syzbot


KASAN: use-after-free Write in __internal_add_timer

Status: upstream: reported C repro on 2020/07/04 17:00
Reported-by: syzbot+808b558a11df12fd2957@syzkaller.appspotmail.com
First crash: 887d, last: 4h19m
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Write in __internal_add_timer C 36071 1873d 1862d 0/24 closed as invalid on 2017/11/01 19:41
android-54 KASAN: slab-out-of-bounds Write in __internal_add_timer (2) 4 488d 663d 0/2 auto-closed as invalid on 2021/12/05 06:45
android-54 KASAN: slab-out-of-bounds Write in __internal_add_timer 4 801d 875d 0/2 auto-closed as invalid on 2021/01/26 06:16
upstream KASAN: slab-out-of-bounds Write in __internal_add_timer 4 1907d 1862d 0/24 closed as invalid on 2017/11/05 08:51

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:796 [inline]
BUG: KASAN: use-after-free in enqueue_timer kernel/time/timer.c:541 [inline]
BUG: KASAN: use-after-free in __internal_add_timer+0x2a6/0x4a0 kernel/time/timer.c:554
Write of size 8 at addr ffff8881e88d71c8 by task syz-executor683/9667

CPU: 1 PID: 9667 Comm: syz-executor683 Not tainted 5.4.197-syzkaller-00015-gf0306959ab7c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18e/0x1d5 lib/dump_stack.c:118
 print_address_description+0x8c/0x630 mm/kasan/report.c:384
 __kasan_report+0xf6/0x130 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 hlist_add_head include/linux/list.h:796 [inline]
 enqueue_timer kernel/time/timer.c:541 [inline]
 __internal_add_timer+0x2a6/0x4a0 kernel/time/timer.c:554
 internal_add_timer kernel/time/timer.c:604 [inline]
 __mod_timer+0x9ce/0x1a40 kernel/time/timer.c:1065
 tun_set_iff+0x8ca/0x1050 drivers/net/tun.c:2854
 __tun_chr_ioctl+0x6c7/0x1b70 drivers/net/tun.c:3149
 do_vfs_ioctl+0x6d1/0x15b0 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f14585329b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f14584e4318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f14585ba3e8 RCX: 00007f14585329b9
RDX: 0000000020000040 RSI: 00000000400454ca RDI: 0000000000000003
RBP: 00007f14585ba3e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 74656e2f7665642f
R13: 00007ffe391a6e8f R14: 00007f14584e4400 R15: 0000000000022000

