KASAN: use-after-free Read in rfcomm_dlc_exists

Status: auto-closed as invalid on 2020/06/13 06:12
Reported-by: syzbot+adf79ce74134c34a39e4@syzkaller.appspotmail.com
First crash: 2607d, last: 2365d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in rfcomm_dlc_exists 19 17 2397d 2602d 0/1 auto-closed as invalid on 2020/05/12 12:00
upstream KASAN: use-after-free Read in rfcomm_dlc_exists bluetooth 19 833 2321d 2935d 0/29 auto-closed as invalid on 2020/06/27 18:46

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in rfcomm_dlc_get net/bluetooth/rfcomm/core.c:360 [inline]
BUG: KASAN: use-after-free in rfcomm_dlc_exists+0x17d/0x1a0 net/bluetooth/rfcomm/core.c:549
Read of size 1 at addr ffff88809eed0684 by task syz-executor.2/18447

CPU: 0 PID: 18447 Comm: syz-executor.2 Not tainted 4.19.103-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
 rfcomm_dlc_get net/bluetooth/rfcomm/core.c:360 [inline]
 rfcomm_dlc_exists+0x17d/0x1a0 net/bluetooth/rfcomm/core.c:549
 __rfcomm_create_dev net/bluetooth/rfcomm/tty.c:413 [inline]
 rfcomm_create_dev net/bluetooth/rfcomm/tty.c:486 [inline]
 rfcomm_dev_ioctl+0x9c8/0x1c90 net/bluetooth/rfcomm/tty.c:588
 rfcomm_sock_ioctl+0x90/0xb0 net/bluetooth/rfcomm/sock.c:902
 sock_do_ioctl+0xd8/0x2f0 net/socket.c:950
 sock_ioctl+0x325/0x610 net/socket.c:1074
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45c6c9
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f700f468c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f700f4696d4 RCX: 000000000045c6c9
RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005
RBP: 000000000076bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000312 R14: 00000000004c5631 R15: 000000000076bfd4

Allocated by task 15821:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc mm/kasan/kasan.c:553 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
 kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3625
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 rfcomm_dlc_alloc+0x66/0x3f0 net/bluetooth/rfcomm/core.c:305
 rfcomm_sock_alloc.constprop.0+0xb3/0x360 net/bluetooth/rfcomm/sock.c:286
 rfcomm_sock_create+0xf3/0x2b0 net/bluetooth/rfcomm/sock.c:329
 bt_sock_create+0x16a/0x2d0 net/bluetooth/af_bluetooth.c:130
 __sock_create+0x3d8/0x730 net/socket.c:1276
 sock_create net/socket.c:1316 [inline]
 __sys_socket+0x103/0x220 net/socket.c:1346
 __do_sys_socket net/socket.c:1355 [inline]
 __se_sys_socket net/socket.c:1353 [inline]
 __x64_sys_socket+0x73/0xb0 net/socket.c:1353
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 18446:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcf/0x220 mm/slab.c:3822
 rfcomm_dlc_free+0x20/0x30 net/bluetooth/rfcomm/core.c:328
 rfcomm_dlc_put include/net/bluetooth/rfcomm.h:258 [inline]
 __rfcomm_create_dev net/bluetooth/rfcomm/tty.c:417 [inline]
 rfcomm_create_dev net/bluetooth/rfcomm/tty.c:486 [inline]
 rfcomm_dev_ioctl+0x1988/0x1c90 net/bluetooth/rfcomm/tty.c:588
 rfcomm_sock_ioctl+0x90/0xb0 net/bluetooth/rfcomm/sock.c:902
 sock_do_ioctl+0xd8/0x2f0 net/socket.c:950
 sock_ioctl+0x325/0x610 net/socket.c:1074
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88809eed0540
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 324 bytes inside of
 512-byte region [ffff88809eed0540, ffff88809eed0740)
The buggy address belongs to the page:
page:ffffea00027bb400 count:1 mapcount:0 mapping:ffff88812c31c940 index:0xffff88809eed0a40
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea00027e4148 ffffea0002a163c8 ffff88812c31c940
raw: ffff88809eed0a40 ffff88809eed0040 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809eed0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88809eed0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88809eed0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88809eed0700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88809eed0780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
==================================================================

