audit: type=1400 audit(1544659794.182:10): avc: denied { associate } for pid=4223 comm="syz-executor3" name="file0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
==================================================================
BUG: KASAN: use-after-free in link_path_walk+0xd2c/0xf90 fs/namei.c:2118
Read of size 1 at addr ffff8881c8ef446a by task syz-executor0/5614
CPU: 1 PID: 5614 Comm: syz-executor0 Not tainted 4.14.87+ #22
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x11b lib/dump_stack.c:53
print_address_description+0x60/0x22b mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report.cold.6+0x11b/0x2dd mm/kasan/report.c:409
link_path_walk+0xd2c/0xf90 fs/namei.c:2118
path_lookupat.isra.11+0x1f0/0x890 fs/namei.c:2356
filename_lookup.part.19+0x177/0x370 fs/namei.c:2391
filename_lookup fs/namei.c:2384 [inline]
user_path_at_empty+0x4b/0x80 fs/namei.c:2652
user_path include/linux/namei.h:62 [inline]
do_mount+0x12c/0x26e0 fs/namespace.c:2843
SYSC_mount fs/namespace.c:3119 [inline]
SyS_mount+0xe5/0x100 fs/namespace.c:3096
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457679
RSP: 002b:00007f53c1024c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457679
RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000200000 R11: 0000000000000246 R12: 00007f53c10256d4
R13: 00000000004c2e25 R14: 00000000004d5200 R15: 00000000ffffffff
Allocated by task 5620:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc.part.1+0x4f/0xd0 mm/kasan/kasan.c:551
slab_post_alloc_hook mm/slab.h:442 [inline]
slab_alloc_node mm/slub.c:2723 [inline]
slab_alloc mm/slub.c:2731 [inline]
__kmalloc_track_caller+0x104/0x300 mm/slub.c:4288
kstrdup+0x35/0x70 mm/util.c:56
bpf_symlink+0x21/0x120 kernel/bpf/inode.c:200
vfs_symlink2+0x321/0x550 fs/namei.c:4208
SYSC_symlinkat fs/namei.c:4241 [inline]
SyS_symlinkat+0x110/0x1e0 fs/namei.c:4221
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Freed by task 5624:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:524
slab_free_hook mm/slub.c:1389 [inline]
slab_free_freelist_hook mm/slub.c:1410 [inline]
slab_free mm/slub.c:2966 [inline]
kfree+0xf5/0x310 mm/slub.c:3897
bpf_evict_inode+0x102/0x130 kernel/bpf/inode.c:381
evict+0x2cb/0x5f0 fs/inode.c:554
iput_final fs/inode.c:1516 [inline]
iput+0x373/0x8e0 fs/inode.c:1543
do_unlinkat+0x4bf/0x650 fs/namei.c:4150
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
The buggy address belongs to the object at ffff8881c8ef4468
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes inside of
8-byte region [ffff8881c8ef4468, ffff8881c8ef4470)
The buggy address belongs to the page:
page:ffffea000723bd00 count:1 mapcount:0 mapping: (null) index:0x0
flags: 0x4000000000000100(slab)
raw: 4000000000000100 0000000000000000 0000000000000000 0000000100aa00aa
raw: 0000000000000000 0000000100000001 ffff8881da803c00 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881c8ef4300: fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb
ffff8881c8ef4380: fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc
>ffff8881c8ef4400: fc fb fc fc fb fc fc fb fc fc 00 fc fc fb fc fc
^
ffff8881c8ef4480: fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb
ffff8881c8ef4500: fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc
==================================================================