[Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

 

We encountered 5 different crashes in the cec device by using our generated syscall specification for it, here are the descriptions of these 5 crashes and the related files are attached:

1. KASAN: slab-use-after-free Read in cec_queue_msg_fh (Reproducible)

2. WARNING: ODEBUG bug in cec_transmit_msg_fh

3. WARNING in cec_data_cancel

4. INFO: task hung in cec_claim_log_addrs (Reproducible)

5. general protection fault in cec_transmit_done_ts

 

For “KASAN: slab-use-after-free Read in cec_queue_msg_fh”, we attached a syzkaller program to reproduce it. This crash is caused by ` list_add_tail(&entry->list, &fh->msgs);` (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-adap.c#L224), which reads a variable freed by `kfree(fh);` (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-api.c#L684). The reproducible program is a Syzkaller program, which can be executed following this document: https://github.com/google/syzkaller/blob/master/docs/executing_syzkaller_programs.md.

 

For “WARNING: ODEBUG bug in cec_transmit_msg_fh”, unfortunately we failed to reproduce it but we indeed trigger this crash almost every time when we fuzz the cec device only. We attached the report and log for this bug. It tries freeing an active object by using `kfree(data);` (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-adap.c#L930).

 

For “WARNING in cec_data_cancel”, it is an internal warning used in cec_data_cancel (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-adap.c#L365), which checks whether the transmit is the current or pending. Unfortunately, we also don't have the reproducible program for this bug, but we attach the report and log.

 

For “INFO: task hung in cec_claim_log_addrs”, the kernel hangs when the cec device ` wait_for_completion(&adap->config_completion);` (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-adap.c#L1579). We have a reproducible C program for this.

 

For “general protection fault in cec_transmit_done_ts”, the cec device tries derefencing a non-canonical address 0xdffffc00000000e0: 0000 [#1], which is related to the invocation ` cec_transmit_attempt_done_ts ` (https://elixir.bootlin.com/linux/v6.7-rc7/source/drivers/media/cec/core/cec-adap.c#L697). It seems that the address of cec_adapter is totally wrong. We do not have a reproducible program for this bug, but the log and report for it are attached.

 

If you have any questions or require more information, please feel free to contact us.

 

Best,

Chenyuan

Attachment: general-protection-fault_cec_transmit_done_ts-machineInfo
Description: general-protection-fault_cec_transmit_done_ts-machineInfo

Attachment: general-protection-fault_cec_transmit_done_ts.log
Description: general-protection-fault_cec_transmit_done_ts.log

Attachment: general-protection-fault_cec_transmit_done_ts.report
Description: general-protection-fault_cec_transmit_done_ts.report

Attachment: INFO-cec_claim_log_addrs-repro.cprog
Description: INFO-cec_claim_log_addrs-repro.cprog

Attachment: INFO-cec_claim_log_addrs-repro.log
Description: INFO-cec_claim_log_addrs-repro.log

Attachment: INFO-cec_claim_log_addrs-repro.prog
Description: INFO-cec_claim_log_addrs-repro.prog

Attachment: INFO-cec_claim_log_addrs-repro.report
Description: INFO-cec_claim_log_addrs-repro.report

Attachment: KASAN-UAF-cec_queue_msg_fh.log
Description: KASAN-UAF-cec_queue_msg_fh.log

Attachment: KASAN-UAF-cec_queue_msg_fh.prog
Description: KASAN-UAF-cec_queue_msg_fh.prog

Attachment: KASAN-UAF-cec_queue_msg_fh.report
Description: KASAN-UAF-cec_queue_msg_fh.report

Attachment: WARNING_cec_data_cancel-machineInfo
Description: WARNING_cec_data_cancel-machineInfo

Attachment: WARNING_cec_data_cancel.log
Description: WARNING_cec_data_cancel.log

Attachment: WARNING_cec_data_cancel.report
Description: WARNING_cec_data_cancel.report

Attachment: WARNING_ODEBUG_cec_transmit_msg_fh-machineInfo
Description: WARNING_ODEBUG_cec_transmit_msg_fh-machineInfo

Attachment: WARNING_ODEBUG_cec_transmit_msg_fh.log
Description: WARNING_ODEBUG_cec_transmit_msg_fh.log

Attachment: WARNING_ODEBUG_cec_transmit_msg_fh.report
Description: WARNING_ODEBUG_cec_transmit_msg_fh.report


[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux