syzbot

 sign-in | mailing list | source | docs
🐞 Open [993] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in do_shrink_slab (2)

Status: fixed on 2023/02/24 13:50
Subsystems: mm
[Documentation on labels]
Fix commit: bd86c69dae65 NFSD: unregister shrinker when nfsd_init_net() fails
First crash: 577d, last: 553d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in do_shrink_slab mm 9 2074d 2078d 8/26 fixed on 2018/08/28 17:48

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in do_shrink_slab+0xbe6/0xce0 mm/vmscan.c:785
Read of size 8 at addr ffff888015a1f5b8 by task kswapd1/128

CPU: 2 PID: 128 Comm: kswapd1 Not tainted 6.1.0-rc1-syzkaller-00134-ge35184f32151 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15e/0x461 mm/kasan/report.c:395
 kasan_report+0xbb/0x1f0 mm/kasan/report.c:495
 do_shrink_slab+0xbe6/0xce0 mm/vmscan.c:785
 shrink_slab+0x175/0x660 mm/vmscan.c:1002
 shrink_node_memcgs mm/vmscan.c:6076 [inline]
 shrink_node+0x93d/0x1f30 mm/vmscan.c:6105
 kswapd_shrink_node mm/vmscan.c:6894 [inline]
 balance_pgdat+0x8f5/0x1530 mm/vmscan.c:7084
 kswapd+0x707/0xfc0 mm/vmscan.c:7344
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Allocated by task 3935:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
 kasan_set_track+0x21/0x30 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:371 [inline]
 ____kasan_kmalloc mm/kasan/common.c:330 [inline]
 __kasan_kmalloc+0x9f/0xb0 mm/kasan/common.c:380
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:955 [inline]
 __kmalloc+0x54/0xc0 mm/slab_common.c:968
 kmalloc include/linux/slab.h:581 [inline]
 kzalloc include/linux/slab.h:712 [inline]
 ops_init+0xfb/0x470 net/core/net_namespace.c:124
 setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
 copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 copy_namespaces+0x391/0x450 kernel/nsproxy.c:178
 copy_process+0x306e/0x7190 kernel/fork.c:2256
 kernel_clone+0xe7/0x980 kernel/fork.c:2671
 __do_sys_clone+0xba/0x100 kernel/fork.c:2812
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 3935:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
 kasan_set_track+0x21/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:511
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200
 kasan_slab_free include/linux/kasan.h:177 [inline]
 __cache_free mm/slab.c:3389 [inline]
 __do_kmem_cache_free mm/slab.c:3585 [inline]
 __kmem_cache_free+0xc9/0x3a0 mm/slab.c:3592
 ops_init+0xcd/0x470 net/core/net_namespace.c:139
 setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
 copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 copy_namespaces+0x391/0x450 kernel/nsproxy.c:178
 copy_process+0x306e/0x7190 kernel/fork.c:2256
 kernel_clone+0xe7/0x980 kernel/fork.c:2671
 __do_sys_clone+0xba/0x100 kernel/fork.c:2812
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff888015a1f000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1464 bytes inside of
 2048-byte region [ffff888015a1f000, ffff888015a1f800)

