syzbot


KASAN: use-after-free Read in mm_update_next_owner

Status: auto-closed as invalid on 2020/12/25 00:54
Reported-by: syzbot+db62f13e54c2145e1e96@syzkaller.appspotmail.com
First crash: 1336d, last: 1336d

Sample crash report:
ipt_CLUSTERIP: bad local_nodes[5] 4132
x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not raw
ipt_CLUSTERIP: bad local_nodes[5] 4132
==================================================================
BUG: KASAN: use-after-free in mm_update_next_owner+0x569/0x650 kernel/exit.c:453
Read of size 8 at addr ffff8880486afe90 by task syz-executor.0/22971

CPU: 1 PID: 22971 Comm: syz-executor.0 Not tainted 4.19.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
 mm_update_next_owner+0x569/0x650 kernel/exit.c:453
 exit_mm kernel/exit.c:545 [inline]
 do_exit+0xaad/0x2b70 kernel/exit.c:874
 do_group_exit+0x125/0x310 kernel/exit.c:990
 __do_sys_exit_group kernel/exit.c:1001 [inline]
 __se_sys_exit_group kernel/exit.c:999 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:999
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5b9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff3bce7c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000001e RCX: 000000000045d5b9
RDX: 0000000000416f01 RSI: fffffffffffffff7 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fff3bce7cf0
R10: 0000000001190e20 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff3bce7cf0 R14: 0000000000000000 R15: 00007fff3bce7d00

The buggy address belongs to the page:
page:ffffea000121abc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0xfffe0000000000()
raw: 00fffe0000000000 0000000000000000 ffffffff00000101 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880486afd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880486afe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880486afe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                         ^
 ffff8880486aff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880486aff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/27 00:53 linux-4.19.y f6d5cb9e2c06 318430cb .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.