syzbot


KASAN: use-after-free Read in p9_conn_cancel

Status: public: reported C repro on 2019/04/11 08:44
Reported-by: syzbot+6204b7ad01377a376b47@syzkaller.appspotmail.com
First crash: 2080d, last: 2030d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in p9_conn_cancel v9fs C inconclusive unreliable 72 2041d 2079d 0/26 auto-obsoleted due to no activity on 2022/12/09 08:19

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KASAN: use-after-free in p9_conn_cancel+0x464/0x4c0 net/9p/trans_fd.c:201
Read of size 8 at addr ffff8801da103420 by task kworker/1:1/24

CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 4.9.113-g9905591 #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events p9_poll_workfn
 ffff8801d940faa0 ffffffff81eb32a9 ffffea0007684080 ffff8801da103420
 0000000000000000 ffff8801da103420 00000000ffffff98 ffff8801d940fad8
 ffffffff81567bd9 ffff8801da103420 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81eb32a9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb32a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81567bd9>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567fe3>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567fe3>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153bc34>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff839c3134>] p9_conn_cancel+0x464/0x4c0 net/9p/trans_fd.c:201
 [<ffffffff839c36e2>] p9_poll_mux net/9p/trans_fd.c:630 [inline]
 [<ffffffff839c36e2>] p9_poll_workfn+0x222/0x330 net/9p/trans_fd.c:1097
 [<ffffffff8118d181>] process_one_work+0x7e1/0x1500 kernel/workqueue.c:2092
 [<ffffffff8118df76>] worker_thread+0xd6/0x10a0 kernel/workqueue.c:2226
 [<ffffffff8119d0ad>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff839fa35c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Allocated by task 3965:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 kmem_cache_alloc_trace+0xfd/0x2b0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 p9_fd_open net/9p/trans_fd.c:792 [inline]
 p9_fd_create+0xf3/0x330 net/9p/trans_fd.c:1029
 p9_client_create+0x6ff/0x10a0 net/9p/client.c:1036
 v9fs_session_init+0x333/0x13a0 fs/9p/v9fs.c:343
 v9fs_mount+0x7d/0x810 fs/9p/vfs_super.c:130
 mount_fs+0x28c/0x370 fs/super.c:1206
 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 vfs_kern_mount fs/namespace.c:973 [inline]
 do_new_mount fs/namespace.c:2513 [inline]
 do_mount+0x3c9/0x2740 fs/namespace.c:2835
 SYSC_mount fs/namespace.c:3051 [inline]
 SyS_mount+0xfe/0x110 fs/namespace.c:3028
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 3965:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 p9_fd_close+0x298/0x330 net/9p/trans_fd.c:890
 p9_client_create+0x825/0x10a0 net/9p/client.c:1050
 v9fs_session_init+0x333/0x13a0 fs/9p/v9fs.c:343
 v9fs_mount+0x7d/0x810 fs/9p/vfs_super.c:130
 mount_fs+0x28c/0x370 fs/super.c:1206
 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 vfs_kern_mount fs/namespace.c:973 [inline]
 do_new_mount fs/namespace.c:2513 [inline]
 do_mount+0x3c9/0x2740 fs/namespace.c:2835
 SYSC_mount fs/namespace.c:3051 [inline]
 SyS_mount+0xfe/0x110 fs/namespace.c:3028
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801da103400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 32 bytes inside of
 512-byte region [ffff8801da103400, ffff8801da103600)
The buggy address belongs to the page:
page:ffffea0007684080 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801da103300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801da103380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801da103400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff8801da103480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801da103500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (81):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/29 22:25 https://android.googlesource.com/kernel/common android-4.9 990559158c7b 1a381291 .config console log report syz C ci-android-49-kasan-gce-root
2018/07/29 13:35 https://android.googlesource.com/kernel/common android-4.9 990559158c7b 0824d7a1 .config console log report syz C ci-android-49-kasan-gce-root
2018/07/10 10:44 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 9fa03fa5 .config console log report syz C ci-android-49-kasan-gce
2018/07/10 05:31 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz C ci-android-49-kasan-gce
2018/07/09 09:05 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz C ci-android-49-kasan-gce
2018/07/09 01:14 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz C ci-android-49-kasan-gce
2018/07/09 12:06 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz C ci-android-49-kasan-gce-386
2018/08/21 00:37 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 95b5c82b .config console log report syz ci-android-49-kasan-gce-root
2018/08/14 01:43 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report syz ci-android-49-kasan-gce-root
2018/08/13 17:21 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report syz ci-android-49-kasan-gce-root
2018/08/09 21:02 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report syz ci-android-49-kasan-gce-root
2018/07/20 17:45 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 49f35839 .config console log report syz ci-android-49-kasan-gce-root
2018/07/10 23:35 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 2e0e3130 .config console log report syz ci-android-49-kasan-gce-root
