KASAN: use-after-free Read in vkms_dumb

Title	Replies (including bot)	Last reply
[PATCH 5.4 000/134] 5.4.47-rc1 review	141 (141)	2021/01/28 17:06
[PATCH 4.19 000/267] 4.19.129-rc1 review	280 (280)	2020/06/30 01:36
[PATCH AUTOSEL 5.7 001/274] drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4	281 (281)	2020/06/17 17:29
[PATCH 5.6 000/161] 5.6.19-rc1 review	164 (164)	2020/06/16 17:11
[PATCH 5.7 000/163] 5.7.3-rc1 review	164 (164)	2020/06/16 15:35
[PATCH AUTOSEL 5.4 001/175] drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4	175 (175)	2020/06/08 23:18
[PATCH] drm/vkms: Hold gem object while still in-use	3 (3)	2020/05/07 01:55
KASAN: use-after-free Read in vkms_dumb_create	4 (7)	2020/04/28 18:27

Created	Duration	User	Patch	Repo	Result
2020/04/27 15:24	16m	ezequiel@vanguardiasur.com.ar	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c578ddb3	OK
2020/04/27 14:27	0m	ezequiel@vanguardiasur.com.ar	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c578ddb3	error

Created

Duration

User

Patch

Repo

Result

2020/04/27 15:24

16m

ezequiel@vanguardiasur.com.ar

patch

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c578ddb3

2020/04/27 14:27

ezequiel@vanguardiasur.com.ar

patch

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c578ddb3

error

================================================================== BUG: KASAN: use-after-free in vkms_dumb_create+0x286/0x290 drivers/gpu/drm/vkms/vkms_gem.c:142 Read of size 8 at addr ffff88809e537110 by task syz-executor.0/9558 CPU: 0 PID: 9558 Comm: syz-executor.0 Not tainted 5.7.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 vkms_dumb_create+0x286/0x290 drivers/gpu/drm/vkms/vkms_gem.c:142 drm_mode_create_dumb+0x27c/0x300 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x220/0x2f0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x4c9/0x980 drivers/gpu/drm/drm_ioctl.c:887 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x11a/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45c829 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f19a3e30c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004e2d80 RCX: 000000000045c829 RDX: 0000000020000080 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000028b R14: 00000000004d3188 R15: 00007f19a3e316d4 Allocated by task 9558: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 kmem_cache_alloc_trace+0x153/0x7d0 mm/slab.c:3551 __vkms_gem_create+0x44/0xf0 include/linux/slab.h:555 vkms_gem_create drivers/gpu/drm/vkms/vkms_gem.c:111 [inline] vkms_gem_create drivers/gpu/drm/vkms/vkms_gem.c:100 [inline] vkms_dumb_create+0x110/0x290 drivers/gpu/drm/vkms/vkms_gem.c:138 drm_mode_create_dumb+0x27c/0x300 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x220/0x2f0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x4c9/0x980 drivers/gpu/drm/drm_ioctl.c:887 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x11a/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 9558: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 drm_gem_object_free+0xf0/0x1f0 drivers/gpu/drm/drm_gem.c:983 kref_put include/linux/kref.h:65 [inline] drm_gem_object_put_unlocked drivers/gpu/drm/drm_gem.c:1017 [inline] drm_gem_object_put_unlocked+0x190/0x1c0 drivers/gpu/drm/drm_gem.c:1002 vkms_gem_create drivers/gpu/drm/vkms/vkms_gem.c:116 [inline] vkms_gem_create drivers/gpu/drm/vkms/vkms_gem.c:100 [inline] vkms_dumb_create+0x14d/0x290 drivers/gpu/drm/vkms/vkms_gem.c:138 drm_mode_create_dumb+0x27c/0x300 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x220/0x2f0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x4c9/0x980 drivers/gpu/drm/drm_ioctl.c:887 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x11a/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff88809e537000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 272 bytes inside of 1024-byte region [ffff88809e537000, ffff88809e537400) The buggy address belongs to the page: page:ffffea0002794dc0 refcount:1 mapcount:0 mapping:00000000e8234a18 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00027a3608 ffffea0002749008 ffff8880aa000c40 raw: 0000000000000000 ffff88809e537000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809e537000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809e537080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88809e537100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809e537180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809e537200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2020/04/23 05:46	upstream	c578ddb39e56	2e44d63e	.config	console log	report	syz				ci-upstream-kasan-gce-root
2020/04/23 03:44	upstream	c578ddb39e56	2e44d63e	.config	console log	report					ci-upstream-kasan-gce-root

Crashes (2):

Assets (help?)