KASAN: use-after-free Read in sock_def_write

KASAN: use-after-free Read in sock_def_write_space (3)
Status: auto-closed as invalid on 2021/08/18 10:16
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 388d, last: 151d

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: use-after-free Read in sock_def_write_space (2)	C	error		29	397d	454d	17/22	fixed on 2020/09/16 22:51
upstream	KASAN: use-after-free Read in sock_def_write_space	C	done		67	455d	821d	17/22	fixed on 2020/07/20 08:03

Sample crash report:

==================================================================
BUG: KASAN: use-after-free in list_empty include/linux/list.h:282 [inline]
BUG: KASAN: use-after-free in waitqueue_active include/linux/wait.h:129 [inline]
BUG: KASAN: use-after-free in wq_has_sleeper include/linux/wait.h:163 [inline]
BUG: KASAN: use-after-free in skwq_has_sleeper include/net/sock.h:2182 [inline]
BUG: KASAN: use-after-free in sock_def_write_space+0x609/0x630 net/core/sock.c:2927
Read of size 8 at addr ffff888061a05480 by task ksoftirqd/3/30

CPU: 3 PID: 30 Comm: ksoftirqd/3 Not tainted 5.13.0-rc2-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:436
 list_empty include/linux/list.h:282 [inline]
 waitqueue_active include/linux/wait.h:129 [inline]
 wq_has_sleeper include/linux/wait.h:163 [inline]
 skwq_has_sleeper include/net/sock.h:2182 [inline]
 sock_def_write_space+0x609/0x630 net/core/sock.c:2927
 sock_wfree+0x1cc/0x240 net/core/sock.c:2066
 skb_release_head_state+0x9f/0x250 net/core/skbuff.c:713
 skb_release_all net/core/skbuff.c:724 [inline]
 __kfree_skb net/core/skbuff.c:740 [inline]
 consume_skb net/core/skbuff.c:896 [inline]
 consume_skb+0x89/0x160 net/core/skbuff.c:890
 __dev_kfree_skb_any+0x6b/0x80 net/core/dev.c:3194
 dev_kfree_skb_any include/linux/netdevice.h:3979 [inline]
 e1000_unmap_and_free_tx_resource+0x141/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1969
 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3859 [inline]
 e1000_clean+0x4a8/0x1c30 drivers/net/ethernet/intel/e1000/e1000_main.c:3800
 __napi_poll+0xaf/0x440 net/core/dev.c:6966
 napi_poll net/core/dev.c:7033 [inline]
 net_rx_action+0x801/0xb40 net/core/dev.c:7120
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:559
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x655/0x9e0 kernel/smpboot.c:165
 kthread+0x3b1/0x4a0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Allocated by task 29826:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 __kasan_slab_alloc+0x84/0xa0 mm/kasan/common.c:461
 kasan_slab_alloc include/linux/kasan.h:236 [inline]
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:2912 [inline]
 slab_alloc mm/slub.c:2920 [inline]
 kmem_cache_alloc+0x152/0x3a0 mm/slub.c:2925
 sock_alloc_inode+0x18/0x1c0 net/socket.c:253
 alloc_inode+0x61/0x230 fs/inode.c:233
 new_inode_pseudo+0x14/0xe0 fs/inode.c:934
 sock_alloc+0x3c/0x260 net/socket.c:576
 __sock_create+0xb9/0x780 net/socket.c:1372
 sock_create net/socket.c:1459 [inline]
 __sys_socket+0xef/0x200 net/socket.c:1501
 __do_sys_socket net/socket.c:1510 [inline]
 __se_sys_socket net/socket.c:1508 [inline]
 __ia32_sys_socket+0x6f/0xb0 net/socket.c:1508
 do_syscall_32_irqs_on arch/x86/entry/common.c:78 [inline]
 __do_fast_syscall_32+0x67/0xe0 arch/x86/entry/common.c:143
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:168
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Freed by task 14:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357
 ____kasan_slab_free mm/kasan/common.c:360 [inline]
 ____kasan_slab_free mm/kasan/common.c:325 [inline]
 __kasan_slab_free+0xfb/0x130 mm/kasan/common.c:368
 kasan_slab_free include/linux/kasan.h:212 [inline]
 slab_free_hook mm/slub.c:1581 [inline]
 slab_free_freelist_hook+0xdf/0x240 mm/slub.c:1606
 slab_free mm/slub.c:3166 [inline]
 kmem_cache_free+0x8a/0x740 mm/slub.c:3182
 i_callback+0x3f/0x70 fs/inode.c:222
 rcu_do_batch kernel/rcu/tree.c:2558 [inline]
 rcu_core+0x7ab/0x13b0 kernel/rcu/tree.c:2793
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:559