Crashes (46):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/14 06:11 linux-4.19.y 357668399cf7 5d7b90f1 .config console log report ci2-linux-4-19
2020/01/19 07:37 linux-4.19.y dc4ba5be1bab bc8bc756 .config console log report ci2-linux-4-19
2020/01/16 12:39 linux-4.19.y db5b9190ff82 3de7aabb .config console log report ci2-linux-4-19
2020/01/15 18:44 linux-4.19.y db5b9190ff82 f9b69507 .config console log report ci2-linux-4-19
2020/01/15 16:20 linux-4.19.y db5b9190ff82 069a5a44 .config console log report ci2-linux-4-19
2020/01/12 16:30 linux-4.19.y dcd888983542 31290a45 .config console log report ci2-linux-4-19
2020/01/09 22:49 linux-4.19.y cb1f9a169a0e 4de4e9f0 .config console log report ci2-linux-4-19
2019/12/30 08:30 linux-4.19.y 672481c2deff af6b8ef8 .config console log report ci2-linux-4-19
2019/12/29 18:18 linux-4.19.y 672481c2deff af6b8ef8 .config console log report ci2-linux-4-19
2019/12/29 13:29 linux-4.19.y 672481c2deff af6b8ef8 .config console log report ci2-linux-4-19
2019/12/29 07:23 linux-4.19.y 672481c2deff af6b8ef8 .config console log report ci2-linux-4-19
2019/12/28 12:01 linux-4.19.y 672481c2deff af6b8ef8 .config console log report ci2-linux-4-19
2019/12/28 11:36 linux-4.19.y 672481c2deff af6b8ef8 .config console log report ci2-linux-4-19
2019/12/28 08:38 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/28 07:44 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/28 07:09 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/28 03:17 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/27 11:22 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/27 04:02 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/26 17:17 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/25 19:06 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/25 11:04 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/25 10:19 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/25 10:05 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/25 08:24 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/24 06:08 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/06 08:41 linux-4.19.y fb683b5e3f53 98b4ef2d .config console log report ci2-linux-4-19
2019/11/25 09:31 linux-4.19.y 14260788bbb9 598ca6c8 .config console log report ci2-linux-4-19
2019/11/18 05:28 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/02 09:09 linux-4.19.y ef244c308885 997ccc67 .config console log report ci2-linux-4-19
2019/11/01 06:50 linux-4.19.y ef244c308885 a41ca8fa .config console log report ci2-linux-4-19
2019/10/25 12:18 linux-4.19.y c3038e718a19 04ca72cd .config console log report ci2-linux-4-19
2019/10/20 08:57 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/07 08:52 linux-4.19.y 6cad9d0cf87b 28ac6e64 .config console log report ci2-linux-4-19
2019/09/21 06:52 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/16 03:20 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/10 03:57 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
2019/09/10 02:02 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
2019/08/17 14:57 linux-4.19.y a5aa80588fcd 55bf8926 .config console log report ci2-linux-4-19
2019/08/14 12:54 linux-4.19.y 893af1c79e42 5576551b .config console log report ci2-linux-4-19
2019/08/06 18:08 linux-4.19.y cc4c818b2219 da562c0b .config console log report ci2-linux-4-19
2019/07/29 14:18 linux-4.19.y 64f4694072aa f67095ee .config console log report ci2-linux-4-19
2019/07/19 11:50 linux-4.19.y 3bd837bfe431 8304907d .config console log report ci2-linux-4-19
2019/06/23 23:48 linux-4.19.y 78778071092e 472f0082 .config console log report ci2-linux-4-19
2019/06/21 08:36 linux-4.19.y 9f31eb60d7a2 34bf9440 .config console log report ci2-linux-4-19
2019/06/17 10:22 linux-4.19.y 7aa823a959e1 442206d7 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.