KASAN: use-after-free Read in virtqueue_add

Status: upstream: reported C repro on 2021/06/13 11:51
Reported-by: syzbot+b140ec75bd5a047c7362@syzkaller.appspotmail.com
First crash: 1886d, last: 643d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in virtqueue_add (3) virt 7 13 1377d 1669d 0/29 auto-obsoleted due to no activity on 2023/02/12 03:53
upstream KMSAN: uninit-value in virtqueue_add (5) virt 7 170 788d 788d 0/29 auto-obsoleted due to no activity on 2024/08/23 15:10
upstream KASAN: slab-use-after-free Read in virtqueue_add virt prio:high 19 1 7d19h 2d11h 0/29 moderation: reported on 2026/08/10 00:24
upstream KMSAN: kernel-infoleak in _copy_to_iter (8) mm 21 syz, C 21180 1160d 1255d 22/29 fixed on 2023/06/08 14:41
upstream KMSAN: uninit-value in virtqueue_add (4) mm 7 syz, C 203184 792d 953d 25/29 fixed on 2024/06/11 10:02
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2026/06/15 18:43 1h08m retest repro android12-5.4 error
2026/03/16 09:49 3m retest repro android12-5.4 error
2026/01/05 09:26 12m retest repro android12-5.4 error
2025/10/27 02:28 13m retest repro android12-5.4 error
2025/08/16 02:47 23m retest repro android12-5.4 error
2025/06/05 07:50 14m retest repro android12-5.4 error
2025/03/27 07:00 15m retest repro android12-5.4 log
2025/01/15 18:29 31m retest repro android12-5.4 error
2024/11/06 18:00 21m retest repro android12-5.4 report log
2024/08/28 00:43 21m retest repro android12-5.4 report log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in virtqueue_add+0x3603/0x3dd0 drivers/virtio/virtio_ring.c:1704
Read of size 1 at addr ffff8881e1690138 by task systemd/1

CPU: 0 PID: 1 Comm: systemd Not tainted 5.4.125-syzkaller-00121-g83ffd1a84016 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x24e lib/dump_stack.c:118
 print_address_description+0x9b/0x650 mm/kasan/report.c:384
 __kasan_report+0x182/0x260 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:641
 virtqueue_add+0x3603/0x3dd0 drivers/virtio/virtio_ring.c:1704
 virtqueue_add_sgs+0x112/0x130 drivers/virtio/virtio_ring.c:1740
 __virtscsi_add_cmd drivers/scsi/virtio_scsi.c:447 [inline]
 virtscsi_add_cmd+0x52b/0x680 drivers/scsi/virtio_scsi.c:481
 virtscsi_queuecommand+0x34d/0x590 drivers/scsi/virtio_scsi.c:578
 scsi_dispatch_cmd+0x2f0/0x6e0 drivers/scsi/scsi_lib.c:1566
 scsi_queue_rq+0x1c53/0x2720 drivers/scsi/scsi_lib.c:1701
 blk_mq_dispatch_rq_list+0x90c/0x17e0 block/blk-mq.c:1297
 blk_mq_do_dispatch_sched+0x313/0x3f0 block/blk-mq-sched.c:124
 blk_mq_sched_dispatch_requests+0x4e3/0x5e0 block/blk-mq-sched.c:220
 __blk_mq_run_hw_queue+0x142/0x260 block/blk-mq.c:1428
 __blk_mq_delay_run_hw_queue+0x22c/0x570 block/blk-mq.c:1496
 blk_mq_run_hw_queue+0x284/0x3a0 block/blk-mq.c:1533
 blk_mq_sched_insert_requests+0x227/0x370 block/blk-mq-sched.c:485
 blk_mq_flush_plug_list+0x858/0xa80 block/blk-mq.c:1801
 blk_flush_plug_list+0x4b0/0x500 block/blk-core.c:1787
 blk_finish_plug+0x5a/0x80 block/blk-core.c:1804
 read_pages+0x3a9/0x400 mm/readahead.c:142
 __do_page_cache_readahead+0x470/0x510 mm/readahead.c:212
 ra_submit mm/internal.h:62 [inline]
 do_sync_mmap_readahead mm/filemap.c:2441 [inline]
 filemap_fault+0xb09/0x19c0 mm/filemap.c:2527
 ext4_filemap_fault+0x7b/0x90 fs/ext4/inode.c:6416
 __do_fault mm/memory.c:3196 [inline]
 do_read_fault mm/memory.c:3596 [inline]
 do_fault mm/memory.c:3725 [inline]
 handle_pte_fault mm/memory.c:3956 [inline]
 __handle_mm_fault mm/memory.c:4080 [inline]
 handle_mm_fault+0x29c3/0x42f0 mm/memory.c:4117
 do_user_addr_fault+0x4a0/0xb40 arch/x86/mm/fault.c:1469
 page_fault+0x2f/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0033:0x7fd99640b21d
Code: Bad RIP value.
