syzbot

 sign-in | mailing list | source | docs
🐞 Open [106]
🐞 Fixed [1]
🐞 Invalid [166]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in get_disk

Status: public: reported C repro on 2019/04/13 00:01
Reported-by: syzbot+a43ba1cae2dd8edc178c@syzkaller.appspotmail.com
First crash: 2270d, last: 1828d
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in get_disk 1 1932d 1931d 0/1 auto-closed as invalid on 2019/12/06 15:46
android-49 KASAN: use-after-free Read in get_disk 42 1827d 2048d 0/3 auto-closed as invalid on 2020/03/20 03:33

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1555445329.679:7): avc:  denied  { map } for  pid=1800 comm="syz-executor908" path="/root/syz-executor908997611" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: use-after-free in get_disk+0xc0/0xd0 block/genhd.c:1433
Read of size 8 at addr ffff8881cf4d1eb0 by task blkid/1806

CPU: 1 PID: 1806 Comm: blkid Not tainted 4.14.111+ #54
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 print_address_description+0x60/0x226 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0x88/0x2a5 mm/kasan/report.c:393

Allocated by task 1801:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc.part.0+0x4f/0xd0 mm/kasan/kasan.c:551
 kmem_cache_alloc_trace+0x126/0x310 mm/slub.c:2750
 kmem_cache_alloc_node_trace include/linux/slab.h:378 [inline]
 kmalloc_node include/linux/slab.h:526 [inline]
 kzalloc_node include/linux/slab.h:672 [inline]
 alloc_disk_node+0x5b/0x3d0 block/genhd.c:1387

Freed by task 1803:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:524
 slab_free_hook mm/slub.c:1389 [inline]
 slab_free_freelist_hook mm/slub.c:1410 [inline]
 slab_free mm/slub.c:2966 [inline]
 kfree+0xf5/0x310 mm/slub.c:3897
 device_release+0xf4/0x1a0 drivers/base/core.c:822