Last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0xe5/0x110 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3038 [inline]
 call_rcu+0xb1/0x750 kernel/rcu/tree.c:3113
 destroy_inode+0x129/0x1b0 fs/inode.c:288
 iput_final fs/inode.c:1660 [inline]
 iput.part.0+0x57e/0x810 fs/inode.c:1686
 iput+0x58/0x70 fs/inode.c:1676
 dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:376
 __dentry_kill+0x3c0/0x640 fs/dcache.c:582
 dentry_kill fs/dcache.c:708 [inline]
 dput+0x72a/0xbc0 fs/dcache.c:888
 __fput+0x3ae/0x920 fs/file_table.c:293
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 get_signal+0x1ba2/0x2150 kernel/signal.c:2591
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:789
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x171/0x280 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:301
 __do_fast_syscall_32+0x74/0xe0 arch/x86/entry/common.c:146
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:168
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Second to last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0xe5/0x110 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3038 [inline]
 call_rcu+0xb1/0x750 kernel/rcu/tree.c:3113
 destroy_inode+0x129/0x1b0 fs/inode.c:288
 iput_final fs/inode.c:1660 [inline]
 iput.part.0+0x57e/0x810 fs/inode.c:1686
 iput+0x58/0x70 fs/inode.c:1676
 dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:376
 __dentry_kill+0x3c0/0x640 fs/dcache.c:582
 dentry_kill fs/dcache.c:708 [inline]
 dput+0x72a/0xbc0 fs/dcache.c:888
 __fput+0x3ae/0x920 fs/file_table.c:293
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
 exit_to_user_mode_prepare+0x272/0x280 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:301
 __do_fast_syscall_32+0x74/0xe0 arch/x86/entry/common.c:146
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:168
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

The buggy address belongs to the object at ffff888061a05400
 which belongs to the cache sock_inode_cache of size 1216
The buggy address is located 128 bytes inside of
 1216-byte region [ffff888061a05400, ffff888061a058c0)
The buggy address belongs to the page:
page:ffffea0001868000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888061a04980 pfn:0x61a00
head:ffffea0001868000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 ffffea0001126e08 ffffea000112c208 ffff888011b7ca00
raw: ffff888061a04980 0000000000180007 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 28132, ts 600619688405, free_ts 209488905895
 prep_new_page mm/page_alloc.c:2358 [inline]
 get_page_from_freelist+0x1033/0x2b60 mm/page_alloc.c:3994
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5200
 alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272
 alloc_slab_page mm/slub.c:1644 [inline]
 allocate_slab+0x2c5/0x4c0 mm/slub.c:1784
 new_slab mm/slub.c:1847 [inline]
 new_slab_objects mm/slub.c:2593 [inline]
 ___slab_alloc+0x4a1/0x810 mm/slub.c:2756
 __slab_alloc.constprop.0+0xa7/0xf0 mm/slub.c:2796
 slab_alloc_node mm/slub.c:2878 [inline]
 slab_alloc mm/slub.c:2920 [inline]
 kmem_cache_alloc+0x34b/0x3a0 mm/slub.c:2925
 sock_alloc_inode+0x18/0x1c0 net/socket.c:253
 alloc_inode+0x61/0x230 fs/inode.c:233
 new_inode_pseudo+0x14/0xe0 fs/inode.c:934
 sock_alloc+0x3c/0x260 net/socket.c:576
 sock_create_lite+0x7b/0x120 net/socket.c:1207
 __netlink_kernel_create+0xde/0x850 net/netlink/af_netlink.c:2050
 netlink_kernel_create include/linux/netlink.h:62 [inline]
 uevent_net_init+0xf7/0x330 lib/kobject_uevent.c:770
 ops_init+0xaf/0x470 net/core/net_namespace.c:140
 setup_net+0x40f/0xa30 net/core/net_namespace.c:333
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1298 [inline]
 free_pcp_prepare+0x223/0x300 mm/page_alloc.c:1342
 free_unref_page_prepare mm/page_alloc.c:3250 [inline]
 free_unref_page+0x12/0x1d0 mm/page_alloc.c:3298
 unfreeze_partials+0x17c/0x1d0 mm/slub.c:2374
 put_cpu_partial+0x13d/0x230 mm/slub.c:2410
 qlink_free mm/kasan/quarantine.c:146 [inline]
 qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165
 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272
 __kasan_slab_alloc+0x8e/0xa0 mm/kasan/common.c:438
 kasan_slab_alloc include/linux/kasan.h:236 [inline]
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:2912 [inline]
 slab_alloc mm/slub.c:2920 [inline]
 __kmalloc+0x1f7/0x330 mm/slub.c:4054
 kmalloc include/linux/slab.h:561 [inline]
 kzalloc include/linux/slab.h:686 [inline]
 tomoyo_encode2.part.0+0xe9/0x3a0 security/tomoyo/realpath.c:45
 tomoyo_encode2 security/tomoyo/realpath.c:31 [inline]
 tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80
 tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_number_perm+0x1d5/0x590 security/tomoyo/file.c:723
 tomoyo_path_mkdir+0x98/0xe0 security/tomoyo/tomoyo.c:167
 security_path_mkdir+0xe8/0x160 security/security.c:1139
 do_mkdirat+0x14b/0x310 fs/namei.c:3834
 do_syscall_32_irqs_on arch/x86/entry/common.c:78 [inline]
 __do_fast_syscall_32+0x67/0xe0 arch/x86/entry/common.c:143

