syzbot

 sign-in | mailing list | source | docs
🐞 Open [1637]
≡ Subsystems
🐞 Fixed [6115]
🐞 Invalid [15318]
⬇ Missing Backports [169]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: use-after-free Read in __vb2_perform_fileio

Status: fixed on 2019/06/14 18:22
Reported-by: syzbot+4180ff9ca6810b06c1e9@syzkaller.appspotmail.com
Fix commit: d65842f7126a media: vb2: add waiting_in_dqbuf flag
First crash: 2342d, last: 2152d
Cause bisection: introduced by (bisect log) :
commit f2fe89061d79706eca5c47e4efdc09bbc171e74a
Author: Helen Koike <helen.koike@collabora.com>
Date: Fri Apr 7 17:55:19 2017 +0000

  [media] vimc: Virtual Media Controller core, capture and sensor

Crash: INFO: task hung in vivid_stop_generating_vid_cap (log)
Repro: C syz .config
  
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.19 000/276] 4.19.47-stable review 304 (304) 2019/06/06 19:22
[PATCH 5.0 000/346] 5.0.20-stable review 355 (355) 2019/05/31 14:18
[PATCH 5.1 000/405] 5.1.6-stable review 414 (414) 2019/05/31 14:16
KASAN: use-after-free Read in __vb2_perform_fileio 0 (2) 2019/04/09 21:18
[PATCHv2 0/4] vb2: fix syzkaller race conditions 12 (12) 2019/01/25 05:07
[PATCH] media: videobuf2-core: Fix error handling when fileio is deallocated 4 (4) 2018/11/13 17:38
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in __vb2_perform_fileio C done 13 1946d 2175d 1/1 fixed on 2019/12/30 15:48
linux-4.14 KASAN: use-after-free Read in __vb2_perform_fileio C 454 754d 2173d 0/1 upstream: reported C repro on 2019/04/16 13:50

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in __vb2_perform_fileio+0x1065/0x1140 drivers/media/common/videobuf2/videobuf2-core.c:2613
Read of size 4 at addr ffff88809ecb5e5c by task syz-executor808/8125

CPU: 0 PID: 8125 Comm: syz-executor808 Not tainted 5.1.0+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
 __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131
 __vb2_perform_fileio+0x1065/0x1140 drivers/media/common/videobuf2/videobuf2-core.c:2613
 vb2_read+0x3b/0x50 drivers/media/common/videobuf2/videobuf2-core.c:2724
 vb2_fop_read+0x212/0x410 drivers/media/common/videobuf2/videobuf2-v4l2.c:1090
 v4l2_read+0x1ce/0x230 drivers/media/v4l2-core/v4l2-dev.c:317
 __vfs_read+0x8d/0x110 fs/read_write.c:416
 vfs_read+0x194/0x3e0 fs/read_write.c:452
 ksys_read+0x14f/0x2d0 fs/read_write.c:579
 __do_sys_read fs/read_write.c:589 [inline]
 __se_sys_read fs/read_write.c:587 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:587
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x444f09
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b cd fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc946edaf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444f09
RDX: 0000000000000052 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 000000000000d1e1 R08: 0000000000000004 R09: 00000000004002e0
R10: 000000000000000f R11: 0000000000000246 R12: 00000000004020a0
R13: 0000000000402130 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 8125:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_kmalloc mm/kasan/common.c:489 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:503
 kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3586
 kmalloc include/linux/slab.h:547 [inline]
 kzalloc include/linux/slab.h:742 [inline]
 __vb2_init_fileio+0x1cb/0xbe0 drivers/media/common/videobuf2/videobuf2-core.c:2458
 __vb2_perform_fileio+0xc01/0x1140 drivers/media/common/videobuf2/videobuf2-core.c:2592
 vb2_read+0x3b/0x50 drivers/media/common/videobuf2/videobuf2-core.c:2724
 vb2_fop_read+0x212/0x410 drivers/media/common/videobuf2/videobuf2-v4l2.c:1090
 v4l2_read+0x1ce/0x230 drivers/media/v4l2-core/v4l2-dev.c:317
 __vfs_read+0x8d/0x110 fs/read_write.c:416
 vfs_read+0x194/0x3e0 fs/read_write.c:452
 ksys_read+0x14f/0x2d0 fs/read_write.c:579
 __do_sys_read fs/read_write.c:589 [inline]
 __se_sys_read fs/read_write.c:587 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:587
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 8127:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
 __cache_free mm/slab.c:3463 [inline]
 kfree+0xcf/0x230 mm/slab.c:3786
 __vb2_cleanup_fileio+0x100/0x170 drivers/media/common/videobuf2/videobuf2-core.c:2551
 vb2_core_queue_release+0x20/0x80 drivers/media/common/videobuf2/videobuf2-core.c:2274
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:864 [inline]
 _vb2_fop_release+0x1cf/0x2a0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1035
 vb2_fop_release+0x75/0xc0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1049
 vivid_fop_release+0x18e/0x430 drivers/media/platform/vivid/vivid-core.c:475
 v4l2_release+0x224/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:456
 __fput+0x2e5/0x8d0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x90a/0x2fa0 kernel/exit.c:876
 do_group_exit+0x135/0x370 kernel/exit.c:980
 __do_sys_exit_group kernel/exit.c:991 [inline]
 __se_sys_exit_group kernel/exit.c:989 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:989
 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88809ecb5b40
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 796 bytes inside of
 1024-byte region [ffff88809ecb5b40, ffff88809ecb5f40)
The buggy address belongs to the page:
page:ffffea00027b2d00 count:1 mapcount:0 mapping:ffff8880aa400ac0 index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea00024c4d08 ffffea00023bf808 ffff8880aa400ac0
raw: 0000000000000000 ffff88809ecb4040 0000000100000007 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809ecb5d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809ecb5d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88809ecb5e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff88809ecb5e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809ecb5f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================

