syzbot


KASAN: use-after-free Read in packet_rcv (2)

Status: upstream: reported syz repro on 2021/12/04 22:14
Reported-by: syzbot+4f9a765a5eec1d48d32a@syzkaller.appspotmail.com
First crash: 920d, last: 466d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in packet_rcv 1 1615d 1615d 0/1 auto-closed as invalid on 2020/05/09 17:47
android-414 KASAN: use-after-free Read in packet_rcv 1 1994d 1886d 0/1 auto-closed as invalid on 2019/06/25 08:50
linux-4.14 KASAN: use-after-free Read in packet_rcv (2) 1 1284d 1284d 0/1 auto-closed as invalid on 2021/04/05 18:49
linux-4.14 KASAN: use-after-free Read in packet_rcv 1 1685d 1685d 0/1 auto-closed as invalid on 2020/02/29 00:45

Sample crash report:
ieee802154 phy0 wpan0: encryption failed: -22
ieee802154 phy1 wpan1: encryption failed: -22
==================================================================
BUG: KASAN: use-after-free in packet_rcv+0x5aa/0x1490 net/packet/af_packet.c:2104
Read of size 1 at addr ffff8880afc5886c by task syz-executor.1/22271

CPU: 0 PID: 22271 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load1_noabort+0x88/0x90 mm/kasan/report.c:430
 packet_rcv+0x5aa/0x1490 net/packet/af_packet.c:2104
 deliver_skb net/core/dev.c:1956 [inline]
 dev_queue_xmit_nit+0x24d/0xa20 net/core/dev.c:2012
 xmit_one net/core/dev.c:3252 [inline]
 dev_hard_start_xmit+0xaa/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 hsr_xmit net/hsr/hsr_forward.c:237 [inline]
 hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
 hsr_forward_skb+0xd2d/0x1c30 net/hsr/hsr_forward.c:373
 send_hsr_supervision_frame+0x917/0xf70 net/hsr/hsr_device.c:321
 hsr_announce+0x125/0x3a0 net/hsr/hsr_device.c:350
 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1696 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
Code: 48 c7 c0 88 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d 7c 31 d8 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 fb eb e6 f8 eb c0 0f 0b 0f 0b 48 c7 c7 88
RSP: 0018:ffff888093d6f930 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3051 RBX: 0000000000000286 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffff8880b16fcd08 RDI: 0000000000000286
RBP: ffffffff89f888d8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88813be45200 R15: 0000000000000120
 __rcu_read_unlock+0x158/0x160 kernel/rcu/tree_plugin.h:428
 rcu_read_unlock include/linux/rcupdate.h:680 [inline]
 is_bpf_text_address+0xdf/0x1b0 kernel/bpf/core.c:548
 kernel_text_address kernel/extable.c:152 [inline]
 kernel_text_address+0xbd/0xf0 kernel/extable.c:122
 __kernel_text_address+0x9/0x30 kernel/extable.c:107
 unwind_get_return_address arch/x86/kernel/unwind_orc.c:297 [inline]
 unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:292
 __save_stack_trace+0xaf/0x190 arch/x86/kernel/stacktrace.c:45
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
 kmem_cache_alloc+0x122/0x370 mm/slab.c:3559
 __d_alloc+0x2b/0xa10 fs/dcache.c:1612
 d_alloc_pseudo+0x19/0x70 fs/dcache.c:1743
 alloc_file_pseudo+0xc6/0x250 fs/file_table.c:224
 create_pipe_files+0x3e7/0x7f0 fs/pipe.c:779
 __do_pipe_flags fs/pipe.c:810 [inline]
 do_pipe2+0x96/0x1b0 fs/pipe.c:858
 __do_sys_pipe fs/pipe.c:881 [inline]
 __se_sys_pipe fs/pipe.c:879 [inline]
 __x64_sys_pipe+0x2f/0x40 fs/pipe.c:879
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff2ab3cd0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff2aa6bb168 EFLAGS: 00000246 ORIG_RAX: 0000000000000016
RAX: ffffffffffffffda RBX: 00007ff2ab4ed2c0 RCX: 00007ff2ab3cd0f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ff2ab428ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd2122c64f R14: 00007ff2aa6bb300 R15: 0000000000022000

