KASAN: use-after-free Read in idr_for

KASAN: use-after-free Read in idr_for_each (2)
Status: upstream: reported C repro on 2020/10/05 08:56
Reported-by: syzbot+12056a09a0311d758e60@syzkaller.appspotmail.com
First crash: 148d, last: 16h59m

Cause bisection: failed (bisect log)

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: use-after-free Read in idr_for_each	C			4	180d	199d	0/21	closed as dup on 2020/08/13 18:43

Patch testing requests:
Created	Duration	User	Patch	Repo	Result
2020/12/18 15:47	17m	asml.silence@gmail.com		git://git.kernel.dk/linux-block dfea9fce29fda6f2f91161677e0e0d9b671bc099	report log

Sample crash report:

==================================================================
BUG: KASAN: use-after-free in radix_tree_next_slot include/linux/radix-tree.h:422 [inline]
BUG: KASAN: use-after-free in idr_for_each+0x206/0x220 lib/idr.c:202
Read of size 8 at addr ffff88803da186b8 by task syz-executor716/4856

CPU: 0 PID: 4856 Comm: syz-executor716 Not tainted 5.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:396 [inline]
 kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413
 radix_tree_next_slot include/linux/radix-tree.h:422 [inline]
 idr_for_each+0x206/0x220 lib/idr.c:202
 io_ring_ctx_wait_and_kill+0x1bd/0x600 fs/io_uring.c:8795
 io_uring_release+0x3e/0x50 fs/io_uring.c:8820
 __fput+0x283/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x190 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0xc5c/0x2ae0 kernel/exit.c:825
 do_group_exit+0x125/0x310 kernel/exit.c:922
 get_signal+0x427/0x20f0 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:201
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:315
 exc_page_fault+0xc6/0x180 arch/x86/mm/fault.c:1509
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:580
RIP: 0033:0x401994
Code: Unable to access opcode bytes at RIP 0x40196a.
RSP: 002b:00007ffcab01c3f0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000010
RDX: 0000000000000007 RSI: 0000000000000000 RDI: 00000000000001c0
RBP: 0000000000000000 R08: 0000000020ffc000 R09: 0000000000100140
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000003373e
R13: 00007ffcab01c3fc R14: 00007ffcab01c410 R15: 00007ffcab01c400

Allocated by task 4856:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:401 [inline]
 ____kasan_kmalloc.constprop.0+0x7f/0xa0 mm/kasan/common.c:429
 kasan_slab_alloc include/linux/kasan.h:209 [inline]
 slab_post_alloc_hook mm/slab.h:512 [inline]
 slab_alloc mm/slab.c:3315 [inline]
 kmem_cache_alloc+0x1ab/0x4c0 mm/slab.c:3486
 radix_tree_node_alloc.constprop.0+0x7c/0x350 lib/radix-tree.c:274
 idr_get_free+0x554/0xa60 lib/radix-tree.c:1504
 idr_alloc_u32+0x170/0x2d0 lib/idr.c:46
 idr_alloc_cyclic+0x102/0x230 lib/idr.c:125
 io_register_personality fs/io_uring.c:9873 [inline]
 __io_uring_register fs/io_uring.c:10102 [inline]
 __do_sys_io_uring_register+0x162f/0x4080 fs/io_uring.c:10152
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 12:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:356
 ____kasan_slab_free+0xb0/0xe0 mm/kasan/common.c:362
 kasan_slab_free include/linux/kasan.h:192 [inline]
 __cache_free mm/slab.c:3424 [inline]
 kmem_cache_free+0x58/0x1c0 mm/slab.c:3697
 rcu_do_batch kernel/rcu/tree.c:2489 [inline]
 rcu_core+0x5eb/0xf00 kernel/rcu/tree.c:2723
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:343

Last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0x87/0xb0 mm/kasan/generic.c:344
 __call_rcu kernel/rcu/tree.c:2965 [inline]
 call_rcu+0xbb/0x700 kernel/rcu/tree.c:3038
 radix_tree_node_free lib/radix-tree.c:308 [inline]
 delete_node+0x591/0x8c0 lib/radix-tree.c:571
 __radix_tree_delete+0x190/0x370 lib/radix-tree.c:1377
 radix_tree_delete_item+0xe7/0x230 lib/radix-tree.c:1428
 io_remove_personalities+0x1d/0x170 fs/io_uring.c:8740
 idr_for_each+0x113/0x220 lib/idr.c:208
 io_ring_ctx_wait_and_kill+0x1bd/0x600 fs/io_uring.c:8795
 io_uring_release+0x3e/0x50 fs/io_uring.c:8820
 __fput+0x283/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x190 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0xc5c/0x2ae0 kernel/exit.c:825
 do_group_exit+0x125/0x310 kernel/exit.c:922
 get_signal+0x427/0x20f0 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:201
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:315
 exc_page_fault+0xc6/0x180 arch/x86/mm/fault.c:1509
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:580