RSP: 002b:00007ffdd4d85810 EFLAGS: 00010207
RAX: 0000000000000001 RBX: 000056010a4a6d10 RCX: 00007fd994d3e303
RDX: 0000000000000001 RSI: 00007ffdd4d85810 RDI: 0000000000000000
RBP: 00007ffdd4d85ac0 R08: 431bde82d7b634db R09: 0000000000000bd0
R10: 00000000ffffffff R11: 0000000000000000 R12: 00007ffdd4d85810
R13: 0000000000000001 R14: ffffffffffffffff R15: 0000000000000002

Allocated by task 341:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x137/0x1e0 mm/kasan/common.c:517
 kmem_cache_alloc_trace+0x139/0x2b0 mm/slub.c:2848
 kmalloc include/linux/slab.h:556 [inline]
 __vring_new_virtqueue+0x141/0xd40 drivers/virtio/virtio_ring.c:2071
 vring_create_virtqueue_split drivers/virtio/virtio_ring.c:894 [inline]
 vring_create_virtqueue+0x1830/0x1d00 drivers/virtio/virtio_ring.c:2152
 setup_vq+0x161/0x370 drivers/virtio/virtio_pci_legacy.c:137
 vp_setup_vq+0xbc/0x330 drivers/virtio/virtio_pci_common.c:189
 vp_find_vqs_msix+0x88b/0xc40 drivers/virtio/virtio_pci_common.c:323
 vp_find_vqs+0x45/0x4a0 drivers/virtio/virtio_pci_common.c:400
 virtio_find_vqs include/linux/virtio_config.h:197 [inline]
 virtscsi_init+0x490/0xa60 drivers/scsi/virtio_scsi.c:807
 virtscsi_restore+0xe2/0xe90 drivers/scsi/virtio_scsi.c:941
 virtio_device_restore+0x39c/0x5a0 drivers/virtio/virtio.c:413
 dpm_run_callback drivers/base/power/main.c:487 [inline]
 device_resume+0x543/0x910 drivers/base/power/main.c:1029
 async_resume+0x23/0x170 drivers/base/power/main.c:1049
 async_run_entry_fn+0xea/0x3c0 kernel/async.c:123
 process_one_work+0x679/0x1030 kernel/workqueue.c:2277
 worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
 kthread+0x30f/0x330 kernel/kthread.c:268
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Freed by task 351:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:333 [inline]
 __kasan_slab_free+0x18a/0x240 mm/kasan/common.c:475
 slab_free_hook mm/slub.c:1454 [inline]
 slab_free_freelist_hook+0x7b/0x150 mm/slub.c:1492
 slab_free mm/slub.c:3072 [inline]
 kfree+0xe0/0x660 mm/slub.c:4061
 vp_del_vq drivers/virtio/virtio_pci_common.c:221 [inline]
 vp_del_vqs+0x37c/0x8c0 drivers/virtio/virtio_pci_common.c:243
 virtscsi_remove_vqs drivers/scsi/virtio_scsi.c:772 [inline]
 virtscsi_freeze+0x8d/0xa0 drivers/scsi/virtio_scsi.c:931
 virtio_pci_freeze+0x39/0x70 drivers/virtio/virtio_pci_common.c:466
 pci_pm_suspend+0x2dc/0x910 drivers/pci/pci-driver.c:789
 dpm_run_callback drivers/base/power/main.c:487 [inline]
 __device_suspend+0x84c/0x1300 drivers/base/power/main.c:1816
 async_suspend+0x25/0x1f0 drivers/base/power/main.c:1848
 async_run_entry_fn+0xea/0x3c0 kernel/async.c:123
 process_one_work+0x679/0x1030 kernel/workqueue.c:2277
 worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
 kthread+0x30f/0x330 kernel/kthread.c:268
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff8881e1690100