Crashes (786):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/08 07:27 upstream 8ff468c29e9a a7383bfa .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/05/08 05:28 upstream 8ff468c29e9a a7383bfa .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/05/08 03:40 upstream 8ff468c29e9a a7383bfa .config console log report syz C ci-upstream-kasan-gce
2019/05/08 02:33 upstream 8ff468c29e9a a7383bfa .config console log report syz C ci-upstream-kasan-gce-root
2019/05/03 21:17 upstream a4ccb5f9dc6c d28f4ce5 .config console log report syz C ci-upstream-kasan-gce-root
2019/05/03 21:14 upstream a4ccb5f9dc6c d28f4ce5 .config console log report syz C ci-upstream-kasan-gce
2019/05/03 21:14 upstream a4ccb5f9dc6c d28f4ce5 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/05/03 20:57 upstream a4ccb5f9dc6c d28f4ce5 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/05/03 15:13 upstream ea9866793d1e 1bfa09b9 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/05/03 15:12 upstream ea9866793d1e 1bfa09b9 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/05/03 14:44 upstream ea9866793d1e 1bfa09b9 .config console log report syz C ci-upstream-kasan-gce-root
2019/05/03 14:42 upstream ea9866793d1e 1bfa09b9 .config console log report syz C ci-upstream-kasan-gce
2019/04/30 17:32 upstream 83a50840e72a 20f16bef .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/30 16:55 upstream 83a50840e72a 20f16bef .config console log report syz C ci-upstream-kasan-gce-root
2019/04/30 16:55 upstream 83a50840e72a 20f16bef .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/28 19:51 upstream 9520b5324b0e b617407b .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/28 17:50 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/28 17:46 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce
2019/04/28 17:41 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-root
2019/04/28 12:01 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-root
2019/04/28 07:16 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/28 07:01 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/28 06:24 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce
2019/04/26 15:42 upstream 8113a85f8720 b617407b .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/26 15:38 upstream 8113a85f8720 b617407b .config console log report syz C ci-upstream-kasan-gce
2019/04/26 15:37 upstream 8113a85f8720 b617407b .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/26 15:36 upstream 8113a85f8720 b617407b .config console log report syz C ci-upstream-kasan-gce-root
2019/04/23 12:55 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce
2019/04/23 12:24 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-root
2019/04/23 12:08 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/23 11:46 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/23 10:15 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce
2019/04/23 08:35 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/23 08:29 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/23 08:20 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-root
2019/04/23 00:08 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-root
2019/04/23 00:06 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/22 23:35 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce
2019/03/09 23:51 upstream 38e7571c07be 12365b99 .config console log report syz C ci-upstream-kasan-gce
2019/05/08 02:37 upstream 8ff468c29e9a a7383bfa .config console log report syz C ci-upstream-kasan-gce-386
2019/05/03 21:20 upstream a4ccb5f9dc6c d28f4ce5 .config console log report syz C ci-upstream-kasan-gce-386
2019/05/03 14:42 upstream ea9866793d1e 1bfa09b9 .config console log report syz C ci-upstream-kasan-gce-386
2019/04/30 16:54 upstream 83a50840e72a 20f16bef .config console log report syz C ci-upstream-kasan-gce-386
2019/04/28 17:47 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-386
2019/04/28 06:28 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-386
2019/04/26 15:43 upstream 8113a85f8720 b617407b .config console log report syz C ci-upstream-kasan-gce-386
2019/04/23 12:02 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-386
2019/04/22 23:34 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-386