Memory state around the buggy address:
 ffff888061a05380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888061a05400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888061a05480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888061a05500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888061a05580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (21):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Title
ci-qemu-upstream-386	2021/05/17 01:38	upstream	d07f6ca923ea	f54a5c09	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-qemu-upstream-386	2021/05/16 15:17	upstream	63d1cb53e26a	f54a5c09	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-qemu-upstream-386	2021/05/10 10:52	upstream	6efb943b8616	bc5434be	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-upstream-net-this-kasan-gce	2021/03/14 14:11	net	ad236ccde19a	4a003785	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-upstream-net-kasan-gce	2021/05/20 10:09	net-next	bc6d076daa8c	a343ba6b	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-upstream-net-kasan-gce	2021/05/15 16:52	net-next	77091933e453	93f844de	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-upstream-net-kasan-gce	2021/04/15 12:12	net-next	3a1aa533f7f6	fcdb12ba	.config	log	report	info	KASAN: use-after-free Read in sock_def_write_space
ci-qemu-upstream	2021/01/12 19:20	upstream	e609571b5ffa	0cdd6185	.config	log	report	info
ci-qemu-upstream	2021/01/11 10:34	upstream	7c53f6b671f4	2c1f2513	.config	log	report	info
ci-qemu-upstream	2020/09/25 16:15	upstream	171d4ff79f96	4a006f63	.config	log	report	info
ci-qemu-upstream-386	2020/12/03 11:58	upstream	34816d20f173	59ad4022	.config	log	report	info
ci-qemu-upstream-386	2020/12/01 23:15	upstream	b65054597872	c42a35e9	.config	log	report	info
ci-qemu-upstream-386	2020/11/17 17:21	upstream	9c87c9f41245	7eca15bf	.config	log	report	info
ci-qemu-upstream-386	2020/11/03 21:14	upstream	ce2e33ba4163	cba33199	.config	log	report	info
ci-qemu-upstream-386	2020/10/26 22:13	upstream	41ba50b0572e	8b3eaf58	.config	log	report	info
ci-qemu-upstream-386	2020/09/27 14:48	upstream	a1bffa48745a	5dd8aee8	.config	log	report	info
ci-upstream-net-this-kasan-gce	2020/11/14 14:05	net	ceb736e1d45c	1bf9a662	.config	log	report	info
ci-upstream-net-kasan-gce	2020/12/31 03:13	net-next	3db1a3fa9880	5cc121d6	.config	log	report	info
ci-upstream-net-kasan-gce	2020/12/12 22:14	net-next	00f7763a26cb	bca53db9	.config	log	report	info
ci-upstream-net-kasan-gce	2020/11/14 14:38	net-next	774626fa440e	1bf9a662	.config	log	report	info
ci-upstream-net-kasan-gce	2020/09/29 10:20	net-next	bcbf1be0ad49	1b88c6d5	.config	log	report	info