syzbot


KASAN: use-after-free Read in fuse_dev_do_read

Status: public: reported C repro on 2019/04/14 00:00
Reported-by: syzbot+ecab654560c9adeba250@syzkaller.appspotmail.com
First crash: 2156d, last: 2072d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in fuse_dev_do_read fuse syz 19 2054d 2102d 11/27 fixed on 2018/11/12 21:25

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
BUG: KASAN: use-after-free in fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303
Read of size 8 at addr ffff8801d06e0278 by task syz-executor209/8903

CPU: 0 PID: 8903 Comm: syz-executor209 Not tainted 4.9.113-g47bbcd6 #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cf7e7968 ffffffff81eb32a9 ffffea000741b800 ffff8801d06e0278
 0000000000000000 ffff8801d06e0278 ffff8801b84aab40 ffff8801cf7e79a0
 ffffffff81567bd9 ffff8801d06e0278 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81eb32a9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb32a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81567bd9>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567fe3>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567fe3>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153bc34>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff81911917>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
 [<ffffffff81911917>] fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303
 [<ffffffff81911bce>] fuse_dev_read+0x15e/0x1f0 fs/fuse/dev.c:1345
 [<ffffffff815711bd>] new_sync_read fs/read_write.c:439 [inline]
 [<ffffffff815711bd>] __vfs_read+0x3dd/0x570 fs/read_write.c:451
 [<ffffffff815726c0>] vfs_read+0x120/0x380 fs/read_write.c:472
 [<ffffffff81576719>] SYSC_read fs/read_write.c:588 [inline]
 [<ffffffff81576719>] SyS_read+0xd9/0x1c0 fs/read_write.c:581
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f9f93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 8903:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xbe/0x290 mm/slub.c:2728
 __fuse_request_alloc+0x27/0xe0 fs/fuse/dev.c:58
 fuse_request_alloc+0x18/0x20 fs/fuse/dev.c:86
 fuse_fill_super+0xcd3/0x1550 fs/fuse/inode.c:1141
 mount_nodev+0x5b/0x100 fs/super.c:1146
 fuse_mount+0x2c/0x40 fs/fuse/inode.c:1198
 mount_fs+0x28c/0x370 fs/super.c:1206
 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 vfs_kern_mount fs/namespace.c:973 [inline]
 do_new_mount fs/namespace.c:2513 [inline]
 do_mount+0x3c9/0x2740 fs/namespace.c:2835
 SYSC_mount fs/namespace.c:3051 [inline]
 SyS_mount+0xfe/0x110 fs/namespace.c:3028
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 8918:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xbe/0x310 mm/slub.c:2980
 fuse_request_free+0x8b/0xa0 fs/fuse/dev.c:101
 fuse_put_request+0x259/0x300 fs/fuse/dev.c:288
 request_end+0x183/0x610 fs/fuse/dev.c:398
 fuse_dev_do_write+0x1099/0x20a0 fs/fuse/dev.c:1905
 fuse_dev_write+0x14b/0x1e0 fs/fuse/dev.c:1929
 new_sync_write fs/read_write.c:496 [inline]
 __vfs_write+0x3e0/0x580 fs/read_write.c:509
 vfs_write+0x187/0x530 fs/read_write.c:557
 SYSC_write fs/read_write.c:604 [inline]
 SyS_write+0xd9/0x1c0 fs/read_write.c:596
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801d06e0248
 which belongs to the cache fuse_request of size 456
The buggy address is located 48 bytes inside of
 456-byte region [ffff8801d06e0248, ffff8801d06e0410)
The buggy address belongs to the page:
page:ffffea000741b800 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d06e0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d06e0180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
>ffff8801d06e0200: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb
                                                                ^
 ffff8801d06e0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d06e0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/21 14:49 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 8cc079c3 .config console log report syz C ci-android-49-kasan-gce-root
2018/10/01 03:24 https://android.googlesource.com/kernel/common android-4.9 1c7637ca0b04 41e4b329 .config console log report syz ci-android-49-kasan-gce-root
2018/10/12 18:47 https://android.googlesource.com/kernel/common android-4.9 38f2b4a8c277 caf12900 .config console log report ci-android-49-kasan-gce-root
2018/09/23 20:41 https://android.googlesource.com/kernel/common android-4.9 1c57ba4f543b 28d9ac76 .config console log report ci-android-49-kasan-gce-root
2018/09/09 01:03 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b 6b5120a4 .config console log report ci-android-49-kasan-gce-root
2018/09/07 06:05 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b e30d3b52 .config console log report ci-android-49-kasan-gce-root
2018/08/30 14:52 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 938220fd .config console log report ci-android-49-kasan-gce-root
2018/08/04 22:15 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 3476a2df .config console log report ci-android-49-kasan-gce-root
2018/07/21 12:48 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 8cc079c3 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.