2019/04/23 12:45 linux-next 3f018f4a019a 53199d6e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/04/23 08:18 linux-next 3f018f4a019a 53199d6e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/04/22 23:32 linux-next 3f018f4a019a 53199d6e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/10/29 10:57 linux-next 8c60c36d0b8c 9ca2afa1 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/05/03 22:40 upstream a4ccb5f9dc6c d28f4ce5 .config console log report ci-upstream-kasan-gce-root
2019/05/03 13:58 upstream ea9866793d1e 1bfa09b9 .config console log report ci-upstream-kasan-gce-selinux-root
2019/05/01 09:34 upstream f2bc9c908dfe 618456b4 .config console log report ci-upstream-kasan-gce
2019/05/01 04:58 upstream bf3bd966dfd7 618456b4 .config console log report ci-upstream-kasan-gce-smack-root
2019/04/27 18:02 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/27 04:41 upstream d0473f978e61 b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/26 04:02 upstream 8113a85f8720 b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/24 04:23 upstream 7142eaa58b49 4d3d6a50 .config console log report ci-upstream-kasan-gce-root
2019/04/23 09:36 upstream 085b7755808a 53199d6e .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/22 21:36 upstream 085b7755808a 53199d6e .config console log report ci-upstream-kasan-gce
2019/04/18 18:10 upstream e53f31bffe1d b0e8efcb .config console log report ci-upstream-kasan-gce-smack-root
2019/04/16 21:17 upstream b5de3c5026f5 505ab413 .config console log report ci-upstream-kasan-gce-root
2019/04/16 19:08 upstream 618d919cae2f 505ab413 .config console log report ci-upstream-kasan-gce
2019/04/16 01:39 upstream 5512320c9f6f 505ab413 .config console log report ci-upstream-kasan-gce
2019/04/15 04:17 upstream dc4060a5dc25 505ab413 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/14 16:08 upstream 4443f8e6ac77 505ab413 .config console log report ci-upstream-kasan-gce-smack-root
2019/04/14 11:53 upstream 4443f8e6ac77 505ab413 .config console log report ci-upstream-kasan-gce-smack-root
2019/04/13 12:39 upstream 6d0a598489ca c402d8f1 .config console log report ci-upstream-kasan-gce
2019/04/11 01:37 upstream 771acc7e4a6e e955ac50 .config console log report ci-upstream-kasan-gce-root
2019/04/08 06:29 upstream fcf88917dd43 c34fde03 .config console log report ci-upstream-kasan-gce
2019/04/07 22:48 upstream 3b0468914708 c34fde03 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/07 16:51 upstream 3b0468914708 c34fde03 .config console log report ci-upstream-kasan-gce-root
2019/04/06 20:53 upstream f654f0fc0bd3 c34fde03 .config console log report ci-upstream-kasan-gce-root
2019/04/06 17:54 upstream f654f0fc0bd3 c34fde03 .config console log report ci-upstream-kasan-gce
2019/04/05 19:02 upstream ea2cec24c8d4 40f2363e .config console log report ci-upstream-kasan-gce-root
2019/04/05 03:59 upstream 8e22ba96d44c e5d1b3ac .config console log report ci-upstream-kasan-gce-smack-root
2019/04/05 02:53 upstream 8e22ba96d44c e5d1b3ac .config console log report ci-upstream-kasan-gce
2019/04/04 11:13 upstream 145f47c7381d 6a475fff .config console log report ci-upstream-kasan-gce-root
2019/05/02 22:36 upstream b7a5b22b0547 e9039493 .config console log report ci-upstream-kasan-gce-386
2019/04/25 13:00 upstream cd8dead0c394 8e3c52b1 .config console log report ci-upstream-kasan-gce-386
2019/04/24 15:33 upstream ba25b50d582f 8e3c52b1 .config console log report ci-upstream-kasan-gce-386
2019/04/20 16:40 upstream 371dd432ab39 b0e8efcb .config console log report ci-upstream-kasan-gce-386
2019/04/14 01:48 upstream 6d0a598489ca c402d8f1 .config console log report ci-upstream-kasan-gce-386
2019/04/12 14:53 upstream 2d06b235815e 8916f5e1 .config console log report ci-upstream-kasan-gce-386
2019/04/07 06:37 upstream faac51ddac45 c34fde03 .config console log report ci-upstream-kasan-gce-386
2019/04/05 09:38 upstream 8e22ba96d44c e5d1b3ac .config console log report ci-upstream-kasan-gce-386
2019/04/18 12:23 linux-next 3f018f4a019a b0e8efcb .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/17 08:01 linux-next a74942526152 b0e8efcb .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/14 23:54 linux-next bcb67f0fbce9 505ab413 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/09 18:11 linux-next cfd24a53adb8 995065ff .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 20:16 linux-next ac5b84a1ffe9 0dfb0452 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.