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 56 bytes inside of
 192-byte region [ffff8881e1690100, ffff8881e16901c0)
The buggy address belongs to the page:
page:ffffea000785a400 refcount:1 mapcount:0 mapping:ffff8881f5c02a00 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 ffffea0007885240 0000000400000004 ffff8881f5c02a00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x19a/0x380 mm/page_alloc.c:2171
 get_page_from_freelist+0x550/0x8b0 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x3a2/0x880 mm/page_alloc.c:4855
 alloc_slab_page+0x39/0x3e0 mm/slub.c:342
 allocate_slab mm/slub.c:1675 [inline]
 new_slab+0x97/0x460 mm/slub.c:1741
 new_slab_objects mm/slub.c:2498 [inline]
 ___slab_alloc+0x330/0x4c0 mm/slub.c:2659
 __slab_alloc mm/slub.c:2699 [inline]
 slab_alloc_node mm/slub.c:2784 [inline]
 slab_alloc mm/slub.c:2829 [inline]
 kmem_cache_alloc_trace+0x199/0x2b0 mm/slub.c:2846
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:690 [inline]
 kernfs_fop_open+0x321/0xad0 fs/kernfs/file.c:647
 do_dentry_open+0x949/0x1100 fs/open.c:796
 do_last fs/namei.c:3495 [inline]
 path_openat+0x1127/0x3da0 fs/namei.c:3612
 do_filp_open+0x208/0x450 fs/namei.c:3642
 do_sys_open+0x383/0x7c0 fs/open.c:1113
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare+0x1a9/0x270 mm/page_alloc.c:1233
 free_unref_page_prepare mm/page_alloc.c:3085 [inline]
 free_unref_page mm/page_alloc.c:3134 [inline]
 free_the_page mm/page_alloc.c:4915 [inline]
 __free_pages+0x9c/0x250 mm/page_alloc.c:4923
 selinux_genfs_get_sid security/selinux/hooks.c:1367 [inline]
 inode_doinit_with_dentry+0xb34/0x11d0 security/selinux/hooks.c:1562
 security_d_instantiate+0xa5/0x100 security/security.c:1882
 d_splice_alias+0x71/0x590 fs/dcache.c:3010
 kernfs_iop_lookup+0x17a/0x1f0 fs/kernfs/dir.c:1104
 __lookup_slow+0x2f8/0x450 fs/namei.c:1748
 lookup_slow fs/namei.c:1765 [inline]
 walk_component+0x3e1/0x960 fs/namei.c:1885
 lookup_last fs/namei.c:2348 [inline]
 path_lookupat+0x219/0xa40 fs/namei.c:2393
 filename_lookup+0x223/0x6a0 fs/namei.c:2423
 user_path_at include/linux/namei.h:49 [inline]
 do_faccessat+0x323/0x7a0 fs/open.c:398
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8881e1690000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881e1690080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881e1690100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff8881e1690180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8881e1690200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/06/13 16:00 android12-5.4 83ffd1a84016 1ba81399 .config console log report syz C ci2-android-5-4-kasan KASAN: use-after-free Read in virtqueue_add
2021/06/13 11:50 android12-5.4 83ffd1a84016 1ba81399 .config console log report info ci2-android-5-4-kasan KASAN: use-after-free Read in virtqueue_add
* Struck through repros no longer work on HEAD.