ASan: Unauthorized Access in vioscsi_scsipi_request

Status: fixed on 2019/04/13 22:14
Reported-by: syzbot+6513c4afe66237d7207f@syzkaller.appspotmail.com
Fix commit: b60093a0824f Fix use-after-free. If we're not polling, virtio_enqueue_commit() will send the transaction, and it means 'xs' can be immediately freed. So, save the value of xs_control beforehand.
First crash: 2754d, last: 2717d
▶ ▼ Duplicate bugs (1)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
ASan: Unauthorized Access In ADDR: Addr ADDR [4 bytes, read, RedZone] -1 syz 1 2755d 2755d 0/3 closed as dup on 2019/03/16 07:03

Sample crash report:
login: [ 1923.3577502] ASan: Unauthorized Access In 0xffffffff816dd96d: Addr 0xffffab8012e590b8 [4 bytes, read, PoolUseAfterFree]
[ 1923.3719931] #0 0xffffffff816dd96d in vioscsi_scsipi_request <netbsd>
[ 1923.3807320] #1 0xffffffff802898dc in scsipi_adapter_request <netbsd>
[ 1923.3897714] #2 0xffffffff80289b10 in scsipi_run_queue <netbsd>
[ 1923.3979467] #3 0xffffffff8028a90f in scsipi_execute_xs <netbsd>
[ 1923.4061239] #4 0xffffffff802a2959 in sd_diskstart <netbsd>
[ 1923.4142982] #5 0xffffffff810df566 in dk_start <netbsd>
[ 1923.4216261] #6 0xffffffff810d48c0 in spec_strategy <netbsd>
[ 1923.4296054] #7 0xffffffff810c01bf in VOP_STRATEGY <netbsd>
[ 1923.4377400] #8 0xffffffff80f0f72e in ufs_strategy <netbsd>
[ 1923.4456263] #9 0xffffffff810c01bf in VOP_STRATEGY <netbsd>
[ 1923.4533578] #10 0xffffffff81079015 in bwrite <netbsd>
[ 1923.4606307] #11 0xffffffff810bc69a in VOP_BWRITE <netbsd>
[ 1923.4688053] #12 0xffffffff80ef9c87 in ufs_dircompact.isra.5 <netbsd>
2019/04/12 10:42:27 executed programs: 15591
[ 1923.4774302] #13 0xffffffff80efa231 in ufs_direnter <netbsd>
[ 1923.4861848] #14 0xffffffff80f0e4e4 in ufs_mkdir <netbsd>
2019/04/12 10:42:32 executed programs: 15761
2019/04/12 10:42:37 executed programs: 15900

Crashes (1841):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/12 11:02 netbsd 44afb383b252 8916f5e1 console log report syz ci2-netbsd
2019/04/09 12:00 netbsd 1b93ab6a788b 995065ff console log report syz ci2-netbsd
2019/04/07 21:12 netbsd a10759f081a1 c34fde03 console log report syz ci2-netbsd
2019/04/07 18:48 netbsd a10759f081a1 c34fde03 console log report syz ci2-netbsd
2019/04/07 05:18 netbsd c2452c62ad22 c34fde03 console log report syz ci2-netbsd
2019/04/07 00:52 netbsd c2452c62ad22 c34fde03 console log report syz ci2-netbsd
2019/04/03 01:01 netbsd a4160cbcd30b dfd3394d console log report syz ci2-netbsd
2019/04/02 04:57 netbsd a56714f2dad5 a9ca43d4 console log report syz ci2-netbsd
2019/04/01 01:27 netbsd a5a5ed5ab169 ccf2355a console log report syz ci2-netbsd
2019/03/21 05:40 netbsd 779fde7bb3cc 427ea487 console log report syz ci2-netbsd
2019/03/19 14:10 netbsd 21d6506aaa91 e4549234 console log report syz ci2-netbsd
2019/03/18 19:58 netbsd b08d23a0802d 4656beca console log report syz ci2-netbsd
2019/03/18 16:51 netbsd b08d23a0802d 4656beca console log report syz ci2-netbsd
2019/03/16 20:44 netbsd a171867f43ea bab43553 console log report syz ci2-netbsd
2019/04/13 22:01 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 20:19 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 18:52 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 17:32 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 16:23 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 15:03 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 13:56 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 12:47 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 11:46 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 10:37 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 09:49 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 08:20 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 07:15 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 06:50 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 05:45 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 04:41 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 03:39 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 03:15 netbsd def13e54a57f c402d8f1 console log report ci2-netbsd
2019/04/13 01:54 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/13 00:36 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 23:26 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 22:06 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 20:00 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 19:48 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 18:38 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 17:27 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 16:18 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 15:54 netbsd 1ed788060c36 4f421599 console log report ci2-netbsd
2019/04/12 13:43 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 12:16 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 10:43 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 08:53 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 07:03 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 05:59 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 04:54 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 03:43 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 03:09 netbsd 44afb383b252 8916f5e1 console log report ci2-netbsd
2019/04/12 01:33 netbsd 0710e7fbeb51 13030ef8 console log report ci2-netbsd
2019/04/12 00:32 netbsd 0710e7fbeb51 13030ef8 console log report ci2-netbsd
2019/04/12 00:17 netbsd 0710e7fbeb51 13030ef8 console log report ci2-netbsd
2019/04/11 22:59 netbsd 0710e7fbeb51 13030ef8 console log report ci2-netbsd
2019/03/08 11:52 netbsd 57a2d3217659 12365b99 console log report ci2-netbsd
* Struck through repros no longer work on HEAD.