KASAN: invalid-free in ieee80211_ibss_leave

Status: fixed on 2021/11/10 00:50
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+93976391bf299d425f44@syzkaller.appspotmail.com
Fix commit: 3bd801b14e0c mac80211: fix double free in ibss_leave
First crash: 1994d, last: 1964d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in ieee80211_ibss_build_presp (log)
Repro: C syz .config
  
▶ ▼ Discussions (16)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.10 01/33] ARM: dts: am33xx: add aliases for mmc interfaces 35 (35) 2021/04/07 14:15
[PATCH AUTOSEL 5.11 01/38] ARM: dts: am33xx: add aliases for mmc interfaces 40 (40) 2021/04/01 02:56
[PATCH 4.4 00/33] 4.4.264-rc1 review 38 (38) 2021/03/30 07:28
[PATCH 4.9 00/53] 4.9.264-rc1 review 58 (58) 2021/03/30 07:05
[PATCH 4.14 00/59] 4.14.228-rc1 review 62 (62) 2021/03/30 06:53
[PATCH 4.19 00/72] 4.19.184-rc1 review 76 (76) 2021/03/30 06:52
[PATCH 5.4 000/111] 5.4.109-rc1 review 117 (117) 2021/03/30 05:50
[PATCH AUTOSEL 4.4 1/8] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove 8 (8) 2021/03/29 22:24
[PATCH AUTOSEL 4.9 01/10] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove 10 (10) 2021/03/29 22:24
[PATCH AUTOSEL 4.14 01/12] ARM: dts: am33xx: add aliases for mmc interfaces 12 (12) 2021/03/29 22:23
[PATCH AUTOSEL 4.19 01/15] ARM: dts: am33xx: add aliases for mmc interfaces 15 (15) 2021/03/29 22:23
[PATCH AUTOSEL 5.4 01/19] ARM: dts: am33xx: add aliases for mmc interfaces 19 (19) 2021/03/29 22:23
[PATCH 5.11 000/254] 5.11.11-rc1 review 267 (267) 2021/03/29 14:13
[PATCH 5.10 000/221] 5.10.27-rc1 review 224 (224) 2021/03/29 11:47
[PATCH] mac80211: fix double free in ibss_leave 1 (1) 2021/02/13 13:36
KASAN: invalid-free in ieee80211_ibss_leave 0 (1) 2021/02/10 16:05
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: invalid-free in ieee80211_ibss_leave 24 C 1 2118d 2118d 0/2 auto-obsoleted due to no activity on 2023/04/16 18:56
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2021/03/10 15:28 25m bisect fix upstream OK (0) job log log
▶ ▼ Cause bisection attempts (2)
Created Duration User Patch Repo Result
2021/02/21 13:23 3h34m bisect upstream OK (0) job log log
2021/02/08 08:07 0m bisect upstream error job log

Sample crash report:
==================================================================
BUG: KASAN: double-free or invalid-free in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876

CPU: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230
 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355
 ____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341
 kasan_slab_free include/linux/kasan.h:192 [inline]
 __cache_free mm/slab.c:3424 [inline]
 kfree+0xed/0x270 mm/slab.c:3760
 ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline]
 __cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212
 __cfg80211_leave+0x327/0x430 net/wireless/core.c:1172
 cfg80211_leave net/wireless/core.c:1221 [inline]
 cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 __dev_close_many+0xee/0x2e0 net/core/dev.c:1586
 __dev_close net/core/dev.c:1624 [inline]
 __dev_change_flags+0x2cb/0x730 net/core/dev.c:8476
 dev_change_flags+0x8a/0x160 net/core/dev.c:8549
 dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265
 dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511
 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060
 sock_ioctl+0x477/0x6a0 net/socket.c:1177
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446c99
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa8353b02f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004cb440 RCX: 0000000000446c99
RDX: 00000000200008c0 RSI: 0000000000008914 RDI: 0000000000000005
RBP: 00000000004cb44c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000049b07c
R13: 0031313230386c6e R14: 0ba62cdd87f75d44 R15: 00000000004cb448