Allocated by task 22267:
 __do_kmalloc mm/slab.c:3727 [inline]
 __kmalloc+0x15a/0x3c0 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 sk_prot_alloc+0x1e2/0x2d0 net/core/sock.c:1483
 sk_alloc+0x36/0xec0 net/core/sock.c:1537
 packet_create+0x117/0x850 net/packet/af_packet.c:3259
 __sock_create+0x3d8/0x740 net/socket.c:1365
 sock_create net/socket.c:1416 [inline]
 __sys_socket+0xef/0x200 net/socket.c:1458
 __do_sys_socket net/socket.c:1467 [inline]
 __se_sys_socket net/socket.c:1465 [inline]
 __x64_sys_socket+0x6f/0xb0 net/socket.c:1465
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 22265:
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 sk_prot_free net/core/sock.c:1520 [inline]
 __sk_destruct+0x684/0x8a0 net/core/sock.c:1602
 sk_destruct net/core/sock.c:1617 [inline]
 __sk_free+0x165/0x3b0 net/core/sock.c:1628
 sk_free+0x3b/0x50 net/core/sock.c:1639
 sock_put include/net/sock.h:1713 [inline]
 packet_release+0x890/0xb70 net/packet/af_packet.c:3088
 __sock_release+0xcd/0x2a0 net/socket.c:599
 sock_close+0x15/0x20 net/socket.c:1214
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880afc58140
 which belongs to the cache kmalloc-4096 of size 4096
The buggy address is located 1836 bytes inside of
 4096-byte region [ffff8880afc58140, ffff8880afc59140)
The buggy address belongs to the page:
page:ffffea0002bf1600 count:1 mapcount:0 mapping:ffff88813bff0dc0 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffffea0002510088 ffffea0002bf1688 ffff88813bff0dc0
raw: 0000000000000000 ffff8880afc58140 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880afc58700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880afc58780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880afc58800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff8880afc58880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880afc58900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	48 c7 c0 88 82 f1 89 	mov    $0xffffffff89f18288,%rax
   7:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   e:	fc ff df
  11:	48 c1 e8 03          	shr    $0x3,%rax
  15:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1)
  19:	75 2f                	jne    0x4a
  1b:	48 83 3d 7c 31 d8 01 	cmpq   $0x0,0x1d8317c(%rip)        # 0x1d8319f
  22:	00
  23:	74 15                	je     0x3a
  25:	48 89 df             	mov    %rbx,%rdi
  28:	57                   	push   %rdi
  29:	9d                   	popfq
* 2a:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1) <-- trapping instruction
  2f:	eb b2                	jmp    0xffffffe3
  31:	e8 fb eb e6 f8       	callq  0xf8e6ec31
  36:	eb c0                	jmp    0xfffffff8
  38:	0f 0b                	ud2
  3a:	0f 0b                	ud2
  3c:	48                   	rex.W
  3d:	c7                   	.byte 0xc7
  3e:	c7                   	(bad)
  3f:	88                   	.byte 0x88

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/04 02:26 linux-4.19.y 3f8a27f9e27b f8902b57 .config console log report syz [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2023/01/07 20:17 linux-4.19.y 3f8a27f9e27b 1dac8c7a .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/12/18 02:43 linux-4.19.y 3f8a27f9e27b 05494336 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/10/04 08:14 linux-4.19.y 3f8a27f9e27b feb56351 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/09/18 03:01 linux-4.19.y 3f8a27f9e27b dd9a85ff .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/09/04 23:43 linux-4.19.y 3f8a27f9e27b 28811d0a .config console log report info [disk image] [vmlinux] ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/07/24 23:28 linux-4.19.y 3f8a27f9e27b 22343af4 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/06/05 12:41 linux-4.19.y 3f8a27f9e27b c8857892 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/04/30 23:39 linux-4.19.y 3f8a27f9e27b 2df221f6 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/04/18 17:59 linux-4.19.y 3f8a27f9e27b 8bcc32a6 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/03/02 10:07 linux-4.19.y 3f8a27f9e27b 45a13a73 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/02/26 22:52 linux-4.19.y 3f8a27f9e27b 45a13a73 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/02/24 20:43 linux-4.19.y 3f8a27f9e27b b28851a4 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/02/11 12:25 linux-4.19.y 3f8a27f9e27b 0b33604d .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2022/01/18 17:18 linux-4.19.y 3f8a27f9e27b 731a2d23 .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
2021/12/04 22:13 linux-4.19.y 3f8a27f9e27b a617004c .config console log report info ci2-linux-4-19 KASAN: use-after-free Read in packet_rcv
* Struck through repros no longer work on HEAD.