syzbot

 sign-in | mailing list | source | docs
🐞 Open [985] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12474] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in __dev_map_entry_free

Status: fixed on 2019/06/18 17:49
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+457d3e2ffbcf31aee5c0@syzkaller.appspotmail.com
Fix commit: 2baae3545327 bpf: devmap: fix use-after-free Read in __dev_map_entry_free
First crash: 2130d, last: 1849d
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.19 000/276] 4.19.47-stable review 304 (304) 2019/06/06 19:22
[PATCH 5.0 000/346] 5.0.20-stable review 355 (355) 2019/05/31 14:18
[PATCH 5.1 000/405] 5.1.6-stable review 414 (414) 2019/05/31 14:16
[PATCH 4.14 000/193] 4.14.123-stable review 199 (199) 2019/05/31 05:16
[PATCH net] bpf: devmap: fix use-after-free Read in __dev_map_entry_free 2 (2) 2019/05/13 23:33
KASAN: use-after-free Read in __dev_map_entry_free 7 (8) 2019/04/09 20:22

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:365 [inline]
BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a8/0x300 kernel/bpf/devmap.c:379
Read of size 8 at addr ffff8801d8cfa1c8 by task ksoftirqd/1/18

CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.18.0-rc1+ #110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 dev_map_flush_old kernel/bpf/devmap.c:365 [inline]
 __dev_map_entry_free+0x2a8/0x300 kernel/bpf/devmap.c:379
 __rcu_reclaim kernel/rcu/rcu.h:178 [inline]
 rcu_do_batch kernel/rcu/tree.c:2558 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2785 [inline]
 rcu_process_callbacks+0xed5/0x1850 kernel/rcu/tree.c:2802
 __do_softirq+0x2e8/0xb17 kernel/softirq.c:284
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:645
 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
 kthread+0x345/0x410 kernel/kthread.c:240
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412

Allocated by task 8934:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
 kmalloc include/linux/slab.h:513 [inline]
 kzalloc include/linux/slab.h:707 [inline]
 dev_map_alloc+0x210/0x810 kernel/bpf/devmap.c:102
 find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
 map_create+0x39b/0x1020 kernel/bpf/syscall.c:453
 __do_sys_bpf kernel/bpf/syscall.c:2351 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:2328 [inline]
 __x64_sys_bpf+0x303/0x510 kernel/bpf/syscall.c:2328
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 26:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xd9/0x260 mm/slab.c:3813
 dev_map_free+0x502/0x680 kernel/bpf/devmap.c:191
 bpf_map_free_deferred+0xba/0xf0 kernel/bpf/syscall.c:262
 process_one_work+0xc73/0x1ba0 kernel/workqueue.c:2153
 worker_thread+0x189/0x13c0 kernel/workqueue.c:2296
 kthread+0x345/0x410 kernel/kthread.c:240
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412

The buggy address belongs to the object at ffff8801d8cfa0c0
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
 512-byte region [ffff8801d8cfa0c0, ffff8801d8cfa2c0)
The buggy address belongs to the page:
page:ffffea0007633e80 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0007620148 ffffea000763d6c8 ffff8801da800940
raw: 0000000000000000 ffff8801d8cfa0c0 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d8cfa080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff8801d8cfa100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d8cfa180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff8801d8cfa200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d8cfa280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================