Second to last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0x87/0xb0 mm/kasan/generic.c:344
 __call_rcu kernel/rcu/tree.c:2965 [inline]
 call_rcu+0xbb/0x700 kernel/rcu/tree.c:3038
 xa_node_free lib/xarray.c:258 [inline]
 xas_delete_node lib/xarray.c:494 [inline]
 update_node lib/xarray.c:756 [inline]
 xas_store+0xbcc/0x1bb0 lib/xarray.c:841
 __xa_erase lib/xarray.c:1489 [inline]
 xa_erase+0xb0/0x170 lib/xarray.c:1510
 io_uring_del_task_file fs/io_uring.c:9044 [inline]
 io_uring_remove_task_files+0xc8/0x1a0 fs/io_uring.c:9055
 __io_uring_files_cancel+0x15a/0x1b0 fs/io_uring.c:9071
 io_uring_files_cancel include/linux/io_uring.h:51 [inline]
 do_exit+0x2fe/0x2ae0 kernel/exit.c:780
 do_group_exit+0x125/0x310 kernel/exit.c:922
 get_signal+0x427/0x20f0 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:201
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:315
 exc_page_fault+0xc6/0x180 arch/x86/mm/fault.c:1509
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:580

The buggy address belongs to the object at ffff88803da18680
 which belongs to the cache radix_tree_node of size 576
The buggy address is located 56 bytes inside of
 576-byte region [ffff88803da18680, ffff88803da188c0)
The buggy address belongs to the page:
page:000000006c86c827 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88803da18ffb pfn:0x3da18
flags: 0xfff00000000200(slab)
raw: 00fff00000000200 ffffea0000f685c8 ffffea0000f68688 ffff888010c6f000
raw: ffff88803da18ffb ffff88803da18100 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88803da18580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88803da18600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88803da18680: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff88803da18700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88803da18780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (78):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce-selinux-root	2021/02/05 20:33	upstream	dd86e7fa	23a562df	.config	log	report	syz	C		KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2020/11/28 17:18	upstream	c84e1efa	76b4dcc7	.config	log	report	syz	C
ci-upstream-kasan-gce-smack-root	2021/01/17 08:22	upstream	0da0a8a0	65a7a854	.config	log	report	syz
ci-upstream-kasan-gce-smack-root	2021/02/26 14:45	upstream	2c87f7a3	4c37c133	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/02/26 05:09	upstream	29c395c7	76f7fc95	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/02/24 23:27	upstream	719bbd4a	fcc6d71b	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2021/02/22 19:11	upstream	a99163e9	c26fb06b	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2021/02/22 06:18	upstream	55f62bc8	a659b3f1	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/02/19 23:22	upstream	f40ddce8	f689d40a	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-selinux-root	2021/02/18 14:05	upstream	f40ddce8	14052202	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/02/18 02:17	upstream	f40ddce8	14052202	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/02/16 23:09	upstream	f40ddce8	98682e5e	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/02/11 12:39	upstream	291009f6	a52ee10a	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2021/02/10 15:48	upstream	e0756cfc	2bd9619f	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2021/02/09 15:33	upstream	e0756cfc	2bd9619f	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/02/08 23:08	upstream	e0756cfc	2bd9619f	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2021/02/04 22:41	upstream	61556703	42b90a7c	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/02/04 10:56	upstream	61556703	42b90a7c	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-selinux-root	2021/02/03 09:54	upstream	3aaf0a27	624dad51	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-root	2021/01/31 12:58	upstream	6642d600	fc9fd31e	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-selinux-root	2021/01/26 17:06	upstream	13391c60	55a7d4df	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/01/26 08:23	upstream	f8ad8187	52e37319	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/01/25 19:24	upstream	6ee1d745	52e37319	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/01/24 08:20	upstream	e1ae4b0b	52e37319	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-selinux-root	2021/01/24 01:47	upstream	e1ae4b0b	52e37319	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/01/21 00:14	upstream	75439bc4	d4f4eca5	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/01/20 17:01	upstream	45dfb8a5	d4f4eca5	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-selinux-root	2021/01/19 23:02	upstream	1e2a199f	63631df1	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-smack-root	2021/01/19 13:18	upstream	1e2a199f	63631df1	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64	2021/02/28 06:22	