KASAN: use-after-free Read in bio_copy_user

KASAN: use-after-free Read in bio_copy_user_iov
Status: fixed on 2017/10/23 20:15
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 4099ac938385 scsi: sg: protect accesses to 'reserved' page array
First crash: 1468d, last: 1433d

Sample crash report:

BUG: KASAN: use-after-free in bio_copy_user_iov+0xe61/0xea0 block/bio.c:1205 at addr ffff8801c7c78140
Read of size 8 by task syz-executor0/3280
CPU: 0 PID: 3280 Comm: syz-executor0 Not tainted 4.9.44-gbf7ef8f #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c60774c0 ffffffff81d929c9 ffff8801da0013c0 ffff8801c7c78140
 ffff8801c7c78240 ffffed0038f8f028 ffff8801c7c78140 ffff8801c60774e8
 ffffffff8153c5ec ffffed0038f8f028 ffff8801da0013c0 0000000000000000
Call Trace:
 [<ffffffff81d929c9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d929c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153c5ec>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153c8ac>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153c8ac>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153c8ac>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
 [<ffffffff8153cc49>] kasan_report mm/kasan/report.c:330 [inline]
 [<ffffffff8153cc49>] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:330
 [<ffffffff81cdff71>] bio_copy_user_iov+0xe61/0xea0 block/bio.c:1205
 [<ffffffff81d13ec7>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
 [<ffffffff81d13ec7>] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133
 [<ffffffff81d14531>] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163
 [<ffffffff82668c0a>] sg_start_req drivers/scsi/sg.c:1766 [inline]
 [<ffffffff82668c0a>] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775
 [<ffffffff8266d028>] sg_write+0x688/0xad0 drivers/scsi/sg.c:678
 [<ffffffff8156a563>] __vfs_write+0x103/0x680 fs/read_write.c:510
 [<ffffffff8156e690>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff81572089>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff81572089>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
 [<ffffffff838a6885>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801c7c78140, in cache kmalloc-256 size: 256
Allocated:
PID = 3280
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 __kmalloc+0x11d/0x310 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 sg_build_sgat drivers/scsi/sg.c:1816 [inline]
 sg_build_indirect.isra.23+0x8b/0x550 drivers/scsi/sg.c:1842
 sg_build_reserve+0x8d/0xb0 drivers/scsi/sg.c:1973
 sg_add_sfp drivers/scsi/sg.c:2160 [inline]
 sg_open+0x946/0x15a0 drivers/scsi/sg.c:329
 chrdev_open+0x22b/0x4c0 fs/char_dev.c:392
 do_dentry_open+0x607/0xc60 fs/open.c:766
 vfs_open+0x105/0x220 fs/open.c:879
 do_last fs/namei.c:3402 [inline]
 path_openat+0x64c/0x2a60 fs/namei.c:3525
 do_filp_open+0x197/0x290 fs/namei.c:3560
 do_sys_open+0x352/0x4c0 fs/open.c:1072
 SYSC_open fs/open.c:1090 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1085
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 3281
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 sg_remove_scat.isra.20+0x212/0x2d0 drivers/scsi/sg.c:1924
 sg_ioctl+0x12d0/0x29f0 drivers/scsi/sg.c:973
 vfs_ioctl fs/ioctl.c:43 [inline]
 do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679
 SYSC_ioctl fs/ioctl.c:694 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801c7c78000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801c7c78080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801c7c78100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                           ^
 ffff8801c7c78180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c7c78200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
==================================================================
BUG: KASAN: wild-memory-access on address ffe70874499f6000
Write of size 38 by task syz-executor0/3280
CPU: 0 PID: 3280 Comm: syz-executor0 Tainted: G    B           4.9.44-gbf7ef8f #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c6077448 ffffffff81d929c9 ffff8801c6077618 0000000000000026
 0000000000000001 ffff8801c6077840 ffe70874499f6000 ffff8801c60774d0
 ffffffff8153ca9f 0000000000000000 0000000000000001 ffffffff81ddc284
Call Trace:
 [<ffffffff81d929c9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d929c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153ca9f>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff8153ca9f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
 [<ffffffff8153ce70>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff8153b7b7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff8153b7b7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff8153b844>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
 [<ffffffff81ddc284>] __copy_from_user arch/x86/include/asm/uaccess_64.h:114 [inline]
 [<ffffffff81ddc284>] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline]
 [<ffffffff81ddc284>] copy_page_from_iter+0x1a4/0x5d0 lib/iov_iter.c:618
 [<ffffffff81cdfc15>] bio_copy_from_iter block/bio.c:1031 [inline]
 [<ffffffff81cdfc15>] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232
 [<ffffffff81d13ec7>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
 [<ffffffff81d13ec7>] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133
 [<ffffffff81d14531>] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163
 [<ffffffff82668c0a>] sg_start_req drivers/scsi/sg.c:1766 [inline]
 [<ffffffff82668c0a>] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775
 [<ffffffff8266d028>] sg_write+0x688/0xad0 drivers/scsi/sg.c:678
 [<ffffffff8156a563>] __vfs_write+0x103/0x680 fs/read_write.c:510
 [<ffffffff8156e690>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff81572089>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff81572089>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
 [<ffffffff838a6885>] entry_SYSCALL_64_fastpath+0x23/0xc6
==================================================================
==================================================================
BUG: KASAN: wild-memory-access on address ffe70874499f6000
Write of size 38 by task syz-executor0/3280
CPU: 0 PID: 3280 Comm: syz-executor0 Tainted: G    B           4.9.44-gbf7ef8f #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c60773f8 ffffffff81d929c9 ffe70874499f6000 0000000000000026
 0000000000000001 0000000020006fdb ffe70874499f6000 ffff8801c6077480
 ffffffff8153ca9f 0000000000000000 0000000000000000 ffffffff81dc60d4
Call Trace:
 [<ffffffff81d929c9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d929c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153ca9f>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff8153ca9f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
 [<ffffffff8153ce70>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff8153b7b7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff8153b7b7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff8153bc23>] memset+0x23/0x40 mm/kasan/kasan.c:333
 [<ffffffff81dc60d4>] copy_user_handle_tail+0xb4/0xd0 arch/x86/lib/usercopy_64.c:86
 [<ffffffff81ddc2a0>] copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 [<ffffffff81ddc2a0>] __copy_from_user_nocheck arch/x86/include/asm/uaccess_64.h:59 [inline]
 [<ffffffff81ddc2a0>] __copy_from_user arch/x86/include/asm/uaccess_64.h:115 [inline]
 [<ffffffff81ddc2a0>] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline]
 [<ffffffff81ddc2a0>] copy_page_from_iter+0x1c0/0x5d0 lib/iov_iter.c:618
 [<ffffffff81cdfc15>] bio_copy_from_iter block/bio.c:1031 [inline]
 [<ffffffff81cdfc15>] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232
 [<ffffffff81d13ec7>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
 [<ffffffff81d13ec7>] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133
 [<ffffffff81d14531>] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163