Allocated by task 8465:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:401 [inline]
 ____kasan_kmalloc.constprop.0+0x7f/0xa0 mm/kasan/common.c:429
 kasan_kmalloc include/linux/kasan.h:219 [inline]
 __do_kmalloc mm/slab.c:3659 [inline]
 __kmalloc_track_caller+0x20a/0x440 mm/slab.c:3674
 kmemdup+0x23/0x50 mm/util.c:128
 kmemdup include/linux/string.h:520 [inline]
 ieee80211_ibss_join+0x8cf/0xfe0 net/mac80211/ibss.c:1824
 rdev_join_ibss net/wireless/rdev-ops.h:535 [inline]
 __cfg80211_join_ibss+0x807/0x1200 net/wireless/ibss.c:144
 nl80211_join_ibss+0xcbb/0x12b0 net/wireless/nl80211.c:10229
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 8473:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:356
 ____kasan_slab_free+0xb0/0xe0 mm/kasan/common.c:362
 kasan_slab_free include/linux/kasan.h:192 [inline]
 __cache_free mm/slab.c:3424 [inline]
 kfree+0xed/0x270 mm/slab.c:3760
 ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline]
 __cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212
 __cfg80211_leave+0x327/0x430 net/wireless/core.c:1172
 cfg80211_leave net/wireless/core.c:1221 [inline]
 cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 __dev_close_many+0xee/0x2e0 net/core/dev.c:1586
 __dev_close net/core/dev.c:1624 [inline]
 __dev_change_flags+0x2cb/0x730 net/core/dev.c:8476
 dev_change_flags+0x8a/0x160 net/core/dev.c:8549
 dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265
 dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511
 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060
 sock_ioctl+0x477/0x6a0 net/socket.c:1177
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0x87/0xb0 mm/kasan/generic.c:344
 insert_work+0x48/0x370 kernel/workqueue.c:1331
 __queue_work+0x5c1/0xf00 kernel/workqueue.c:1497
 queue_work_on+0xc7/0xd0 kernel/workqueue.c:1524
 queue_work include/linux/workqueue.h:507 [inline]
 call_usermodehelper_exec+0x1f0/0x4c0 kernel/umh.c:433
 kobject_uevent_env+0xf9f/0x1680 lib/kobject_uevent.c:617
 kobject_synth_uevent+0x701/0x850 lib/kobject_uevent.c:208
 uevent_store+0x20/0x50 drivers/base/core.c:2160
 dev_attr_store+0x50/0x80 drivers/base/core.c:1861
 sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:139
 kernfs_fop_write_iter+0x342/0x500 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write+0x426/0x650 fs/read_write.c:518
 vfs_write+0x791/0xa30 fs/read_write.c:605
 ksys_write+0x12d/0x250 fs/read_write.c:658
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Second to last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0x87/0xb0 mm/kasan/generic.c:344
 insert_work+0x48/0x370 kernel/workqueue.c:1331
 __queue_work+0x5c1/0xf00 kernel/workqueue.c:1497
 queue_work_on+0xc7/0xd0 kernel/workqueue.c:1524
 queue_work include/linux/workqueue.h:507 [inline]
 call_usermodehelper_exec+0x1f0/0x4c0 kernel/umh.c:433
 kobject_uevent_env+0xf9f/0x1680 lib/kobject_uevent.c:617
 kobject_synth_uevent+0x701/0x850 lib/kobject_uevent.c:208
 uevent_store+0x20/0x50 drivers/base/core.c:2160
 dev_attr_store+0x50/0x80 drivers/base/core.c:1861
 sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:139
 kernfs_fop_write_iter+0x342/0x500 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write+0x426/0x650 fs/read_write.c:518
 vfs_write+0x791/0xa30 fs/read_write.c:605
 ksys_write+0x12d/0x250 fs/read_write.c:658
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88801c155f00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
 192-byte region [ffff88801c155f00, ffff88801c155fc0)
The buggy address belongs to the page:
page:000000001221e238 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801c155900 pfn:0x1c155
flags: 0xfff00000000200(slab)
raw: 00fff00000000200 ffffea0000928b48 ffffea00006de508 ffff888010c40000
raw: ffff88801c155900 ffff88801c155000 000000010000000d 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801c155e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88801c155e80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801c155f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88801c155f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88801c156000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/02/08 08:07 upstream b75dba7f472c 2ce644fc .config console log report syz C ci-upstream-kasan-gce-selinux-root KASAN: invalid-free in ieee80211_ibss_leave
* Struck through repros no longer work on HEAD.