syzbot

 sign-in | mailing list | source | docs
🐞 Open [1570]
≡ Subsystems
🐞 Fixed [5936]
🐞 Invalid [14432]
⬇ Missing Backports [102]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: use-after-free Write in irq_bypass_register_consumer

Status: fixed on 2018/08/24 18:06
Subsystems: kvm
[Documentation on labels]
Reported-by: syzbot+7ad82526b98c64c90062275162dacfa48c20dbd3@syzkaller.appspotmail.com
Fix commit: b5020a8e6b54 KVM/Eventfd: Avoid crash when assign and deassign specific eventfd in parallel.
First crash: 2699d, last: 2347d
▶ ▼ Duplicate bugs (4)
duplicates (4):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel NULL pointer dereference in irq_bypass_register_consumer kvm syz 3 2558d 2561d 0/28 closed as dup on 2018/01/26 23:25
KASAN: use-after-free Read in irq_bypass_unregister_consumer kvm C 2 2365d 2405d 0/28 closed as dup on 2018/05/26 09:22
general protection fault in eventfd_ctx_remove_wait_queue fs 1 2419d 2401d 0/28 closed as dup on 2018/05/26 09:22
KASAN: use-after-free Read in irq_bypass_register_consumer kvm C 369 2347d 2606d 0/28 closed as dup on 2018/05/26 09:22

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in __list_add include/linux/list.h:64 [inline]
BUG: KASAN: use-after-free in list_add include/linux/list.h:79 [inline]
BUG: KASAN: use-after-free in irq_bypass_register_consumer+0x51e/0x550 virt/lib/irqbypass.c:217
Write of size 8 at addr ffff8801d43688e8 by task syz-executor898/4520

CPU: 0 PID: 4520 Comm: syz-executor898 Not tainted 4.18.0-rc1+ #115
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:438
 __list_add include/linux/list.h:64 [inline]
 list_add include/linux/list.h:79 [inline]
 irq_bypass_register_consumer+0x51e/0x550 virt/lib/irqbypass.c:217
 kvm_irqfd_assign arch/x86/kvm/../../../virt/kvm/eventfd.c:417 [inline]
 kvm_irqfd+0x1511/0x1e80 arch/x86/kvm/../../../virt/kvm/eventfd.c:572
 kvm_vm_ioctl+0xf80/0x1d80 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3015
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x445619
Code: e8 4c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 51 00 00 c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007fd4aa085da8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006dac44 RCX: 0000000000445619
RDX: 00000000200015c0 RSI: 000000004020ae76 RDI: 000000000000017f
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000297 R12: 00000000006dac40
R13: 6d766b2f7665642f R14: 00007fd4aa0869c0 R15: 0000000000000005

Allocated by task 4520:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
 kmalloc include/linux/slab.h:513 [inline]
 kzalloc include/linux/slab.h:707 [inline]
 kvm_irqfd_assign arch/x86/kvm/../../../virt/kvm/eventfd.c:296 [inline]
 kvm_irqfd+0x18f/0x1e80 arch/x86/kvm/../../../virt/kvm/eventfd.c:572
 kvm_vm_ioctl+0xf80/0x1d80 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3015
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 27:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xd9/0x260 mm/slab.c:3813
 irqfd_shutdown+0x144/0x1c0 arch/x86/kvm/../../../virt/kvm/eventfd.c:148
 process_one_work+0xc73/0x1ba0 kernel/workqueue.c:2153
 worker_thread+0x189/0x13c0 kernel/workqueue.c:2296
 kthread+0x345/0x410 kernel/kthread.c:240
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412

