syzbot

 sign-in | mailing list | source | docs
🐞 Open [1573]
≡ Subsystems
🐞 Fixed [5936]
🐞 Invalid [14438]
⬇ Missing Backports [102]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: use-after-free Read in n_tty_receive_buf_common

Status: fixed on 2020/04/15 17:19
Reported-by: syzbot+59997e8d5cbdc486e6f6@syzkaller.appspotmail.com
Fix commit: 07e6124a1a46 vt: selection, close sel_buffer race
First crash: 1842d, last: 1766d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: no output from test machine (log)
Repro: C syz .config
  
▶ ▼ Discussions (12)
Title Replies (including bot) Last reply
[PATCH 3.16 000/245] 3.16.83-rc1 review 260 (260) 2020/04/24 17:54
[PATCH 5.5 000/189] 5.5.9-stable review 206 (206) 2020/03/25 17:53
[PATCH 4.19 00/86] 4.19.109-stable review 103 (103) 2020/03/17 19:46
[PATCH 4.14 000/126] 4.14.173-stable review 140 (140) 2020/03/13 16:17
[PATCH 5.4 000/168] 5.4.25-stable review 177 (177) 2020/03/11 18:09
[PATCH 4.4 00/72] 4.4.216-stable review 78 (78) 2020/03/11 10:27
[PATCH 4.9 00/88] 4.9.216-stable review 96 (96) 2020/03/10 21:57
[PATCH 4.19 00/97] 4.19.107-stable review 108 (108) 2020/02/28 18:05
[PATCH 5.5 000/150] 5.5.7-stable review 166 (166) 2020/02/28 15:12
[PATCH 5.4 000/135] 5.4.23-stable review 140 (140) 2020/02/28 03:42
[PATCH 1/2] vt: selection, handle pending signals in paste_selection 5 (5) 2020/02/13 19:58
KASAN: use-after-free Read in n_tty_receive_buf_common 0 (2) 2019/12/09 06:21
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in n_tty_receive_buf_common C done 40 1750d 1844d 1/1 fixed on 2020/04/07 16:31
linux-4.14 KASAN: use-after-free Read in n_tty_receive_buf_common C done 25 1756d 1844d 1/1 fixed on 2020/04/02 14:59

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in n_tty_check_throttle drivers/tty/n_tty.c:266 [inline]
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x270f/0x2b70 drivers/tty/n_tty.c:1761
Read of size 1 at addr ffff8880a7648402 by task syz-executor319/11030