Crashes (73):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro
ci-android-49-kasan-gce	2017/08/25 22:28	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/24 08:24	https://android.googlesource.com/kernel/common android-4.9	34803e7c1c92	c3631fc7	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/21 17:32	https://android.googlesource.com/kernel/common android-4.9	c2e26216b788	f238fbd4	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/21 06:52	https://android.googlesource.com/kernel/common android-4.9	6dda7ac61943	f238fbd4	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/21 05:01	https://android.googlesource.com/kernel/common android-4.9	6dda7ac61943	f238fbd4	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/20 08:35	https://android.googlesource.com/kernel/common android-4.9	6dda7ac61943	f238fbd4	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/19 02:35	https://android.googlesource.com/kernel/common android-4.9	ca95b3e3a5a1	4802b0fb	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/15 06:13	https://android.googlesource.com/kernel/common android-4.9	7073fca5af57	6a0246bf	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/13 11:45	https://android.googlesource.com/kernel/common android-4.9	02f29ab1b950	6a0246bf	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/12 17:16	https://android.googlesource.com/kernel/common android-4.9	02f29ab1b950	6a0246bf	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/12 07:06	https://android.googlesource.com/kernel/common android-4.9	4501c044de52	a0330c0f	.config	log	report	syz
ci-android-49-kasan-gce	2017/07/26 05:56	https://android.googlesource.com/kernel/common android-4.9	72a0c9f5b54a	b0d23a5c	.config	log	report	syz
ci-android-49-kasan-gce	2017/08/29 01:33	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/28 20:36	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/28 14:57	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/27 23:11	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/27 19:40	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/27 05:29	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/27 01:13	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/25 20:52	https://android.googlesource.com/kernel/common android-4.9	bf7ef8f2d57c	be291771	.config	log	report
ci-android-49-kasan-gce	2017/08/24 12:51	https://android.googlesource.com/kernel/common android-4.9	34803e7c1c92	c3631fc7	.config	log	report
ci-android-49-kasan-gce	2017/08/24 00:41	https://android.googlesource.com/kernel/common android-4.9	34803e7c1c92	c3631fc7	.config	log	report
ci-android-49-kasan-gce	2017/08/23 20:53	https://android.googlesource.com/kernel/common android-4.9	34803e7c1c92	c3631fc7	.config	log	report
ci-android-49-kasan-gce	2017/08/22 10:00	https://android.googlesource.com/kernel/common android-4.9	34803e7c1c92	c3631fc7	.config	log	report
ci-android-49-kasan-gce	2017/08/21 19:54	https://android.googlesource.com/kernel/common android-4.9	c2e26216b788	f238fbd4	.config	log	report
ci-android-49-kasan-gce	2017/08/20 12:23	https://android.googlesource.com/kernel/common android-4.9	6dda7ac61943	f238fbd4	.config	log	report
ci-android-49-kasan-gce	2017/08/20 09:27	https://android.googlesource.com/kernel/common android-4.9	6dda7ac61943	f238fbd4	.config	log	report
ci-android-49-kasan-gce	2017/08/20 07:41	https://android.googlesource.com/kernel/common android-4.9	6dda7ac61943	f238fbd4	.config	log	report
ci-android-49-kasan-gce	2017/08/18 14:05	https://android.googlesource.com/kernel/common android-4.9	6e055356d529	41bbf437	.config	log	report
ci-android-49-kasan-gce	2017/08/18 06:09	https://android.googlesource.com/kernel/common android-4.9	6e055356d529	41bbf437	.config	log	report
ci-android-49-kasan-gce	2017/08/17 01:26	https://android.googlesource.com/kernel/common android-4.9	2292b51e2e1b	f93be584	.config	log	report
ci-android-49-kasan-gce	2017/08/10 03:43	https://android.googlesource.com/kernel/common android-4.9	db0248427f18	7e288c05	.config	log	report