syzbot


KASAN: use-after-free Read in bpf_test_finish

Status: public: reported C repro on 2019/04/11 00:00
Reported-by: syzbot+0133ed9afa71a766cd03@syzkaller.appspotmail.com
First crash: 2146d, last: 1777d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in bpf_test_finish bpf net C 1211 2183d 2198d 8/27 fixed on 2018/08/07 13:43
linux-4.14 KASAN: use-after-free Read in bpf_test_finish C inconclusive 4 1504d 1807d 0/1 upstream: reported C repro on 2019/08/03 11:31

Sample crash report:
audit: type=1400 audit(1537821747.371:8): avc:  denied  { prog_load } for  pid=1792 comm="syz-executor352" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1
audit: type=1400 audit(1537821747.391:9): avc:  denied  { prog_run } for  pid=1792 comm="syz-executor352" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1
==================================================================
BUG: KASAN: use-after-free in _copy_to_user+0x9a/0xc0 lib/usercopy.c:27
Read of size 660 at addr ffff8801c3e3fffa by task syz-executor352/1792

CPU: 0 PID: 1792 Comm: syz-executor352 Not tainted 4.14.71+ #8
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 print_address_description+0x60/0x22b mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report.cold.6+0x11b/0x2dd mm/kasan/report.c:409
 _copy_to_user+0x9a/0xc0 lib/usercopy.c:27
 copy_to_user include/linux/uaccess.h:155 [inline]
 bpf_test_finish.isra.0+0xc8/0x190 net/bpf/test_run.c:59
 bpf_prog_test_run_skb+0x4d0/0x8c0 net/bpf/test_run.c:144
 bpf_prog_test_run kernel/bpf/syscall.c:1330 [inline]
 SYSC_bpf kernel/bpf/syscall.c:1602 [inline]
 SyS_bpf+0x79d/0x3640 kernel/bpf/syscall.c:1547
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x440259
RSP: 002b:00007fff63f9d828 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259
RDX: 0000000000000028 RSI: 0000000020000280 RDI: 000000000000000a
RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401ae0
R13: 0000000000401b70 R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea00070f8fc0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffffea00070f8fe0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c3e3fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801c3e3ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8801c3e3ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                ^
 ffff8801c3e40000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801c3e40080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (388):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/09/24 20:45 android-4.14 666c420fa3ea 2f485cdf .config console log report syz C ci-android-414-kasan-gce-root
2018/09/02 02:40 android-4.14 47350a9f13c6 a4718693 .config console log report syz C ci-android-414-kasan-gce-root
2018/09/25 02:48 android-4.14 666c420fa3ea 0e7547d7 .config console log report syz ci-android-414-kasan-gce-root
2018/09/08 03:28 android-4.14 b859aa7d7a0c 6b5120a4 .config console log report syz ci-android-414-kasan-gce-root
2018/09/01 07:50 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2018/09/01 01:45 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2018/09/01 00:11 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2019/09/02 22:28 android-4.14 a9d0871a562e 14544a56 .config console log report ci-android-414-kasan-gce-root
2019/09/02 02:01 android-4.14 a9d0871a562e bad3cce2 .config console log report ci-android-414-kasan-gce-root
2019/09/01 04:25 android-4.14 a9d0871a562e bad3cce2 .config console log report ci-android-414-kasan-gce-root
2019/08/31 15:32 android-4.14 987732fcbbe3 fd37b39e .config console log report ci-android-414-kasan-gce-root
2019/08/30 06:59 android-4.14 987732fcbbe3 fd37b39e .config console log report ci-android-414-kasan-gce-root
2019/08/29 17:22 android-4.14 987732fcbbe3 fd37b39e .config console log report ci-android-414-kasan-gce-root
2019/08/26 16:19 android-4.14 f5189d4af2b5 d21c5d9d .config console log report ci-android-414-kasan-gce-root
2019/08/24 05:27 android-4.14 a48da8903efa 78ded196 .config console log report ci-android-414-kasan-gce-root
2019/08/22 16:54 android-4.14 e204fa49a029 d003d6d0 .config console log report ci-android-414-kasan-gce-root
2019/08/21 06:56 android-4.14 e204fa49a029 4ea67ff8 .config console log report ci-android-414-kasan-gce-root
2019/08/20 04:48 android-4.14 40b8f54d0fc7 ee12860b .config console log report ci-android-414-kasan-gce-root
2019/08/18 04:53 android-4.14 5d8bfdf81cde 55bf8926 .config console log report ci-android-414-kasan-gce-root
2019/08/13 20:59 android-4.14 0e28694fe668 ef801a3e .config console log report ci-android-414-kasan-gce-root
2019/08/12 07:18 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/12 06:08 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/11 22:38 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/11 15:53 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/09 13:11 android-4.14 b9cd593b1ba7 ede31a9b .config console log report ci-android-414-kasan-gce-root
2019/08/08 18:40 android-4.14 b9cd593b1ba7 e6ebef88 .config console log report ci-android-414-kasan-gce-root
2019/08/08 09:41 android-4.14 b9cd593b1ba7 e6ebef88 .config console log report ci-android-414-kasan-gce-root
2019/08/07 02:59 android-4.14 b9cd593b1ba7 c6f01e54 .config console log report ci-android-414-kasan-gce-root
2018/12/30 08:21 android-4.14 7d2d5fc1acda 35e3f847 .config console log report ci-android-414-kasan-gce-root
2018/11/21 01:53 android-4.14 4e76528bd48d 9aca6b52 .config console log report ci-android-414-kasan-gce-root
2018/11/21 00:08 android-4.14 4e76528bd48d 9aca6b52 .config console log report ci-android-414-kasan-gce-root
2018/11/20 14:27 android-4.14 4e76528bd48d 9bc2a903 .config console log report ci-android-414-kasan-gce-root
2018/11/19 09:26 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/19 05:12 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/18 18:42 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/18 14:22 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/17 22:26 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/16 04:01 android-4.14 4e76528bd48d 3a41052e .config console log report ci-android-414-kasan-gce-root
2018/11/16 02:06 android-4.14 4e76528bd48d 3a41052e .config console log report ci-android-414-kasan-gce-root
2018/11/15 20:01 android-4.14 4e76528bd48d 3a41052e .config console log report ci-android-414-kasan-gce-root
2018/11/15 11:53 android-4.14 4e76528bd48d 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/15 02:50 android-4.14 4e76528bd48d 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/14 20:45 android-4.14 4e76528bd48d 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/14 16:44 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/14 06:17 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/13 22:25 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/13 16:40 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/13 14:16 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/13 10:36 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/13 01:03 android-4.14 97c308ca4091 74dbb806 .config console log report ci-android-414-kasan-gce-root
2018/11/12 06:23 android-4.14 494c2659e60e 7b5f8621 .config console log report ci-android-414-kasan-gce-root
2018/11/11 22:38 android-4.14 494c2659e60e 7b5f8621 .config console log report ci-android-414-kasan-gce-root
2018/11/11 20:08 android-4.14 494c2659e60e 7b5f8621 .config console log report ci-android-414-kasan-gce-root
2018/11/11 11:04 android-4.14 494c2659e60e f3c4e618 .config console log report ci-android-414-kasan-gce-root
2018/11/11 07:40 android-4.14 494c2659e60e f3c4e618 .config console log report ci-android-414-kasan-gce-root
2018/08/30 04:00 android-4.14 47350a9f13c6 6c7e9d3d .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.