syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12505] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in disk_unblock_events

Status: fixed on 2018/04/09 09:36
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+148f2573ec86c854cdac7339c41b98e31a94150a@syzkaller.appspotmail.com
Fix commit: 897366537fb6 genhd: Fix use after free in __blkdev_get()
First crash: 2379d, last: 2262d
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 KASAN: use-after-free Read in disk_unblock_events C 367 1603d 1840d 0/2 public: reported C repro on 2019/04/12 00:00
android-49 KASAN: use-after-free Read in disk_unblock_events C 665 1936d 2376d 0/3 closed as invalid on 2019/01/08 21:30
android-49 KASAN: use-after-free Read in disk_unblock_events (2) C 200 1606d 1841d 0/3 public: reported C repro on 2019/04/11 08:44
linux-4.14 KASAN: use-after-free Read in disk_unblock_events C error 129 594d 1833d 0/1 upstream: reported C repro on 2019/04/19 06:17
android-414 KASAN: use-after-free Read in disk_unblock_events C 114 1608d 1841d 0/1 public: reported C repro on 2019/04/11 00:00

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 block/genhd.c:1657
Read of size 8 at addr ffff8801d4f82e40 by task blkid/4168

CPU: 1 PID: 4168 Comm: blkid Not tainted 4.15.0-rc8+ #263
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
 disk_unblock_events+0x51/0x60 block/genhd.c:1657
 __blkdev_get+0x869/0x10e0 fs/block_dev.c:1535
 blkdev_get+0x3a1/0xad0 fs/block_dev.c:1591
 blkdev_open+0x1c9/0x250 fs/block_dev.c:1749
 do_dentry_open+0x667/0xd40 fs/open.c:752
 vfs_open+0x107/0x220 fs/open.c:866
 do_last fs/namei.c:3379 [inline]
 path_openat+0x1151/0x3530 fs/namei.c:3519
 do_filp_open+0x25b/0x3b0 fs/namei.c:3554
 do_sys_open+0x502/0x6d0 fs/open.c:1059
 SYSC_open fs/open.c:1077 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1072
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x7fc3ad794120
RSP: 002b:00007fff61c14658 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fc3adc7587c RCX: 00007fc3ad794120
RDX: 00007fff61c16f45 RSI: 0000000000000000 RDI: 00007fff61c16f45
RBP: 00007fff61c16f3d R08: 0000000000000078 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403738
R13: 0000000000000001 R14: 0000000000000000 R15: 00007fc3ada6aa20

Allocated by task 4153:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 kmem_cache_alloc_node_trace+0x150/0x750 mm/slab.c:3653
 kmalloc_node include/linux/slab.h:537 [inline]
 kzalloc_node include/linux/slab.h:699 [inline]
 __alloc_disk_node+0xb4/0x4e0 block/genhd.c:1400
 loop_add+0x44c/0xa70 drivers/block/loop.c:1814
 loop_control_ioctl+0x2e9/0x490 drivers/block/loop.c:1972
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x29/0xa0

Freed by task 4168:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3488 [inline]
 kfree+0xd6/0x260 mm/slab.c:3803
 disk_release+0x327/0x410 block/genhd.c:1249
 device_release+0x7c/0x210 drivers/base/core.c:814
 kobject_cleanup lib/kobject.c:648 [inline]
 kobject_release lib/kobject.c:677 [inline]
 kref_put include/linux/kref.h:70 [inline]
 kobject_put+0x14c/0x250 lib/kobject.c:694
 put_disk+0x23/0x30 block/genhd.c:1465
 __blkdev_get+0x7c9/0x10e0 fs/block_dev.c:1528
 blkdev_get+0x3a1/0xad0 fs/block_dev.c:1591
 blkdev_open+0x1c9/0x250 fs/block_dev.c:1749
 do_dentry_open+0x667/0xd40 fs/open.c:752
 vfs_open+0x107/0x220 fs/open.c:866
 do_last fs/namei.c:3379 [inline]
 path_openat+0x1151/0x3530 fs/namei.c:3519
 do_filp_open+0x25b/0x3b0 fs/namei.c:3554
 do_sys_open+0x502/0x6d0 fs/open.c:1059
 SYSC_open fs/open.c:1077 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1072
 entry_SYSCALL_64_fastpath+0x29/0xa0

The buggy address belongs to the object at ffff8801d4f828c0
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1408 bytes inside of
 2048-byte region [ffff8801d4f828c0, ffff8801d4f830c0)
The buggy address belongs to the page:
page:ffffea000753e080 count:1 mapcount:0 mapping:ffff8801d4f82040 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffff8801d4f82040 0000000000000000 0000000100000003
raw: ffffea000753e020 ffffea000763c420 ffff8801dac00c40 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d4f82d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d4f82d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d4f82e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff8801d4f82e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d4f82f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (65):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/16 12:00 upstream a8750ddca918 4198e588 .config console log report syz C ci-upstream-kasan-gce
2018/01/03 23:46 upstream d6bbd51587ec 00193447 .config console log report syz C ci-upstream-kasan-gce
2017/12/23 08:05 upstream 9c294ec08408 73aba437 .config console log report syz C ci-upstream-kasan-gce
2017/10/25 04:47 upstream ae59df0349ba 3d7d860f .config console log report syz C ci-upstream-kasan-gce
2018/01/16 16:11 upstream a8750ddca918 4198e588 .config console log report syz C ci-upstream-kasan-gce-386
2017/12/23 07:58 upstream 9c294ec08408 73aba437 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/16 16:05 linux-next fdddade65d7b 4198e588 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/16 14:53 mmots ce3c209f6733 4198e588 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/04 00:29 mmots ad036b63ee57 00193447 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/03 23:32 linux-next 73005e1a35fd 00193447 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/24 08:30 linux-next 0e08c463db38 73aba437 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/23 21:54 mmots 37759fa6d0fa 73aba437 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/10/29 20:52 linux-next 36ef71cae353 e511d9f8 .config console log report syz C ci-upstream-next-kasan-gce
2017/10/29 08:27 linux-next 36ef71cae353 e511d9f8 .config console log report syz C ci-upstream-next-kasan-gce
2017/10/28 12:26 linux-next 36ef71cae353 e511d9f8 .config console log report syz C ci-upstream-next-kasan-gce
2017/10/25 04:54 linux-next 36ef71cae353 e511d9f8 .config console log report syz C ci-upstream-next-kasan-gce
2017/10/25 04:47 mmots 0f611fb6dcc0 e0a2b195 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/10/28 12:22 upstream 11224e1fc40a 80c74880 .config console log report syz ci-upstream-kasan-gce
2017/10/25 04:31 upstream ae59df0349ba 3d7d860f .config console log report syz ci-upstream-kasan-gce
2018/02/13 18:37 upstream 61f14c015f5b 88bc17df .config console log report ci-upstream-kasan-gce
2018/02/02 16:36 upstream 4bf772b14675 632a8c2c .config console log report ci-upstream-kasan-gce
2018/01/17 19:08 upstream 8cbab92dff77 d7bc5820 .config console log report ci-upstream-kasan-gce
2017/12/27 08:47 upstream beacbc68ac3e 09c8f4c0 .config console log report ci-upstream-kasan-gce
2017/12/23 08:12 upstream 9c294ec08408 73aba437 .config console log report ci-upstream-kasan-gce
2017/12/03 21:03 upstream ae64f9bd1d36 48359b97 .config console log report ci-upstream-kasan-gce
