KASAN: use-after-free Write in paging64_update_accessed_dirty_bits

Status: fixed on 2022/04/21 04:24
Reported-by: syzbot+6cde2282daa792c49ab8@syzkaller.appspotmail.com
Fix commit: e90518d10c7d KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
First crash: 1740d, last: 1632d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (16)
Title Replies (including bot) Last reply
[PATCH 5.18 00/67] 5.18.2-rc1 review 75 (75) 2022/06/05 07:38
[PATCH 5.17 00/75] 5.17.13-rc1 review 82 (82) 2022/06/04 19:32
[PATCH v2 0/5] x86: uaccess CMPXCHG + KVM bug fixes 15 (15) 2022/05/16 14:03
[PATCH 5.10 000/599] 5.10.110-rc1 review 628 (629) 2022/05/08 12:31
[PATCH 5.4 000/475] 5.4.189-rc1 review 485 (486) 2022/04/15 15:35
[PATCH 5.16 0000/1017] 5.16.19-rc1 review 1034 (1035) 2022/04/07 08:34
[PATCH 5.15 000/913] 5.15.33-rc1 review 932 (933) 2022/04/06 15:36
[PATCH 5.17 0000/1126] 5.17.2-rc1 review 1143 (1144) 2022/04/06 14:06
[PATCH 5.4 v2] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address 2 (2) 2022/04/05 05:11
[PATCH 5.16] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address 2 (2) 2022/04/04 14:03
[PATCH 5.4] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address 2 (2) 2022/04/04 14:02
[PATCH 5.15] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address 1 (1) 2022/04/04 13:41
[PATCH 5.10] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address 1 (1) 2022/04/04 13:41
[PATCH 0/5] x86: uaccess CMPXCHG + KVM bug fixes 15 (15) 2022/02/01 21:15
[PATCH RESEND] KVM: x86/mmu: fix UAF in paging_update_accessed_dirty_bits 7 (7) 2022/02/01 02:29
[PATCH RFC] KVM: x86/mmu: fix UAF in paging_update_accessed_dirty_bits 3 (3) 2021/12/16 00:18
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits 22 1 1927d 1927d 0/2 auto-closed as invalid on 2021/09/01 08:03
android-54 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits (2) 22 1 1778d 1778d 0/2 auto-closed as invalid on 2022/01/27 12:44
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2022/01/12 02:12 21m bisect fix android12-5.10-lts OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:86 [inline]
BUG: KASAN: use-after-free in paging64_cmpxchg_gpte arch/x86/kvm/mmu/paging_tmpl.h:181 [inline]
BUG: KASAN: use-after-free in paging64_update_accessed_dirty_bits+0x5eb/0xa60 arch/x86/kvm/mmu/paging_tmpl.h:287
Write of size 8 at addr ffff888010000000 by task syz-executor930/1017

CPU: 1 PID: 1017 Comm: syz-executor930 Not tainted 5.10.84-syzkaller-00439-ge2aed161fc26 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
 __kasan_report+0x142/0x220 mm/kasan/report.c:419
 kasan_report+0x51/0x70 mm/kasan/report.c:436
 check_region_inline mm/kasan/generic.c:135 [inline]
 kasan_check_range+0x2b6/0x2f0 mm/kasan/generic.c:186
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_write include/linux/instrumented.h:86 [inline]
 paging64_cmpxchg_gpte arch/x86/kvm/mmu/paging_tmpl.h:181 [inline]
 paging64_update_accessed_dirty_bits+0x5eb/0xa60 arch/x86/kvm/mmu/paging_tmpl.h:287
 paging64_walk_addr_generic+0xc76/0x1470 arch/x86/kvm/mmu/paging_tmpl.h:459
 paging64_walk_addr arch/x86/kvm/mmu/paging_tmpl.h:516 [inline]
 paging64_gva_to_gpa+0xd8/0x1b0 arch/x86/kvm/mmu/paging_tmpl.h:971
 kvm_mmu_gva_to_gpa_write arch/x86/kvm/x86.c:5956 [inline]
 emulator_cmpxchg_emulated+0x1b8/0x840 arch/x86/kvm/x86.c:6423
 __load_segment_descriptor+0xe18/0x1560 arch/x86/kvm/emulate.c:1767
 load_segment_descriptor arch/x86/kvm/emulate.c:1834 [inline]
 em_ltr+0xb9/0xe0 arch/x86/kvm/emulate.c:3803
 x86_emulate_insn+0xa79/0x63e0 arch/x86/kvm/emulate.c:5636
 x86_emulate_instruction+0x1087/0x2730 arch/x86/kvm/x86.c:7480
 kvm_mmu_page_fault+0x45e/0x550 arch/x86/kvm/mmu/mmu.c:5108
 handle_ept_violation+0x2e2/0x470 arch/x86/kvm/vmx/vmx.c:5366
 vmx_handle_exit+0x3b9/0xd20 arch/x86/kvm/vmx/vmx.c:6075
 vcpu_enter_guest+0x24b1/0x3a80 arch/x86/kvm/x86.c:9151
 vcpu_run+0x332/0xc20 arch/x86/kvm/x86.c:9216
 kvm_arch_vcpu_ioctl_run+0x4d7/0x9d0 arch/x86/kvm/x86.c:9433
 kvm_vcpu_ioctl+0x799/0xd70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3278
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0x115/0x190 fs/ioctl.c:739
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:739
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f1917246f79
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f19171c91f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f19172cf278 RCX: 00007f1917246f79
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007f19172cf270 R08: 0000000000000000 R09: 0000000000000000
R10: 00007f19171c9700 R11: 0000000000000246 R12: 00007f19172cf27c
R13: 00007ffd55c9f83f R14: 00007f19171c9300 R15: 0000000000022000

The buggy address belongs to the page:
page:ffffea0000400000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x10000
flags: 0x4000000000000000()
raw: 4000000000000000 ffffea0000410008 ffffea00003f0008 0000000000000000
raw: 0000000000000000 000000000000000a 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88800fffff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88800fffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888010000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888010000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888010000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/13 02:10 android12-5.10-lts e2aed161fc26 49ca1f59 .config console log report syz C ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2022/02/23 05:34 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2022/01/18 15:17 android12-5.10-lts f45f895af546 731a2d23 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/12/13 01:48 android12-5.10-lts e2aed161fc26 49ca1f59 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/12/05 18:57 android12-5.10-lts bc8ae0e2afaf a617004c .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/29 13:58 android12-5.10-lts 76698ea35fd3 63eeac02 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/28 02:22 android12-5.10-lts 76698ea35fd3 63eeac02 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/26 08:45 android12-5.10-lts 76698ea35fd3 63eeac02 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/26 02:04 android12-5.10-lts 76698ea35fd3 63eeac02 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/25 14:31 android12-5.10-lts 76698ea35fd3 545ab074 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/24 14:10 android12-5.10-lts 76698ea35fd3 545ab074 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/24 04:38 android12-5.10-lts 76698ea35fd3 545ab074 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/19 09:13 android12-5.10-lts 76698ea35fd3 31a30fc0 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/15 04:15 android12-5.10-lts 76698ea35fd3 75b04091 .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/07 09:31 android12-5.10-lts 76698ea35fd3 4c1be0be .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
2021/11/06 12:57 android12-5.10-lts 76698ea35fd3 4c1be0be .config console log report info ci2-android-5-10 KASAN: use-after-free Write in paging64_update_accessed_dirty_bits
* Struck through repros no longer work on HEAD.