2018/07/09 21:01 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz ci-android-49-kasan-gce-386
2018/07/09 16:03 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz ci-android-49-kasan-gce-386
2018/08/27 22:17 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 7ef1de9e .config console log report ci-android-49-kasan-gce-root
2018/08/26 15:34 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 758cd203 .config console log report ci-android-49-kasan-gce-root
2018/08/25 22:42 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 76e7c3df .config console log report ci-android-49-kasan-gce-root
2018/08/25 03:26 https://android.googlesource.com/kernel/common android-4.9 6a1b5923548a 9b0f5c75 .config console log report ci-android-49-kasan-gce-root
2018/08/24 14:13 https://android.googlesource.com/kernel/common android-4.9 520d10d31ca4 95b5c82b .config console log report ci-android-49-kasan-gce-root
2018/08/24 07:29 https://android.googlesource.com/kernel/common android-4.9 520d10d31ca4 95b5c82b .config console log report ci-android-49-kasan-gce-root
2018/08/23 16:07 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report ci-android-49-kasan-gce-root
2018/08/21 11:18 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 95b5c82b .config console log report ci-android-49-kasan-gce-root
2018/08/20 14:25 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 2dc4378f .config console log report ci-android-49-kasan-gce-root
2018/08/19 17:58 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 2dc4378f .config console log report ci-android-49-kasan-gce-root
2018/08/17 17:35 https://android.googlesource.com/kernel/common android-4.9 f85543ba3c54 738da825 .config console log report ci-android-49-kasan-gce-root
2018/08/16 18:45 https://android.googlesource.com/kernel/common android-4.9 f85543ba3c54 9ccc1d45 .config console log report ci-android-49-kasan-gce-root
2018/08/16 05:21 https://android.googlesource.com/kernel/common android-4.9 f85543ba3c54 9ccc1d45 .config console log report ci-android-49-kasan-gce-root
2018/08/15 19:45 https://android.googlesource.com/kernel/common android-4.9 f85543ba3c54 9ccc1d45 .config console log report ci-android-49-kasan-gce-root
2018/08/14 14:15 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/14 13:06 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/13 12:32 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/13 03:46 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/13 00:53 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/11 22:34 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/11 16:46 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/11 10:04 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/11 07:34 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-root
2018/08/10 10:54 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report ci-android-49-kasan-gce-root
2018/08/09 04:05 https://android.googlesource.com/kernel/common android-4.9 856452b4f22e 2eeda842 .config console log report ci-android-49-kasan-gce-root
2018/08/08 22:26 https://android.googlesource.com/kernel/common android-4.9 856452b4f22e 2eeda842 .config console log report ci-android-49-kasan-gce-root
2018/08/08 02:03 https://android.googlesource.com/kernel/common android-4.9 47b77b8d01c4 1beb8136 .config console log report ci-android-49-kasan-gce-root
2018/08/07 14:21 https://android.googlesource.com/kernel/common android-4.9 47b77b8d01c4 1beb8136 .config console log report ci-android-49-kasan-gce-root
2018/08/07 00:59 https://android.googlesource.com/kernel/common android-4.9 47b77b8d01c4 1beb8136 .config console log report ci-android-49-kasan-gce-root
2018/08/04 21:15 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 3476a2df .config console log report ci-android-49-kasan-gce-root
2018/08/04 03:54 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c df7f6947 .config console log report ci-android-49-kasan-gce-root
2018/08/03 00:00 https://android.googlesource.com/kernel/common android-4.9 0137ea2134c0 5b7e23bb .config console log report ci-android-49-kasan-gce-root
2018/08/01 16:12 https://android.googlesource.com/kernel/common android-4.9 52be322125e5 1477993e .config console log report ci-android-49-kasan-gce-root
2018/08/01 14:32 https://android.googlesource.com/kernel/common android-4.9 52be322125e5 1477993e .config console log report ci-android-49-kasan-gce-root
2018/07/31 23:28 https://android.googlesource.com/kernel/common android-4.9 90e7a9002952 1477993e .config console log report ci-android-49-kasan-gce-root
2018/07/31 18:06 https://android.googlesource.com/kernel/common android-4.9 90e7a9002952 1a381291 .config console log report ci-android-49-kasan-gce-root
2018/07/31 08:14 https://android.googlesource.com/kernel/common android-4.9 8956c50bdcd3 1a381291 .config console log report ci-android-49-kasan-gce-root
2018/07/31 00:21 https://android.googlesource.com/kernel/common android-4.9 8956c50bdcd3 1a381291 .config console log report ci-android-49-kasan-gce-root
2018/07/12 06:51 https://android.googlesource.com/kernel/common android-4.9 9e7903954483 2e0e3130 .config console log report ci-android-49-kasan-gce
2018/07/10 23:33 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 2e0e3130 .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.