KASAN: use-after-free Read in filp_close

Status: auto-obsoleted due to no activity on 2023/04/21 02:05
Reported-by: syzbot+53897bcb31b82c7a08fe@syzkaller.appspotmail.com
First crash: 2043d, last: 1838d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] KASAN: null-ptr-deref Read in filp_close (2) 10 (15) 2021/07/14 14:16
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in filp_close io-uring fs 19 syz, C done 17 1310d 1539d 22/29 fixed on 2023/02/24 13:50
upstream KASAN: null-ptr-deref Read in filp_close (2) fs 19 syz, C 3 1860d 1969d 20/29 fixed on 2021/11/10 13:22
android-5-10 general protection fault in filp_close 2 1 1241d 1241d 0/2 auto-obsoleted due to no activity on 2023/06/22 23:34
android-5-15 general protection fault in filp_close 2 1 123d 123d 0/2 auto-obsoleted due to no activity on 2026/07/14 19:12
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2023/04/21 01:27 22m retest repro android12-5.4 no crash log
2023/04/21 01:27 22m retest repro android12-5.4 no crash log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in filp_close+0x31/0x140 fs/open.c:1184
Read of size 8 at addr ffff8881e5def3b8 by task syz-executor523/337

CPU: 0 PID: 337 Comm: syz-executor523 Not tainted 5.4.125-syzkaller-00012-ge7e1f9adf836 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x24e lib/dump_stack.c:118
 print_address_description+0x9b/0x650 mm/kasan/report.c:384
 __kasan_report+0x182/0x260 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
 atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
 filp_close+0x31/0x140 fs/open.c:1184
 __do_sys_close fs/open.c:1209 [inline]
 __se_sys_close fs/open.c:1207 [inline]
 __x64_sys_close+0x62/0xc0 fs/open.c:1207
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4021c3
RSP: 002b:00007ffd256a6858 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004021c3
RBP: 00007ffd256a6868 R08: 0000000000000006 R09: 00000000004aa000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd256a6870
R13: 0000000000000000 R14: 00000000004ad018 R15: 0000000000400488
Allocated by task 337:
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2821 [inline]
 slab_alloc mm/slub.c:2829 [inline]
 kmem_cache_alloc+0x115/0x290 mm/slub.c:2834
 kmem_cache_zalloc include/linux/slab.h:680 [inline]
 __alloc_file+0x26/0x380 fs/file_table.c:101
 alloc_empty_file+0xa9/0x1b0 fs/file_table.c:151
 alloc_file+0x57/0x4d0 fs/file_table.c:193
 alloc_file_pseudo+0x272/0x300 fs/file_table.c:233
 create_pipe_files+0x2de/0x620 fs/pipe.c:776
 __do_pipe_flags+0x46/0x200 fs/pipe.c:807
 do_pipe2+0xd0/0x300 fs/pipe.c:855
 __do_sys_pipe2 fs/pipe.c:873 [inline]
 __se_sys_pipe2 fs/pipe.c:871 [inline]
 __x64_sys_pipe2+0x56/0x60 fs/pipe.c:871
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 337:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x18a/0x240 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1454 [inline]
 slab_free_freelist_hook+0x7b/0x150 mm/slub.c:1492
 slab_free mm/slub.c:3072 [inline]
 kfree+0xe0/0x660 mm/slub.c:4061
 put_fs_context+0x57c/0x690 fs/fs_context.c:509
 fscontext_release+0x61/0x80 fs/fsopen.c:73
 __fput+0x27d/0x6c0 fs/file_table.c:281
 task_work_run+0x186/0x1b0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:163 [inline]
 prepare_exit_to_usermode+0x2b0/0x310 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff8881e5def380
 which belongs to the cache filp of size 280
The buggy address is located 56 bytes inside of
 280-byte region [ffff8881e5def380, ffff8881e5def498)
The buggy address belongs to the page:
page:ffffea0007977b80 refcount:1 mapcount:0 mapping:ffff8881f5cfa000 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5cfa000
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x19a/0x380 mm/page_alloc.c:2171
 get_page_from_freelist+0x550/0x8b0 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x3a2/0x880 mm/page_alloc.c:4855
 alloc_slab_page+0x39/0x3e0 mm/slub.c:342
 allocate_slab mm/slub.c:1675 [inline]
 new_slab+0x97/0x460 mm/slub.c:1741
 new_slab_objects mm/slub.c:2498 [inline]
 ___slab_alloc+0x330/0x4c0 mm/slub.c:2659
 __slab_alloc mm/slub.c:2699 [inline]
 slab_alloc_node mm/slub.c:2784 [inline]
 slab_alloc mm/slub.c:2829 [inline]
 kmem_cache_alloc+0x18b/0x290 mm/slub.c:2834
 kmem_cache_zalloc include/linux/slab.h:680 [inline]
 __alloc_file+0x26/0x380 fs/file_table.c:101
 alloc_empty_file+0xa9/0x1b0 fs/file_table.c:151
 path_openat+0x125/0x3da0 fs/namei.c:3601
 do_filp_open+0x208/0x450 fs/namei.c:3642
 do_sys_open+0x383/0x7c0 fs/open.c:1113
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0xc60/0xd80 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4917 [inline]
 __free_pages+0x8f/0x250 mm/page_alloc.c:4923
 __free_slab+0x237/0x2f0 mm/slub.c:1766
 free_slab mm/slub.c:1781 [inline]
 discard_slab mm/slub.c:1787 [inline]
 unfreeze_partials+0x14f/0x180 mm/slub.c:2279
 put_cpu_partial+0xb5/0x150 mm/slub.c:2315
 __slab_free mm/slub.c:2963 [inline]
 do_slab_free mm/slub.c:3060 [inline]
 ___cache_free+0x352/0x4e0 mm/slub.c:3079
 qlist_free_all mm/kasan/quarantine.c:167 [inline]
 quarantine_reduce+0x17a/0x1e0 mm/kasan/quarantine.c:260
 __kasan_kmalloc+0x43/0x1e0 mm/kasan/common.c:507
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2821 [inline]
 slab_alloc mm/slub.c:2829 [inline]
 __kmalloc+0x140/0x2f0 mm/slub.c:3899
 kmalloc include/linux/slab.h:561 [inline]
 do_tty_write drivers/tty/tty_io.c:943 [inline]
 tty_write+0x304/0x880 drivers/tty/tty_io.c:1045
 __vfs_write+0x103/0x780 fs/read_write.c:494
 vfs_write+0x212/0x4e0 fs/read_write.c:558
 ksys_write+0x186/0x2b0 fs/read_write.c:611
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8881e5def280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881e5def300: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881e5def38

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/04 08:32 android12-5.4 e7e1f9adf836 6c236867 .config console log report syz C ci2-android-5-4-kasan KASAN: use-after-free Read in filp_close
2021/01/11 12:49 android12-5.4 c9951e5d80dd 2c1f2513 .config console log report syz C ci2-android-5-4-kasan
2021/01/11 12:37 android12-5.4 c9951e5d80dd 2c1f2513 .config console log report info ci2-android-5-4-kasan
* Struck through repros no longer work on HEAD.