The buggy address belongs to the page:
page:ffffea0007a235c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x8000000000000000()
raw: 8000000000000000 0000000000000000 ffffea0007a235c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x46dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP|__GFP_ZERO)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x194/0x380 mm/page_alloc.c:2171
 get_page_from_freelist+0x524/0x560 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x2ab/0x6f0 mm/page_alloc.c:4857
 __alloc_pages include/linux/gfp.h:503 [inline]
 __alloc_pages_node include/linux/gfp.h:516 [inline]
 alloc_pages_node include/linux/gfp.h:530 [inline]
 kmalloc_order mm/slab_common.c:1342 [inline]
 kmalloc_order_trace+0x2a/0xf0 mm/slab_common.c:1358
 __kmalloc_node include/linux/slab.h:422 [inline]
 kmalloc_node include/linux/slab.h:599 [inline]
 kvmalloc_node+0x7e/0xf0 mm/util.c:564
 kvmalloc include/linux/mm.h:758 [inline]
 kvzalloc include/linux/mm.h:766 [inline]
 alloc_netdev_mqs+0x86/0xc30 net/core/dev.c:9597
 tun_set_iff+0x4f9/0x1050 drivers/net/tun.c:2814
 __tun_chr_ioctl+0x6c7/0x1b70 drivers/net/tun.c:3149
 do_vfs_ioctl+0x6d1/0x15b0 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0x7ee/0x920 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4919 [inline]
 __free_pages+0x45/0x1e0 mm/page_alloc.c:4925
 kfree+0x1ef/0x260 mm/slub.c:4068
 device_release+0x70/0x1a0 drivers/base/core.c:1776
 kobject_cleanup lib/kobject.c:708 [inline]
 kobject_release+0x1f3/0x3d0 lib/kobject.c:739
 tun_set_iff+0xc0b/0x1050 drivers/net/tun.c:2906
 __tun_chr_ioctl+0x6c7/0x1b70 drivers/net/tun.c:3149
 do_vfs_ioctl+0x6d1/0x15b0 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8881e88d7080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881e88d7100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881e88d7180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff8881e88d7200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881e88d7280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (142):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-android-5-4-kasan 2022/09/03 23:36 android12-5.4 f0306959ab7c 28811d0a .config log report syz C KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-kasan 2020/07/08 22:55 https://android.googlesource.com/kernel/common android-5.4 07da2129a868 9f9845eb .config log report syz
ci2-android-5-4-perf-kasan 2022/10/27 10:16 android12-5.4 035e4939365c 86777b7f .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/10/14 23:57 android12-5.4 ff63a5f5cdf6 67cb024c .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/10/03 03:33 android12-5.4 3ee2a37108c8 feb56351 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/10/01 17:06 android12-5.4 3ee2a37108c8 feb56351 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/23 00:03 android12-5.4 def19b1cf16c 0042f2b4 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/13 09:13 android12-5.4 704c7d053806 a08652b0 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/10 14:46 android12-5.4 704c7d053806 356d8217 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/08 10:29 android12-5.4 704c7d053806 435aeef7 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/06 15:56 android12-5.4 a5eb56fb2ab4 65aea2b9 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/02 06:08 android12-5.4 f0306959ab7c a805568e .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/30 22:15 android12-5.4 f0306959ab7c 4a380809 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/29 13:09 android12-5.4 f0306959ab7c 94da0b6b .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/23 17:27 android12-5.4 f3c75e616e3f cea8b0f7 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/19 12:03 android12-5.4 c991311c3375 26a13b38 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/18 23:16 android12-5.4 2bf0b614f0fb 26a13b38 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/16 23:32 android12-5.4 2bf0b614f0fb 9e4b39c2 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/14 16:01 android12-5.4 2bf0b614f0fb 8dfcaa3d .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/10 15:04 android12-5.4 c7a5efa26008 aaa9eaa0 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/06 07:11 android12-5.4 19a66b6f3cd8 e853abd9 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/06 03:17 android12-5.4 19a66b6f3cd8 e853abd9 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/05 12:22 android12-5.4 19a66b6f3cd8 a65a7ce9 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/05 07:27 android12-5.4 19a66b6f3cd8 1c9013ac .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/04 03:23 android12-5.4 ea07addb2369 1c9013ac .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/01 04:59 android12-5.4 2bde2e268ec7 fef302b1 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/07/29 17:32 android12-5.4 2bde2e268ec7 fef302b1 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/07/22 10:36 android12-5.4 330fa791a029 5e6028b9 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/07/20 16:20 android12-5.4 330fa791a029 88cb1383 .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/07/20 04:36 android12-5.4 330fa791a029 775344bc .config log report info KASAN: use-after-free Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/12/08 12:58 android12-5.4 d7e5d5321233 d88f3abb .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/12/07 22:00 android12-5.4 d7e5d5321233 d88f3abb .config log report info KASAN: out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/12/05 04:55 android12-5.4 1c84384fbdc7 e080de16 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/11/09 09:09 android12-5.4 5e295dcf7dcb 5fa28208 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/11/01 15:50 android12-5.4 dd9d210aa955 a1d8560a .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/10/28 06:07 android12-5.4 035e4939365c 5c716ff6 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/10/24 06:21 android12-5.4 8c70a830a157 23bf86af .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/30 20:06 android12-5.4 3ee2a37108c8 feb56351 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/23 18:49 android12-5.4 def19b1cf16c 0042f2b4 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/04 00:56 android12-5.4 f0306959ab7c 28811d0a .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/09/01 15:40 android12-5.4 f0306959ab7c 86c46e46 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/27 15:29 android12-5.4 f0306959ab7c 07177916 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/23 05:25 android12-5.4 f3c75e616e3f 26a13b38 .config log report info KASAN: out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/16 06:09 android12-5.4 2bf0b614f0fb 7a7cb304 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/08/06 14:43 android12-5.4 19a66b6f3cd8 88e3a122 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/07/23 12:14 android12-5.4 397b3ca493cb 22343af4 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-perf-kasan 2022/07/14 12:41 android12-5.4 330fa791a029 5d921b08 .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-kasan 2022/03/07 01:44 android12-5.4 8a3679a75730 7bdd8b2c .config log report info KASAN: slab-out-of-bounds Write in __internal_add_timer
ci2-android-5-4-kasan 2021/01/03 08:18 android12-5.4 e627b02af655 79264ae3 .config log report info
ci2-android-5-4-kasan 2020/07/04 16:59 https://android.googlesource.com/kernel/common android-5.4 45217b91eaaa 4f739670 .config log report
* Struck through repros no longer work on HEAD.