KASAN: use-after-free Read in do_general

[upstream] KASAN: use-after-free Read in do_general_protection
Status: upstream: reported C repro on 2018/05/26 09:16
Reported-by: syzbot+a1264132fc103340628f@syzkaller.appspotmail.com
First: 55d, last: 26d

duplicates:
Title	Repro	Count	Last	Reported	Status
KASAN: use-after-scope Read in vmx_vcpu_run		1	101d	99d	closed as dup on 2018/05/26 09:26
KASAN: stack-out-of-bounds Read in unwind_next_frame	C	2	6d18h	30d	closed as dup on 2018/06/20 07:51
KASAN: stack-out-of-bounds Read in do_general_protection	syz	8	1d15h	55d	closed as dup on 2018/05/26 09:25
KASAN: slab-out-of-bounds Read in vmx_vcpu_run		1	72d	68d	closed as dup on 2018/05/26 09:26
KASAN: stack-out-of-bounds Write in notify_die		1	61d	55d	closed as dup on 2018/05/26 09:26

Sample crash report:

random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KASAN: use-after-free in do_general_protection+0x2ac/0x2f0 arch/x86/kernel/traps.c:539
Read of size 8 at addr ffff8801ac11f358 by task syz-executor216/4585

CPU: 1 PID: 4585 Comm: syz-executor216 Not tainted 4.18.0-rc2+ #116
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

The buggy address belongs to the page:
page:ffffea0006b047c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 0000000000000000 ffffffff06b00101 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801ac11f200: 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff
 ffff8801ac11f280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8801ac11f300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                    ^
 ffff8801ac11f380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801ac11f400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 4585 Comm: syz-executor216 Tainted: G    B             4.18.0-rc2+ #116
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

All crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-root	2018/06/24 20:08	upstream	7daf201d7fe8334e2d2364d4e8ed3394ec9af819	2064fc5c9114c170841328aaa4b124a4062becf6	.config	log	report	syz	C	[]
ci-upstream-kasan-gce	2018/05/26 06:25	upstream	62d18ecfa64137349fac9c5817784fbd48b54f48	f48c20b8f9b2a6c26629f11cc15e1c9c316572c8	.config	log	report	syz	C	[]