Crashes (473):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/20 11:51 upstream 81e97f01371f 095ef806 .config console log report syz C ci-upstream-kasan-gce-root
2018/06/20 11:13 bpf-next f0dc7f9c6dd9 095ef806 .config console log report syz C ci-upstream-bpf-next-kasan-gce
2018/09/13 23:06 upstream 54eda9df17f3 19e9088b .config console log report syz ci-upstream-kasan-gce-smack-root
2018/09/13 02:43 upstream 96eddb810b14 71907daf .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/09/13 01:59 upstream 96eddb810b14 71907daf .config console log report syz ci-upstream-kasan-gce-root
2018/07/29 01:49 upstream dd63bf22fccd ebf656d7 .config console log report syz ci-upstream-kasan-gce-root
2018/09/12 13:15 net-old 4ecdf7709143 3c88136c .config console log report syz ci-upstream-net-this-kasan-gce
2018/09/12 13:15 bpf 28619527b8a7 3c88136c .config console log report syz ci-upstream-bpf-kasan-gce
2018/07/29 01:50 bpf acc04d4c0e41 ebf656d7 .config console log report syz ci-upstream-bpf-kasan-gce
2018/09/12 13:16 net-next-old aad06d1104e8 3c88136c .config console log report syz ci-upstream-net-kasan-gce
2018/09/12 13:16 bpf-next 2e2a0c961a87 3c88136c .config console log report syz ci-upstream-bpf-next-kasan-gce
2018/07/29 01:44 bpf-next 2e96187b6967 ebf656d7 .config console log report syz ci-upstream-bpf-next-kasan-gce
2018/07/29 01:50 linux-next d1e0b8e0cb7a ebf656d7 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/20 11:28 upstream f2ce1065e767 9bc2a903 .config console log report ci-upstream-kasan-gce-selinux-root
2018/11/14 08:00 upstream ccda4af0f4b9 5f5f6d14 .config console log report ci-upstream-kasan-gce-root
2019/03/15 08:05 bpf cd70182e8d53 d72db19b .config console log report ci-upstream-bpf-kasan-gce
2019/03/11 04:16 bpf 71b91a506bb0 12365b99 .config console log report ci-upstream-bpf-kasan-gce
2019/03/08 07:27 bpf 20182390c413 4b69c3cb .config console log report ci-upstream-bpf-kasan-gce
2019/02/07 12:46 bpf d2901b0739a4 aa4feb03 .config console log report ci-upstream-bpf-kasan-gce
2019/01/03 10:28 bpf a67825f51951 06a2b89f .config console log report ci-upstream-bpf-kasan-gce
2019/01/02 22:18 bpf 8b6b25cf93b7 f0491811 .config console log report ci-upstream-bpf-kasan-gce
2019/03/28 16:20 bpf-next 356d71e00d27 f94f56fe .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/25 19:29 bpf-next 62b31b42cff9 2c86e0a5 .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/24 01:19 bpf-next 7df5e3db8f63 a2cef203 .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/23 13:26 bpf-next 2569473816a9 3361bde5 .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/17 19:27 bpf-next d9862cfbe209 ba18afea .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/15 16:03 bpf-next d9862cfbe209 bab43553 .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/14 22:54 bpf-next d9862cfbe209 d72db19b .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/14 12:28 bpf-next d9862cfbe209 d09a902e .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/11 18:54 bpf-next d9862cfbe209 12365b99 .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/09 06:20 bpf-next d9862cfbe209 12365b99 .config console log report ci-upstream-bpf-next-kasan-gce
2019/03/01 11:56 bpf-next 3860d38f2856 8a4b3a6b .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/28 22:56 bpf-next 3bcd60444519 09aeeba4 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/23 16:22 bpf-next 915654fd718c 18107ce0 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/17 00:44 bpf-next b251f9f63a3b f42dee6d .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/15 03:39 bpf-next fb405883c189 76dd003f .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/14 10:04 bpf-next 87486b23f8aa 6a46f448 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/14 02:06 bpf-next dd27c2e3d0a0 0a49c954 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/13 06:07 bpf-next dd27c2e3d0a0 1eedba36 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/10 17:20 bpf-next 28bbfc3a25dd b4f792e4 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/08 10:18 bpf-next a4021a3579c5 aa4feb03 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/08 00:35 bpf-next 7d8e249f393a aa4feb03 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/07 22:28 bpf-next 7d8e249f393a aa4feb03 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/07 18:26 bpf-next 7d8e249f393a aa4feb03 .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/07 05:33 bpf-next dd9cef43c222 d25487bc .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/07 03:13 bpf-next dd9cef43c222 d25487bc .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/07 00:54 bpf-next f7748e295238 d25487bc .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/06 17:32 net-next-old bfbae2eafe05 d25487bc .config console log report ci-upstream-net-kasan-gce
2019/02/06 03:37 bpf-next 90d304b7f7a1 d672172c .config console log report ci-upstream-bpf-next-kasan-gce
2019/02/05 21:12 net-next-old 5468e82f7034 d672172c .config console log report ci-upstream-net-kasan-gce
2019/01/29 14:20 bpf-next 3d2af27a84a8 aa432daf .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/19 10:14 bpf-next d0b2818efbe2 2103a236 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/16 16:42 bpf-next 7939f8beecf1 d538790b .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/15 04:58 bpf-next b71acb0e3721 ebacf5cb .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/13 12:11 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/11 11:18 bpf-next b71acb0e3721 80dde172 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/11 06:53 bpf-next b71acb0e3721 80dde172 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/09 13:30 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/05 00:10 bpf-next b71acb0e3721 0127e3ba .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/02 11:58 bpf-next b71acb0e3721 f0491811 .config console log report ci-upstream-bpf-next-kasan-gce
2018/11/18 16:08 linux-next 442b8cea2477 adf636a8 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.