2017/11/21 12:36 upstream e1d1ea549b57 d4d14b03 .config console log report ci-upstream-kasan-gce
2017/11/14 14:20 upstream 43ff2f4db9d0 cf38de00 .config console log report ci-upstream-kasan-gce
2017/11/12 03:41 upstream b39545684a90 e0a2b195 .config console log report ci-upstream-kasan-gce
2017/11/10 22:29 upstream 5cf2360ba6ec e0a2b195 .config console log report ci-upstream-kasan-gce
2017/11/10 07:42 upstream 1c9dbd4615fd e0a2b195 .config console log report ci-upstream-kasan-gce
2017/11/03 19:37 upstream 866ba84ea30f e930d6f6 .config console log report ci-upstream-kasan-gce
2017/10/28 04:16 upstream 15f859ae5c43 80c74880 .config console log report ci-upstream-kasan-gce
2017/12/12 11:43 upstream a638349bf6c2 081721ff .config console log report ci-upstream-kasan-gce-386
2017/12/05 14:22 upstream fd6d2e506ce6 de212f1a .config console log report ci-upstream-kasan-gce-386
2017/12/04 08:47 upstream ae64f9bd1d36 48359b97 .config console log report ci-upstream-kasan-gce-386
2017/12/01 13:43 upstream 3c1c4ddffb58 2fa91450 .config console log report ci-upstream-kasan-gce-386
2017/11/28 18:57 upstream 43f462f1c2e1 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/28 09:44 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/27 14:20 upstream 4fbd8d194f06 ac93d7e1 .config console log report ci-upstream-kasan-gce-386
2017/11/26 12:31 upstream 844056fd74eb 4bd70f88 .config console log report ci-upstream-kasan-gce-386
2017/11/25 01:17 net-next-old 1d3b78bbc6e9 deb5f6ae .config console log report ci-upstream-kasan-gce-386
2017/11/24 08:10 net-next-old 1d3b78bbc6e9 deb5f6ae .config console log report ci-upstream-kasan-gce-386
2017/11/21 08:01 upstream c8a0739b185d eff27f33 .config console log report ci-upstream-kasan-gce-386
2017/11/02 15:48 upstream 3a99df9a3d14 dab7524e .config console log report ci-upstream-kasan-gce-386
2017/10/31 23:49 upstream 287683d027a3 e775312e .config console log report ci-upstream-kasan-gce-386
2017/10/31 17:26 upstream 5f479447d983 2de9b525 .config console log report ci-upstream-kasan-gce-386
2017/11/25 00:35 net-next-old 1d3b78bbc6e9 deb5f6ae .config console log report ci-upstream-net-kasan-gce
2018/01/20 14:13 mmots 2734fabdcba4 fbbdcd92 .config console log report ci-upstream-mmots-kasan-gce
2018/01/20 09:37 mmots 2734fabdcba4 fbbdcd92 .config console log report ci-upstream-mmots-kasan-gce
2017/11/26 20:05 mmots 1ea8d039f9ed deb5f6ae .config console log report ci-upstream-mmots-kasan-gce
2017/11/25 20:09 mmots 1ea8d039f9ed deb5f6ae .config console log report ci-upstream-mmots-kasan-gce
2017/11/22 12:25 linux-next 1efc584c7106 31af2ce0 .config console log report ci-upstream-next-kasan-gce
2017/11/18 02:50 mmots 9390953851bb 84dd36ba .config console log report ci-upstream-mmots-kasan-gce
2017/11/17 20:01 linux-next ee92513eae01 9badd053 .config console log report ci-upstream-next-kasan-gce
2017/11/17 04:29 linux-next 785be731fbc6 348d8f13 .config console log report ci-upstream-next-kasan-gce
2017/11/16 22:06 linux-next 785be731fbc6 348d8f13 .config console log report ci-upstream-next-kasan-gce
2017/11/14 04:57 mmots 97530111c84b 00f6ff58 .config console log report ci-upstream-mmots-kasan-gce
2017/11/05 04:51 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/01 04:44 linux-next 36ef71cae353 e511d9f8 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.