CPU: 0 PID: 11030 Comm: syz-executor319 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 n_tty_check_throttle drivers/tty/n_tty.c:266 [inline]
 n_tty_receive_buf_common+0x270f/0x2b70 drivers/tty/n_tty.c:1761
 n_tty_receive_buf2+0x34/0x40 drivers/tty/n_tty.c:1777
 tty_ldisc_receive_buf+0xad/0x1c0 drivers/tty/tty_buffer.c:461
 paste_selection+0x1ff/0x460 drivers/tty/vt/selection.c:372
 tioclinux+0x133/0x480 drivers/tty/vt/vt.c:3044
 vt_ioctl+0x1a41/0x26d0 drivers/tty/vt/vt_ioctl.c:364
 tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl+0x123/0x180 fs/ioctl.c:763
 __do_sys_ioctl fs/ioctl.c:772 [inline]
 __se_sys_ioctl fs/ioctl.c:770 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441329
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffeae838978 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441329
RDX: 0000000020000040 RSI: 000000000000541c RDI: 0000000000000004
RBP: 0000000000076975 R08: 000000000000000d R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004020a0
R13: 0000000000402130 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 11034:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc mm/kasan/common.c:515 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:488
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529
 __do_kmalloc mm/slab.c:3656 [inline]
 __kmalloc+0x163/0x770 mm/slab.c:3665
 kmalloc_array include/linux/slab.h:597 [inline]
 set_selection_kernel+0x872/0x13b0 drivers/tty/vt/selection.c:305
 set_selection_user+0x95/0xd9 drivers/tty/vt/selection.c:177
 tioclinux+0x11c/0x480 drivers/tty/vt/vt.c:3039
 vt_ioctl+0x1a41/0x26d0 drivers/tty/vt/vt_ioctl.c:364
 tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl+0x123/0x180 fs/ioctl.c:763
 __do_sys_ioctl fs/ioctl.c:772 [inline]
 __se_sys_ioctl fs/ioctl.c:770 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 11036:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 kasan_set_free_info mm/kasan/common.c:337 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:476
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x10a/0x2c0 mm/slab.c:3757
 set_selection_kernel+0x88f/0x13b0 drivers/tty/vt/selection.c:312
 set_selection_user+0x95/0xd9 drivers/tty/vt/selection.c:177
 tioclinux+0x11c/0x480 drivers/tty/vt/vt.c:3039
 vt_ioctl+0x1a41/0x26d0 drivers/tty/vt/vt_ioctl.c:364
 tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl+0x123/0x180 fs/ioctl.c:763
 __do_sys_ioctl fs/ioctl.c:772 [inline]
 __se_sys_ioctl fs/ioctl.c:770 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880a7648400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 2 bytes inside of
 512-byte region [ffff8880a7648400, ffff8880a7648600)
The buggy address belongs to the page:
page:ffffea00029d9200 refcount:1 mapcount:0 mapping:ffff8880aa400a80 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00029c3a48 ffffea00027a7488 ffff8880aa400a80
raw: 0000000000000000 ffff8880a7648000 0000000100000004 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a7648300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a7648380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880a7648400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8880a7648480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880a7648500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (68):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/17 04:14 upstream 11a48a5a18c6 1f448cd6 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/02/15 18:42 upstream 2019fc96af22 5d7b90f1 .config console log report syz C ci-upstream-kasan-gce-root
2020/02/14 12:53 upstream b19e8c684703 5d7b90f1 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/02 16:08 upstream 738d2902773e 25a0186e .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/02 15:41 upstream 738d2902773e 25a0186e .config console log report syz C ci-upstream-kasan-gce-root
2019/12/15 12:15 upstream 07c4b9e9f71a eef6e580 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/15 10:04 upstream 07c4b9e9f71a eef6e580 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/15 04:48 upstream 07c4b9e9f71a eef6e580 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/15 00:40 upstream e31736d9fae8 eef6e580 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/13 17:14 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/13 11:52 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/13 11:27 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/13 10:58 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/13 06:18 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/13 05:48 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/13 04:14 upstream ae4b064e2a61 08003f64 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/09 16:10 upstream e42617b825f8 b31eda3d .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/09 06:20 upstream 9455d25f4e3b 1508f453 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/26 16:27 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/26 06:16 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/26 03:51 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/26 02:09 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/25 23:54 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/25 10:13 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/25 03:15 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/24 11:12 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/24 09:29 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/24 00:47 linux-next 7ddd09fc4b74 be5c2c81 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/23 00:40 linux-next 7ddd09fc4b74 8b967267 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/21 14:51 linux-next 7ddd09fc4b74 bc586918 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/29 17:51 upstream bf8d1cd43865 af6b8ef8 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/12/29 12:57 upstream bf8d1cd43865 af6b8ef8 .config console log report syz ci-upstream-kasan-gce-root
2019/12/14 15:47 upstream e31736d9fae8 eef6e580 .config console log report syz ci-upstream-kasan-gce-root
2019/12/06 10:40 upstream b0d4beaa5a4b 98b4ef2d .config console log report syz ci-upstream-kasan-gce-root
2020/01/05 07:42 linux-next 7ddd09fc4b74 68256974 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/02/20 10:52 upstream ca7e1fd1026c 81230308 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/12 03:51 upstream 359c92c02bfa a75b198c .config console log report ci-upstream-kasan-gce-selinux-root
2020/02/11 08:56 upstream 0a679e13ea30 084454ae .config console log report ci-upstream-kasan-gce-smack-root
2020/01/31 22:48 upstream ccaaaf6fe5a5 c30117b2 .config console log report ci-upstream-kasan-gce-root
2020/01/31 05:20 upstream 9f68e3655aae 5ed23f9a .config console log report ci-upstream-kasan-gce-smack-root
2020/01/28 08:34 upstream d5226fa6dbae 56cd6c9b .config console log report ci-upstream-kasan-gce-root
2020/01/26 15:00 upstream 2821e26f3a0a f4e7270e .config console log report ci-upstream-kasan-gce-root
2020/01/24 07:10 upstream 4703d9119972 2e95ab33 .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/22 03:54 upstream d96d875ef5dd 8eda0b95 .config console log report ci-upstream-kasan-gce-root
2020/01/15 11:46 upstream 95e20af9fb9c fa12bd3c .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/14 22:06 upstream e033e7d4a808 fa12bd3c .config console log report ci-upstream-kasan-gce-root
2020/01/14 20:56 upstream e033e7d4a808 fa12bd3c .config console log report ci-upstream-kasan-gce-smack-root
2020/01/14 13:28 upstream b3a987b0264d 32881205 .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/13 23:47 upstream b3a987b0264d 99565c1a .config console log report ci-upstream-kasan-gce-smack-root
2020/01/13 18:12 upstream b3a987b0264d 99565c1a .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/12 19:43 upstream 040a3c33623b 53faa9fe .config console log report ci-qemu-upstream
2020/01/10 12:11 upstream e69ec487b2c7 4de4e9f0 .config console log report ci-upstream-kasan-gce-root
2019/12/24 19:50 upstream 46cf053efec6 be5c2c81 .config console log report ci-upstream-kasan-gce-root
2019/12/20 23:48 upstream 6398b9fc818e bc586918 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/20 08:07 upstream 7e0165b2f1a9 e30cbdae .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/20 08:06 upstream 7e0165b2f1a9 e30cbdae .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/20 07:59 upstream 7e0165b2f1a9 e30cbdae .config console log report ci-upstream-kasan-gce-root
2019/12/18 14:27 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/12 16:00 upstream 687dec9b9459 d973f528 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/11 22:06 upstream 6794862a16ef 101194eb .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/11 08:14 upstream 6794862a16ef 101194eb .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/11 04:46 upstream 6794862a16ef 101194eb .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/08 10:20 upstream ad910e36da4c 1508f453 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/24 06:40 linux-next 7ddd09fc4b74 be5c2c81 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/12/23 11:46 linux-next 7ddd09fc4b74 be5c2c81 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/12/08 10:24 linux-next 558c2bf52f61 1508f453 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/12/08 10:20 linux-next 558c2bf52f61 1508f453 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.