The buggy address belongs to the object at ffff8801d4368780
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 360 bytes inside of
 512-byte region [ffff8801d4368780, ffff8801d4368980)
The buggy address belongs to the page:
page:ffffea000750da00 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0007506708 ffffea000750da48 ffff8801da800940
raw: 0000000000000000 ffff8801d4368000 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d4368780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d4368800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d4368880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff8801d4368900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d4368980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (1632):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/24 09:47 upstream 77072ca59fdd 2064fc5c .config console log report syz C ci-upstream-kasan-gce-root
2018/06/24 05:18 upstream 77072ca59fdd 2064fc5c .config console log report syz C ci-upstream-kasan-gce
2018/05/19 15:46 upstream 73fcb1a370c7 849705db .config console log report syz C ci-upstream-kasan-gce
2017/12/15 10:13 mmots 82bcf1def3b5 ac20b98c .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/11 22:37 upstream 50c4c4e268a2 da131727 .config console log report syz ci-upstream-kasan-gce
2017/11/12 03:27 upstream b39545684a90 e0a2b195 .config console log report syz ci-upstream-kasan-gce
2017/08/01 13:41 upstream bc78d646e708 864b7ea2 .config console log report syz ci-upstream-kasan-gce
2018/06/24 05:22 upstream 77072ca59fdd 2064fc5c .config console log report syz ci-upstream-kasan-gce-386
2017/09/24 15:44 upstream cd4175b11685 c26ea367 .config console log report syz ci-upstream-kasan-gce-386
2017/09/24 13:34 upstream cd4175b11685 c26ea367 .config console log report syz ci-upstream-kasan-gce-386
2017/09/19 19:43 upstream 12fcf66e74b1 d394531e .config console log report syz ci-upstream-kasan-gce-386
2017/09/19 19:31 upstream 12fcf66e74b1 d394531e .config console log report syz ci-upstream-kasan-gce-386
2017/12/11 21:46 linux-next 153e8244ebcb da131727 .config console log report syz ci-upstream-next-kasan-gce
2017/11/12 03:26 mmots 97530111c84b 00f6ff58 .config console log report syz ci-upstream-mmots-kasan-gce
2017/11/12 03:04 linux-next d9e0e63d9a6f e0a2b195 .config console log report syz ci-upstream-next-kasan-gce
2017/09/27 08:06 linux-next 045c5205823f c26ea367 .config console log report syz ci-upstream-next-kasan-gce
2017/09/12 12:13 mmots 114c278181ca 96b8e399 .config console log report syz ci-upstream-mmots-kasan-gce
2018/07/18 17:53 upstream 3c53776e29f8 809256c3 .config console log report ci-upstream-kasan-gce-root
2018/07/18 12:24 upstream 3c53776e29f8 809256c3 .config console log report ci-upstream-kasan-gce-root
2018/07/18 09:56 upstream 3c53776e29f8 6d5bd5b5 .config console log report ci-upstream-kasan-gce
2018/07/17 15:19 upstream 30b06abfb92b 13761366 .config console log report ci-upstream-kasan-gce
2018/07/17 10:26 upstream 30b06abfb92b 13761366 .config console log report ci-upstream-kasan-gce
2018/07/17 03:23 upstream 706bf68b4339 40cb0c9a .config console log report ci-upstream-kasan-gce
2018/07/16 08:47 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce-root
2018/07/16 06:54 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/16 05:04 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/16 03:35 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/16 01:19 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/15 11:40 upstream 37b5dca2898d 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/15 03:06 upstream c31496dbacc2 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/14 23:39 upstream c31496dbacc2 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/14 15:49 upstream 2db39a2f491a 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/14 03:00 upstream 9d2e34897d8d 92a49505 .config console log report ci-upstream-kasan-gce-root
2018/07/13 15:35 upstream 63f047771621 92a49505 .config console log report ci-upstream-kasan-gce
2018/07/13 06:39 upstream 63f047771621 06c33b3a .config console log report ci-upstream-kasan-gce
2018/07/12 16:26 upstream c25c74b7476e 06c33b3a .config console log report ci-upstream-kasan-gce-root
2018/07/12 15:14 upstream c25c74b7476e 06c33b3a .config console log report ci-upstream-kasan-gce
2018/07/12 04:11 upstream c25c74b7476e 2e0e3130 .config console log report ci-upstream-kasan-gce
2018/07/11 17:37 upstream 1e09177acae3 2e0e3130 .config console log report ci-upstream-kasan-gce-root
2018/07/11 15:12 upstream 1e09177acae3 2e0e3130 .config console log report ci-upstream-kasan-gce-root
2018/07/11 13:17 upstream 1e09177acae3 2e0e3130 .config console log report ci-upstream-kasan-gce
2018/07/11 08:56 upstream 30c2c32d7f70 2e0e3130 .config console log report ci-upstream-kasan-gce
2018/07/11 04:06 upstream 30c2c32d7f70 2e0e3130 .config console log report ci-upstream-kasan-gce
2018/07/10 23:36 upstream 30c2c32d7f70 2e0e3130 .config console log report ci-upstream-kasan-gce
2018/07/10 12:08 upstream 092150a25cb7 9fa03fa5 .config console log report ci-upstream-kasan-gce
2018/07/09 13:41 upstream 1e4b044d2251 f25e5770 .config console log report ci-upstream-kasan-gce
2018/07/18 06:29 upstream 3c53776e29f8 6d5bd5b5 .config console log report ci-upstream-kasan-gce-386
2018/07/17 20:34 upstream 30b06abfb92b 6d5bd5b5 .config console log report ci-upstream-kasan-gce-386
2018/07/16 14:59 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/16 12:08 upstream 9d3cce1e8b85 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/15 15:35 upstream 37b5dca2898d 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/15 08:12 upstream c31496dbacc2 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/14 20:44 upstream 2db39a2f491a 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/13 19:25 upstream 9d2e34897d8d 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/13 12:44 upstream 63f047771621 92a49505 .config console log report ci-upstream-kasan-gce-386
2018/07/13 08:32 upstream 63f047771621 06c33b3a .config console log report ci-upstream-kasan-gce-386
2018/07/13 04:51 upstream 63f047771621 06c33b3a .config console log report ci-upstream-kasan-gce-386
2018/07/10 14:37 upstream 092150a25cb7 9fa03fa5 .config console log report ci-upstream-kasan-gce-386
2018/07/16 17:31 linux-next 1d4eb636f0ab 40cb0c9a .config console log report ci-upstream-linux-next-kasan-gce-root
2018/07/14 12:25 linux-next 483d835c8189 92a49505 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/07/12 20:10 linux-next 3ee15ba60e6b 06c33b3a .config console log report ci-upstream-linux-next-kasan-gce-root
2018/07/10 21:26 linux-next 3951bd9fe3e2 2e0e3130 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/07/10 06:34 linux-next d00d6d9a339d f25e5770 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/07/09 22:18 linux-next d00d6d9a339d f25e5770 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/07/09 15:34 linux-next d00d6d9a339d f25e5770 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.