][ C1] lock_acquire+0x100/0x2b0 |
| [ 136.594889][ C1] ? __wake_up_common_lock+0xb0/0x170 |
| [ 136.594894][ C1] _raw_spin_lock_irqsave+0x32/0x50 |
| [ 136.594900][ C1] ? __wake_up_common_lock+0xb0/0x170 |
| [ 136.594905][ C1] __wake_up_common_lock+0xb0/0x170 |
| [ 136.594911][ C1] ? __usb_hcd_giveback_urb+0x1f2/0x470 |
| [ 136.594916][ C1] ? __wake_up_common+0x650/0x650 |
| [ 136.594921][ C1] ? usb_unanchor_urb+0x91/0xc0 |
| [ 136.594927][ C1] usb_anchor_resume_wakeups+0xbe/0xe0 |
| [ 136.594933][ C1] __usb_hcd_giveback_urb+0x1fa/0x470 |
| [ 136.594939][ C1] usb_hcd_giveback_urb+0x34a/0x400 |
| [ 136.594945][ C1] dummy_timer+0x1022/0x2df4 |
| [ 136.594950][ C1] ? mark_held_locks+0xe0/0xe0 |
| [ 136.594955][ C1] ? __lock_acquire+0x54a/0x5340 |
| [ 136.594960][ C1] ? find_held_lock+0x2d/0x110 |
| [ 136.594965][ C1] ? do_raw_spin_lock+0x11a/0x280 |
| [ 136.594970][ C1] ? lock_acquire+0x100/0x2b0 |
| [ 136.594976][ C1] ? dummy_udc_probe+0x970/0x970 |
| [ 136.594981][ C1] call_timer_fn+0x15e/0x5e0 |
| [ 136.594992][ C1] ? dummy_udc_probe+0x970/0x970 |
| [ 136.594998][ C1] ? process_timeout+0x40/0x40 |
| [ 136.595002][ C1] ? mark_held_locks+0x9f/0xe0 |
| [ 136.595007][ C1] ? _raw_spin_unlock_irq+0x24/0x30 |
| [ 136.595013][ C1] ? dummy_udc_probe+0x970/0x970 |
| [ 136.595019][ C1] run_timer_softirq+0x597/0x1410 |
| [ 136.595024][ C1] ? add_timer+0x7a0/0x7a0 |
| [ 136.595029][ C1] ? ktime_get+0x162/0x1d0 |
| [ 136.595034][ C1] __do_softirq+0x219/0x8b0 |
| [ 136.595040][ C1] irq_exit+0x17c/0x1a0 |
| [ 136.595046][ C1] smp_apic_timer_interrupt+0xe2/0x480 |
| [ 136.595052][ C1] apic_timer_interrupt+0xf/0x20 |
| [ 136.595053][ C1] </IRQ> |
| [ 136.595059][ C1] RIP: 0010:console_unlock+0x9db/0xbf0 |
| [ 136.595065][ C1] Code: 00 89 ee 48 c7 c7 e0 eb f2 86 e8 50 a4 03 00 65 ff 0d 51 56 da 7e e9 11 fa ff ff e8 af 43 15 00 e8 ba 69 1a 00 ff 74 24 30 9d <e9> 31 fe ff ff e8 9b 43 15 00 48 8b bc 24 80 00 00 00 c7 05 d9 e6 |
| [ 136.595068][ C1] RSP: 0018:ffff8881d9f8f2c0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 |
| [ 136.595073][ C1] RAX: 0000000000000007 RBX: 0000000000000200 RCX: 1ffff1103b3cc729 |
| [ 136.595076][ C1] RDX: 0000000000000000 RSI: ffff8881d9e63928 RDI: ffff8881d9e63834 |
| [ 136.595079][ C1] RBP: 0000000000000000 R08: ffff8881d9e63000 R09: 0000000000000000 |
| [ 136.595082][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000068 |
| [ 136.595086][ C1] R13: ffffffff828cb580 R14: ffffffff8726a520 R15: dffffc0000000000 |
| [ 136.595092][ C1] ? netconsole_netdev_event+0x2a0/0x2a0 |
| [ 136.595098][ C1] vprintk_emit+0x171/0x3e0 |
| [ 136.595103][ C1] dev_vprintk_emit+0x4fc/0x541 |
| [ 136.595108][ C1] ? dev_attr_show.cold+0x3a/0x3a |
| [ 136.595114][ C1] ? save_stack+0x4c/0x80 |
