Hello,

We are reporting the following crash (reproducer and a proposed patch attached): Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713 Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[ 44.000772][ T804] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 44.163699][ T804] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 1.00 [ 44.169786][ T804] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.212054][ T12] greybus 1-svc: set power mode = 0 [ 44.212064][ T12] greybus 1-svc: power mode change failed on AP to switch link: -5 [ 44.213758][ C1] greybus greybus1: 0/0:0: short response 0x94 received (8 < 9) [ 44.215179][ T9337] greybus greybus1: 0/0:0: synchronous operation id 0x0003 of type 0x14 failed: -90 [ 44.215216][ T9337] greybus 1-svc: failed to get rail count: -90 [ 44.234071][ T9337] greybus 1-2.2: Interface added (greybus) [ 44.234080][ T9337] greybus 1-2.2: GMP VID=0x00000001, PID=0x00000001 [ 44.234087][ T9337] greybus 1-2.2: DDBL1 Manufacturer=0x00000126, Product=0x00000001 [ 44.256005][ T9337] hid-generic 0000:0001:0002.0001: hidraw0: <UNKNOWN> HID v1.11 Device [1-2.2.1 0001:0002] on [ 44.295710][ T9495] ================================================================== [ 44.295718][ T9495] BUG: KASAN: slab-out-of-bounds in gb_hid_raw_request+0x29c/0x860 [ 44.295741][ T9495] Write of size 2 at addr ffff88810d471a0a by task repro/9495 [ 44.295747][ T9495] [ 44.295758][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.295767][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.295775][ T9495] Call Trace: [ 44.295779][ T9495] <TASK> [ 44.295784][ T9495] dump_stack_lvl+0xe8/0x150 [ 44.295794][ T9495] print_address_description+0x55/0x1e0 [ 44.295802][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295809][ T9495] print_report+0x58/0x70 [ 44.295815][ T9495] kasan_report+0x117/0x150 [ 44.295826][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295834][ T9495] kasan_check_range+0x264/0x2c0 [ 44.295843][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295849][ T9495] __asan_memcpy+0x40/0x70 [ 44.295858][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.295865][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.295873][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.295883][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.295892][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.295901][ T9495] hidraw_write+0x91/0xd0 [ 44.295908][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.295916][ T9495] vfs_write+0x29a/0xb90 [ 44.295924][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.295931][ T9495] ? __fget_files+0x2a/0x420 [ 44.295939][ T9495] ? __fget_files+0x2a/0x420 [ 44.295944][ T9495] ? __fget_files+0x3a0/0x420 [ 44.295950][ T9495] ? __fget_files+0x2a/0x420 [ 44.295958][ T9495] ksys_write+0x150/0x270 [ 44.295965][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.295973][ T9495] do_syscall_64+0x155/0x510 [ 44.295984][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.295993][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296000][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.296007][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296014][ T9495] RIP: 0033:0x4521d2 [ 44.296024][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.296032][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.296042][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.296046][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.296051][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.296055][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.296059][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.296066][ T9495] </TASK> [ 44.296068][ T9495] [ 44.296071][ T9495] Allocated by task 9495: [ 44.296075][ T9495] kasan_save_track+0x3e/0x80 [ 44.296082][ T9495] __kasan_kmalloc+0x93/0xb0 [ 44.296090][ T9495] __kmalloc_noprof+0x36f/0x720 [ 44.296097][ T9495] gb_operation_message_alloc+0x8c/0x280 [ 44.296104][ T9495] gb_operation_create_common+0xa9/0x650 [ 44.296111][ T9495] gb_operation_create_flags+0xa2/0x2d0 [ 44.296117][ T9495] gb_hid_raw_request+0x1e6/0x860 [ 44.296123][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.296130][ T9495] hidraw_write+0x91/0xd0 [ 44.296137][ T9495] vfs_write+0x29a/0xb90 [ 44.296142][ T9495] ksys_write+0x150/0x270 [ 44.296148][ T9495] do_syscall_64+0x155/0x510 [ 44.296156][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296162][ T9495] [ 44.296163][ T9495] The buggy address belongs to the object at ffff88810d471a00 [ 44.296163][ T9495] which belongs to the cache kmalloc-16 of size 16 [ 44.296170][ T9495] The buggy address is located 10 bytes inside of [ 44.296170][ T9495] allocated 11-byte region [ffff88810d471a00, ffff88810d471a0b) [ 44.296177][ T9495] [ 44.296179][ T9495] The buggy address belongs to the physical page: [ 44.296186][ T9495] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d471 [ 44.296193][ T9495] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 44.296202][ T9495] page_type: f5(slab) [ 44.296212][ T9495] raw: 057ff00000000000 ffff88801b041640 dead000000000100 dead000000000122 [ 44.296217][ T9495] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 44.296220][ T9495] page dumped because: kasan: bad access detected [ 44.296226][ T9495] page_owner tracks the page as allocated [ 44.296229][ T9495] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3657058998 [ 44.296240][ T9495] post_alloc_hook+0x1f9/0x250 [ 44.296247][ T9495] get_page_from_freelist+0x235a/0x23e0 [ 44.296255][ T9495] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 44.296262][ T9495] allocate_slab+0x7d/0x610 [ 44.296267][ T9495] refill_objects+0x2d6/0x350 [ 44.296272][ T9495] __pcs_replace_empty_main+0x2c9/0x6c0 [ 44.296281][ T9495] __kmalloc_noprof+0x48b/0x720 [ 44.296288][ T9495] usb_hcd_submit_urb+0x7a3/0x1b40 [ 44.296301][ T9495] usb_start_wait_urb+0x13f/0x5b0 [ 44.296308][ T9495] usb_control_msg+0x234/0x3e0 [ 44.296314][ T9495] hub_power_on+0x1b6/0x460 [ 44.296320][ T9495] hub_activate+0x345/0x1a80 [ 44.296327][ T9495] hub_probe+0x291e/0x3c10 [ 44.296334][ T9495] usb_probe_interface+0x71f/0xe00 [ 44.296342][ T9495] really_probe+0x267/0xaf0 [ 44.296366][ T9495] __driver_probe_device+0x1e2/0x350 [ 44.296372][ T9495] page_owner free stack trace missing [ 44.296375][ T9495] [ 44.296377][ T9495] Memory state around the buggy address: [ 44.296381][ T9495] ffff88810d471900: 00 04 fc fc 00 07 fc fc 00 00 fc fc 00 01 fc fc [ 44.296385][ T9495] ffff88810d471980: 00 01 fc fc 00 01 fc fc fa fb fc fc 00 01 fc fc [ 44.296389][ T9495] >ffff88810d471a00: 00 03 fc fc fa fb fc fc fa fb fc fc 00 01 fc fc [ 44.296393][ T9495] ^ [ 44.296396][ T9495] ffff88810d471a80: fa fb fc fc fa fb fc fc 00 00 fc fc 00 01 fc fc [ 44.296400][ T9495] ffff88810d471b00: 00 01 fc fc 00 01 fc fc 00 05 fc fc 00 05 fc fc [ 44.296404][ T9495] ================================================================== [ 44.297569][ T9495] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 44.352486][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.353650][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.354609][ T9495] Call Trace: [ 44.354919][ T9495] <TASK> [ 44.355192][ T9495] vpanic+0x56d/0xa60 [ 44.355639][ T9495] ? __pfx_vpanic+0x10/0x10 [ 44.356061][ T9495] panic+0xc5/0xd0 [ 44.356407][ T9495] ? __pfx_panic+0x10/0x10 [ 44.356831][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.357323][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.357800][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.358291][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.358771][ T9495] check_panic_on_warn+0x89/0xb0 [ 44.359225][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.359702][ T9495] end_report+0x73/0x170 [ 44.360095][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.360566][ T9495] kasan_report+0x128/0x150 [ 44.360998][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.361471][ T9495] kasan_check_range+0x264/0x2c0 [ 44.361929][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.362430][ T9495] __asan_memcpy+0x40/0x70 [ 44.362863][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.363348][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.363865][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.364348][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.364825][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.365314][ T9495] hidraw_write+0x91/0xd0 [ 44.365786][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.366245][ T9495] vfs_write+0x29a/0xb90 [ 44.366636][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.367076][ T9495] ? __fget_files+0x2a/0x420 [ 44.367500][ T9495] ? __fget_files+0x2a/0x420 [ 44.367924][ T9495] ? __fget_files+0x3a0/0x420 [ 44.368352][ T9495] ? __fget_files+0x2a/0x420 [ 44.368791][ T9495] ksys_write+0x150/0x270 [ 44.369188][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.369633][ T9495] do_syscall_64+0x155/0x510 [ 44.370063][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.370523][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.371077][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.371509][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.372046][ T9495] RIP: 0033:0x4521d2 [ 44.372407][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.374131][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.374887][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.375673][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.376381][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.377101][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.377812][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.378522][ T9495] </TASK> [ 44.379100][ T9495] Kernel Offset: disabled [ 44.379644][ T9495] Rebooting in 86400 seconds..

Regards, SEFCOM Lab @ ASU