KASAN: use-after-free Read in class_equal

Status: closed as dup on 2019/05/26 06:43
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+83c135be90fc92db7e13@syzkaller.appspotmail.com
First crash: 2630d, last: 2569d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
KASAN: slab-out-of-bounds Read in class_equal 17 syz done 45 2557d 2630d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: use-after-free Read in class_equal 1 (2) 2019/05/26 06:43

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in class_equal+0x40/0x50 /kernel/locking/lockdep.c:1579
Read of size 8 at addr ffff888088b07980 by task syz-executor.5/9715

CPU: 1 PID: 9715 Comm: syz-executor.5 Not tainted 5.2.0+ #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

Allocated by task 1102416563:
(stack is not available)

Freed by task 2290545821:
BUG: unable to handle page fault for address: ffffffff8c28b458
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 8c70067 P4D 8c70067 PUD 8c71063 PMD 0 
Thread overran stack, or stack corrupted
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9715 Comm: syz-executor.5 Not tainted 5.2.0+ #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:stack_depot_fetch+0x10/0x30 /lib/stackdepot.c:203
Code: ff ff 48 c7 c7 10 f0 d2 88 e8 6c 95 5d fe e9 d7 fe ff ff 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 60 b4 28 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00
RSP: 0018:ffff888088b07768 EFLAGS: 00010006
RAX: 00000000001fffff RBX: ffff888088b07e8c RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888088b07770 RDI: 0000000000003ff0
RBP: ffff888088b07788 R08: 000000000000001c R09: ffffed1015d244fa
R10: ffffed1015d244f9 R11: ffff8880ae9227cf R12: ffffea000222c180
R13: ffff888088b07980 R14: ffff8880aa400e00 R15: ffff888088b07e80
FS:  000055555612a940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8c28b458 CR3: 00000000a45bf000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
CR2: ffffffff8c28b458
---[ end trace 9fafb1fc6a82969c ]---
RIP: 0010:stack_depot_fetch+0x10/0x30 /lib/stackdepot.c:203
Code: ff ff 48 c7 c7 10 f0 d2 88 e8 6c 95 5d fe e9 d7 fe ff ff 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 60 b4 28 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00
RSP: 0018:ffff888088b07768 EFLAGS: 00010006
RAX: 00000000001fffff RBX: ffff888088b07e8c RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888088b07770 RDI: 0000000000003ff0
RBP: ffff888088b07788 R08: 000000000000001c R09: ffffed1015d244fa
R10: ffffed1015d244f9 R11: ffff8880ae9227cf R12: ffffea000222c180
R13: ffff888088b07980 R14: ffff8880aa400e00 R15: ffff888088b07e80
FS:  000055555612a940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8c28b458 CR3: 00000000a45bf000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (34):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/19 05:43 upstream 22051d9c4a57 7bb222f7 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/19 01:50 upstream 22051d9c4a57 7bb222f7 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/06 17:09 upstream 69bf4b6b54fb f62e1e85 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/01 07:48 upstream 6fbc7275c7a9 699d6448 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/06/21 09:06 upstream abf02e2964b3 34bf9440 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/06/21 08:34 upstream abf02e2964b3 34bf9440 .config console log report syz ci-upstream-kasan-gce-root
2019/06/16 14:52 upstream e01e060fe00d 442206d7 .config console log report syz ci-upstream-kasan-gce-root
2019/06/16 13:50 upstream e01e060fe00d 442206d7 .config console log report syz ci-upstream-kasan-gce-root
2019/06/08 08:17 upstream 79c3ba3206c7 cf9c3a50 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/06/08 01:07 upstream 16d72dd4891f ce9107d0 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/05/25 11:19 upstream c50bbf615f2f 85c57315 .config console log report syz ci-upstream-kasan-gce-root
2019/05/25 08:54 upstream c50bbf615f2f 85c57315 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/07/26 03:55 net-old 107e47cc80ec 732bc5a0 .config console log report syz ci-upstream-net-this-kasan-gce
2019/07/25 09:29 net-old 107e47cc80ec 32329ceb .config console log report syz ci-upstream-net-this-kasan-gce
2019/07/07 03:24 net-old 537de0c8ca2b f62e1e85 .config console log report syz ci-upstream-net-this-kasan-gce
2019/06/23 20:19 net-old 85f9aa7565bd 472f0082 .config console log report syz ci-upstream-net-this-kasan-gce
2019/06/07 03:02 net-old 85cb928787ea 698773cb .config console log report syz ci-upstream-net-this-kasan-gce
2019/07/25 08:52 net-next-old 31cc088a4f5d 32329ceb .config console log report syz ci-upstream-net-kasan-gce
2019/07/19 06:44 net-next-old 192f0f8e9db7 7bb222f7 .config console log report syz ci-upstream-net-kasan-gce
2019/07/06 16:44 net-next-old 23f30c41c732 f62e1e85 .config console log report syz ci-upstream-net-kasan-gce
2019/06/26 06:55 net-next-old 045df37e743c 0a8d1a96 .config console log report syz ci-upstream-net-kasan-gce
2019/06/23 19:49 net-next-old 92ad6325cb89 472f0082 .config console log report syz ci-upstream-net-kasan-gce
2019/06/21 03:44 net-next-old dca73a65a683 34bf9440 .config console log report syz ci-upstream-net-kasan-gce
2019/06/21 02:38 net-next-old dca73a65a683 34bf9440 .config console log report syz ci-upstream-net-kasan-gce
2019/06/15 09:48 net-next-old 877cd9ffbc9c 442206d7 .config console log report syz ci-upstream-net-kasan-gce
2019/06/11 06:41 net-next-old a248384e6420 0159583c .config console log report syz ci-upstream-net-kasan-gce
2019/06/08 22:39 net-next-old a6cdeeb16bff 0159583c .config console log report syz ci-upstream-net-kasan-gce
2019/06/05 14:58 net-next-old 712246bc93cb bfb4a51e .config console log report syz ci-upstream-net-kasan-gce
2019/06/05 08:23 net-next-old 712246bc93cb bfb4a51e .config console log report syz ci-upstream-net-kasan-gce
2019/07/11 08:51 linux-next a77f5c70e3d2 ff7bf04c .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/08 05:27 linux-next f9ca7f5a1eb9 f62e1e85 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/03 04:14 linux-next 4fc74c2c8af7 55565fa0 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/03 02:43 linux-next 4fc74c2c8af7 55565fa0 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/18 07:50 linux-next a125097c8410 442206d7 .config console log report syz ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.