| [ 136.595119][ C1] ? save_stack+0x1b/0x80 |
| [ 136.595124][ C1] ? __kasan_slab_free+0x130/0x180 |
| [ 136.595129][ C1] ? kfree+0xd7/0x280 |
| [ 136.595135][ C1] ? ftdi_sio_port_remove+0x117/0x350 |
| [ 136.595140][ C1] ? usb_serial_device_remove+0x15d/0x1e0 |
| [ 136.595146][ C1] ? device_release_driver_internal+0x206/0x4c0 |
| [ 136.595151][ C1] ? bus_remove_device+0x2dc/0x4a0 |
| [ 136.595155][ C1] ? device_del+0x460/0xb80 |
| [ 136.595160][ C1] ? usb_serial_disconnect+0x20d/0x300 |
| [ 136.595165][ C1] ? usb_unbind_interface+0x1bd/0x8a0 |
| [ 136.595170][ C1] dev_printk_emit+0xba/0xf1 |
| [ 136.595175][ C1] ? dev_vprintk_emit+0x541/0x541 |
| [ 136.595179][ C1] ? find_held_lock+0x2d/0x110 |
| [ 136.595185][ C1] ? do_raw_spin_lock+0x11a/0x280 |
| [ 136.595190][ C1] __dev_printk+0x1db/0x203 |
| [ 136.595195][ C1] _dev_info+0xd7/0x109 |
| [ 136.595200][ C1] ? _dev_notice+0x109/0x109 |
| [ 136.595205][ C1] ? __kasan_slab_free+0x145/0x180 |
| [ 136.595211][ C1] ? ftdi_sio_port_remove+0x117/0x350 |
| [ 136.595216][ C1] ? kfree+0xd7/0x280 |
| [ 136.595222][ C1] usb_serial_device_remove.cold+0x1e/0x98 |
| [ 136.595227][ C1] ? usb_serial_device_match+0xa0/0xa0 |
| [ 136.595233][ C1] device_release_driver_internal+0x206/0x4c0 |
| [ 136.595238][ C1] bus_remove_device+0x2dc/0x4a0 |
| [ 136.595243][ C1] device_del+0x460/0xb80 |
| [ 136.595248][ C1] ? __device_links_no_driver+0x240/0x240 |
| [ 136.595253][ C1] ? _raw_spin_unlock_irqrestore+0x3e/0x50 |
| [ 136.595258][ C1] ? lockdep_hardirqs_on+0x379/0x580 |
| [ 136.595263][ C1] usb_serial_disconnect+0x20d/0x300 |
| [ 136.595268][ C1] usb_unbind_interface+0x1bd/0x8a0 |
| [ 136.595274][ C1] ? usb_autoresume_device+0x60/0x60 |
| [ 136.595279][ C1] device_release_driver_internal+0x404/0x4c0 |
| [ 136.595285][ C1] bus_remove_device+0x2dc/0x4a0 |
| [ 136.595289][ C1] device_del+0x460/0xb80 |
| [ 136.595294][ C1] ? __device_links_no_driver+0x240/0x240 |
| [ 136.595299][ C1] ? lockdep_hardirqs_on+0x379/0x580 |
| [ 136.595304][ C1] ? remove_intf_ep_devs+0x13f/0x1d0 |
| [ 136.595309][ C1] usb_disable_device+0x211/0x690 |
| [ 136.595314][ C1] usb_disconnect+0x284/0x830 |
| [ 136.595319][ C1] hub_event+0x1409/0x3590 |
| [ 136.595325][ C1] ? hub_port_debounce+0x260/0x260 |
| [ 136.595331][ C1] process_one_work+0x905/0x1570 |
| [ 136.595338][ C1] ? pwq_dec_nr_in_flight+0x310/0x310 |
| [ 136.595343][ C1] ? do_raw_spin_lock+0x11a/0x280 |
| [ 136.595349][ C1] worker_thread+0x7ab/0xe20 |
| [ 136.595355][ C1] ? process_one_work+0x1570/0x1570 |
| [ 136.595360][ C1] kthread+0x30b/0x410 |
| [ 136.595365][ C1] ? kthread_park+0x1a0/0x1a0 |
| [ 136.595370][ C1] ret_from_fork+0x24/0x30 |
| [ 136.595625][ C1] Kernel Offset: disabled |
| [ 138.235281][ C1] Rebooting in 86400 seconds.. |