upstream	5695e516	4c37c133	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64	2021/02/27 20:33	upstream	3fb6d0e0	4c37c133	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64	2021/02/25 21:32	upstream	29c395c7	76f7fc95	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/25 12:35	upstream	29c395c7	fcc6d71b	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64	2021/02/22 08:47	upstream	31caf8b2	a659b3f1	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/15 01:38	upstream	f40ddce8	98682e5e	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/12 21:24	upstream	dcc0b490	98682e5e	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/12 07:46	upstream	dcc0b490	a5f86b15	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64	2021/02/11 18:35	upstream	291009f6	a5f86b15	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/07 23:21	upstream	b75dba7f	2ce644fc	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/07 07:42	upstream	825b5991	2ce644fc	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/06 12:40	upstream	1e0d27fc	0655e081	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-386	2021/02/06 08:34	upstream	1e0d27fc	23a562df	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/02/02 15:08	upstream	88bb507a	19e09687	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce-386	2021/01/30 23:35	upstream	8c947645	fc9fd31e	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/01/30 00:46	upstream	bec4c296	93d04185	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-qemu2-arm64-compat	2021/01/28 11:51	upstream	76c057c8	eefc07f2	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-linux-next-kasan-gce-root	2021/02/06 07:10	linux-next	aa2b8820	23a562df	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-linux-next-kasan-gce-root	2021/02/03 01:50	linux-next	fb2a9c32	624dad51	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-linux-next-kasan-gce-root	2021/01/18 07:27	linux-next	b3a3cbde	fd103621	.config	log	report			info	KASAN: use-after-free Read in idr_for_each
ci-upstream-kasan-gce	2021/01/17 10:32	upstream	0da0a8a0	65a7a854	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2021/01/16 08:59	upstream	1d94330a	65a7a854	.config	log	report			info
ci-upstream-kasan-gce-root	2021/01/16 00:37	upstream	5ee88057	65a7a854	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2021/01/16 00:03	upstream	5ee88057	65a7a854	.config	log	report			info
ci-upstream-kasan-gce	2021/01/14 10:43	upstream	65f0d241	269d24e8	.config	log	report			info
ci-upstream-kasan-gce	2021/01/13 21:27	upstream	e609571b	a945f0a3	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2021/01/11 09:58	upstream	0653161f	2c1f2513	.config	log	report			info
ci-upstream-kasan-gce-root	2021/01/10 09:09	upstream	2ff90100	2c1f2513	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2021/01/08 20:20	upstream	f5e6c330	c104d4a3	.config	log	report			info
ci-upstream-kasan-gce-root	2020/12/28 06:28	upstream	5c8fe583	2242f77f	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/12/25 19:52	upstream	71c5f031	b982b3ea	.config	log	report			info
ci-upstream-kasan-gce	2020/12/21 13:47	upstream	e37b12e4	04201c06	.config	log	report			info
ci-upstream-kasan-gce-smack-root	2020/12/10 17:18	upstream	a2f5ea9e	f900b48c	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/12/07 15:29	upstream	0477e928	1190297f	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/12/05 19:43	upstream	b3298500	50503117	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/11/22 03:53	upstream	a349e4c6	0d27f508	.config	log	report			info
ci-upstream-kasan-gce-root	2020/11/17 13:45	upstream	9c87c9f4	bd2a760b	.config	log	report			info
ci-upstream-kasan-gce-selinux-root	2020/11/14 18:20	upstream	f01c30de	1bf9a662	.config	log	report			info
ci-upstream-kasan-gce-root	2020/11/02 22:12	upstream	3cea11cd	8bc4594f	.config	log	report			info
ci-qemu2-arm64-mte	2021/02/23 11:17	upstream	a99163e9	fcc6d71b	.config	log	report			info	KASAN: invalid-access Read in idr_for_each
ci-qemu2-arm64-mte	2021/02/10 19:49	upstream	e0756cfc	9c8b8541	.config	log	report			info	KASAN: invalid-access Read in idr_for_each
ci-upstream-kasan-gce-386	2020/10/03 01:53	upstream	472e5b05	4969d6ca	.config	log	report			info
ci-upstream-linux-next-kasan-gce-root	2021/01/13 14:01	linux-next	aa515cdc	a945f0a3	.config	log	report			info
ci-upstream-linux-next-kasan-gce-root	2021/01/10 16:58	linux-next	1c925d20	2c1f2513	.config	log	report			info
ci-upstream-linux-next-kasan-gce-root	2021/01/08 08:17	linux-next	2d3811a4	c104d4a3	.config	log	report			info
ci-upstream-linux-next-kasan-gce-root	2021/01/07 02:48	linux-next	7e4525a4	c104d4a3	.config	log	report			info
ci-upstream-linux-next-kasan-gce-root	2020/12/26 10:23	linux-next	d7a03a44	821e0b09	.config	log	report			info
ci-upstream-linux-next-kasan-gce-root	2020/12/13 07:48	linux-next	14240d4c	bca53db9	.config	log	report			info