The buggy address belongs to the object at ffff8881cf4d1980
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1328 bytes inside of
 2048-byte region [ffff8881cf4d1980, ffff8881cf4d2180)
The buggy address belongs to the page:
page:ffffea00073d3400 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 0000000000000000 0000000000000000 00000001800f000f
raw: dead000000000100 dead000000000200 ffff8881da802800 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881cf4d1d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881cf4d1e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881cf4d1e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff8881cf4d1f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881cf4d1f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (48):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/16 20:13 android-4.14 efe836537cf2 505ab413 .config console log report syz C ci-android-414-kasan-gce-root
2019/11/20 02:50 android-4.14 460dc7c31cef f4b7ed07 .config console log report ci-android-414-kasan-gce-root
2019/11/17 07:12 android-4.14 460dc7c31cef d5696d51 .config console log report ci-android-414-kasan-gce-root
2019/11/10 00:32 android-4.14 81144e705f48 dc438b91 .config console log report ci-android-414-kasan-gce-root
2019/09/19 23:30 android-4.14 290dd9dfcbe8 4d3ae0b7 .config console log report ci-android-414-kasan-gce-root
2019/09/18 07:49 android-4.14 ca30356b2a26 03e0d245 .config console log report ci-android-414-kasan-gce-root
2019/08/27 02:42 android-4.14 f5189d4af2b5 d21c5d9d .config console log report ci-android-414-kasan-gce-root
2019/08/12 14:30 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/10 11:59 android-4.14 57ac921eaff1 acb51638 .config console log report ci-android-414-kasan-gce-root
2019/08/05 06:37 android-4.14 20c71e6d5a16 6affd8e8 .config console log report ci-android-414-kasan-gce-root
2019/07/26 07:32 android-4.14 4be998761675 732bc5a0 .config console log report ci-android-414-kasan-gce-root
2019/07/19 15:51 android-4.14 269f182fac0b 1656845f .config console log report ci-android-414-kasan-gce-root
2019/07/19 04:22 android-4.14 269f182fac0b 7bb222f7 .config console log report ci-android-414-kasan-gce-root
2019/06/18 16:13 android-4.14 dfb686cea779 e3f76baa .config console log report ci-android-414-kasan-gce-root
2019/06/17 14:19 android-4.14 cfee25d274dd 442206d7 .config console log report ci-android-414-kasan-gce-root
2019/06/04 10:32 android-4.14 50f99a65439b ce07a7ae .config console log report ci-android-414-kasan-gce-root
2019/05/03 07:53 android-4.14 b5123fd47340 1bfa09b9 .config console log report ci-android-414-kasan-gce-root
2019/04/23 10:36 android-4.14 fde41616bce4 53199d6e .config console log report ci-android-414-kasan-gce-root
2019/04/17 11:41 android-4.14 ff17dbeb199f b0e8efcb .config console log report ci-android-414-kasan-gce-root
2019/04/16 00:25 android-4.14 efe836537cf2 505ab413 .config console log report ci-android-414-kasan-gce-root
2019/03/19 06:44 android-4.14 ea583d160621 46264c32 .config console log report ci-android-414-kasan-gce-root
2019/03/10 19:45 android-4.14 b11964adfe4c 12365b99 .config console log report ci-android-414-kasan-gce-root
2019/03/03 22:08 android-4.14 934272e9380b 1c0e457a .config console log report ci-android-414-kasan-gce-root
2019/02/28 15:32 android-4.14 0cc8f104f45a 09aeeba4 .config console log report ci-android-414-kasan-gce-root
2019/02/27 16:43 android-4.14 0cc8f104f45a 083cfd0e .config console log report ci-android-414-kasan-gce-root
2019/02/24 05:40 android-4.14 6bdf39bb26fd 7a06e792 .config console log report ci-android-414-kasan-gce-root
2019/02/24 00:56 android-4.14 6bdf39bb26fd 7a06e792 .config console log report ci-android-414-kasan-gce-root
2019/02/03 03:09 android-4.14 80d7b06534fa c198d5dd .config console log report ci-android-414-kasan-gce-root
2019/01/27 00:06 android-4.14 70014b13c28c c73f090a .config console log report ci-android-414-kasan-gce-root
2019/01/25 05:18 android-4.14 ca20dbf407cb bfab9cd8 .config console log report ci-android-414-kasan-gce-root
2019/01/24 05:44 android-4.14 87a15f6d2289 56558f63 .config console log report ci-android-414-kasan-gce-root
2019/01/20 20:34 android-4.14 5a76363f1262 fd37a550 .config console log report ci-android-414-kasan-gce-root
2019/01/13 14:05 android-4.14 da2880fa47ec c3f3344c .config console log report ci-android-414-kasan-gce-root
2019/01/12 13:15 android-4.14 fab7352ca8d1 c3f3344c .config console log report ci-android-414-kasan-gce-root
2019/01/01 21:43 android-4.14 7d2d5fc1acda 3d85f48c .config console log report ci-android-414-kasan-gce-root
2018/12/18 14:00 android-4.14 a6424a3d08fb 4edaba93 .config console log report ci-android-414-kasan-gce-root
2018/12/11 21:08 android-4.14 e525d2cfbe65 7795ae03 .config console log report ci-android-414-kasan-gce-root
2018/12/06 10:25 android-4.14 d142f569a166 764b42c4 .config console log report ci-android-414-kasan-gce-root
2018/12/01 19:18 android-4.14 d11d7f1ccfb1 5a581673 .config console log report ci-android-414-kasan-gce-root
2018/11/30 20:42 android-4.14 51164110fa6e ade12e91 .config console log report ci-android-414-kasan-gce-root
2018/11/28 18:36 android-4.14 f544ad0b1547 4b6d14f2 .config console log report ci-android-414-kasan-gce-root
2018/11/22 01:41 android-4.14 fb396435d9dd 9db828b5 .config console log report ci-android-414-kasan-gce-root
2018/11/11 03:56 android-4.14 494c2659e60e f3c4e618 .config console log report ci-android-414-kasan-gce-root
2018/10/29 04:05 android-4.14 4ed22187defd 9ca2afa1 .config console log report ci-android-414-kasan-gce-root
2018/10/26 08:57 android-4.14 4ed22187defd a8292de9 .config console log report ci-android-414-kasan-gce-root
2018/10/24 07:59 android-4.14 ff26b00b484b a8292de9 .config console log report ci-android-414-kasan-gce-root
2018/10/16 16:42 android-4.14 48091d94336e 1ba7fd7e .config console log report ci-android-414-kasan-gce-root
2018/09/04 10:32 android-4.14 47350a9f13c6 a4718693 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.