The buggy address belongs to the physical page:
page:ffffea00005687c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15a1f
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000997b88 ffffea00006e87c8 ffff888011840800
raw: 0000000000000000 ffff888015a1f000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2c2220(__GFP_HIGH|__GFP_ATOMIC|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_THISNODE), pid 3699, tgid 3699 (syz-executor.1), ts 191952443978, free_ts 190847837680
 prep_new_page mm/page_alloc.c:2538 [inline]
 get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4287
 __alloc_pages+0x1c7/0x5a0 mm/page_alloc.c:5554
 __alloc_pages_node include/linux/gfp.h:223 [inline]
 kmem_getpages mm/slab.c:1363 [inline]
 cache_grow_begin+0x75/0x360 mm/slab.c:2570
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2943
 ____cache_alloc mm/slab.c:3019 [inline]
 ____cache_alloc mm/slab.c:3002 [inline]
 __do_cache_alloc mm/slab.c:3202 [inline]
 slab_alloc_node mm/slab.c:3250 [inline]
 __kmem_cache_alloc_node+0x442/0x500 mm/slab.c:3549
 __do_kmalloc_node mm/slab_common.c:954 [inline]
 __kmalloc_node_track_caller+0x45/0xc0 mm/slab_common.c:975
 kmalloc_reserve net/core/skbuff.c:437 [inline]
 __alloc_skb+0xd9/0x2f0 net/core/skbuff.c:509
 alloc_skb include/linux/skbuff.h:1267 [inline]
 nlmsg_new include/net/netlink.h:964 [inline]
 rtmsg_ifinfo_build_skb+0x72/0x1a0 net/core/rtnetlink.c:3905
 rtmsg_ifinfo_event net/core/rtnetlink.c:3941 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:3932 [inline]
 rtmsg_ifinfo+0x83/0x120 net/core/rtnetlink.c:3950
 __dev_notify_flags+0x226/0x2b0 net/core/dev.c:8577
 dev_change_flags+0x112/0x170 net/core/dev.c:8619
 do_setlink+0x9f1/0x3bb0 net/core/rtnetlink.c:2788
 __rtnl_newlink+0xd6a/0x17e0 net/core/rtnetlink.c:3547
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594
 rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6091
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2540
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1458 [inline]
 free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1508
 free_unref_page_prepare mm/page_alloc.c:3386 [inline]
 free_unref_page+0x19/0x4d0 mm/page_alloc.c:3482
 slab_destroy mm/slab.c:1615 [inline]
 slabs_destroy+0x85/0xc0 mm/slab.c:1635
 cache_flusharray mm/slab.c:3360 [inline]
 ___cache_free+0x2a8/0x3d0 mm/slab.c:3423
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x4f/0x1a0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x5f/0x80 mm/kasan/common.c:302
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slab.h:737 [inline]
 slab_alloc_node mm/slab.c:3257 [inline]
 slab_alloc mm/slab.c:3265 [inline]
 __kmem_cache_alloc_lru mm/slab.c:3442 [inline]
 kmem_cache_alloc+0x218/0x450 mm/slab.c:3461
 kmem_cache_zalloc include/linux/slab.h:702 [inline]
 lsm_file_alloc security/security.c:575 [inline]
 security_file_alloc+0x34/0x170 security/security.c:1529
 __alloc_file+0xd9/0x270 fs/file_table.c:143
 alloc_empty_file+0x6d/0x170 fs/file_table.c:187
 path_openat+0xe7/0x2860 fs/namei.c:3699
 do_filp_open+0x1b6/0x400 fs/namei.c:3740
 do_sys_openat2+0x16d/0x4c0 fs/open.c:1310
 do_sys_open fs/open.c:1326 [inline]
 __do_sys_openat fs/open.c:1342 [inline]
 __se_sys_openat fs/open.c:1337 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1337
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff888015a1f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888015a1f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888015a1f580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888015a1f600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888015a1f680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (105):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/21 21:53 upstream e35184f32151 4bfd3c27 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/21 18:27 upstream e35184f32151 4bfd3c27 .config console log report info ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/21 16:44 upstream e35184f32151 4bfd3c27 .config console log report info ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/21 12:23 upstream 6d36c728bc2e 3a03e294 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/20 23:31 upstream aae703b02f92 a0fd4dab .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/20 04:16 upstream 55be6084c8e0 b31320fc .config console log report info ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/20 02:59 upstream aae703b02f92 b31320fc .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/19 23:53 upstream 55be6084c8e0 b31320fc .config console log report info ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/19 17:24 upstream aae703b02f92 b31320fc .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/18 06:42 upstream bbb8ceb5e242 754863b4 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/18 05:29 upstream bbb8ceb5e242 754863b4 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/18 03:44 upstream bbb8ceb5e242 754863b4 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/17 20:09 upstream 9abf2313adc1 94744d21 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/17 10:37 upstream 9abf2313adc1 67cb024c .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/16 23:43 upstream 2df76606db9d 67cb024c .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/16 14:32 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/14 14:43 upstream 55be6084c8e0 4954e4b2 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/10 13:10 upstream 493ffd6605b2 5bcf0c31 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/10 03:16 upstream 4899a36f91a9 aea5da89 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/10 01:48 upstream 4899a36f91a9 aea5da89 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/09 23:40 upstream 4899a36f91a9 aea5da89 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/09 12:10 upstream a6afa4199d3d aea5da89 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/09 03:49 upstream a6afa4199d3d aea5da89 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/08 23:47 upstream e8bc52cb8df8 aea5da89 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 18:42 upstream 4c86114194e6 79a59635 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 14:51 upstream 4c86114194e6 79a59635 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 10:04 upstream 18fd049731e6 8a212197 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 09:00 upstream 18fd049731e6 8a212197 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 07:26 upstream ffb39098bf87 8a212197 .config console log report info ci-upstream-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/10/07 06:04 upstream 18fd049731e6 8a212197 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 05:54 upstream 18fd049731e6 8a212197 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 05:36 upstream 18fd049731e6 8a212197 .config console log report info ci-qemu-upstream KASAN: use-after-free Read in do_shrink_slab
2022/10/07 00:44 upstream ffb39098bf87 8a212197 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root KASAN: use-after-free Read in do_shrink_slab
2022/10/21 04:34 upstream 6d36c728bc2e a0fd4dab .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/20 21:32 upstream aae703b02f92 a0fd4dab .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/19 11:36 upstream aae703b02f92 b31320fc .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/19 10:04 upstream aae703b02f92 b31320fc .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/18 20:41 upstream bb1a1146467a b31320fc .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/18 18:03 upstream bb1a1146467a b31320fc .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/18 15:52 upstream bb1a1146467a b31320fc .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/18 05:24 upstream bbb8ceb5e242 754863b4 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/17 18:12 upstream 9abf2313adc1 94744d21 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/17 12:08 upstream 9abf2313adc1 67cb024c .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/13 14:17 upstream 55be6084c8e0 adf90437 .config console log report info ci-upstream-kasan-gce-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/10 01:57 upstream 4899a36f91a9 aea5da89 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/09 17:26 upstream a6afa4199d3d aea5da89 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/08 17:04 upstream e8bc52cb8df8 aea5da89 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/08 04:32 upstream 62e6e5940c0c aea5da89 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/08 03:03 upstream 62e6e5940c0c aea5da89 .config console log report info ci-qemu-upstream-386 KASAN: use-after-free Read in do_shrink_slab
2022/10/20 08:04 net-next-old 0326074ff465 b31320fc .config console log report info ci-upstream-net-kasan-gce KASAN: use-after-free Read in do_shrink_slab
2022/09/27 15:08 linux-next aaa11ce2ffc8 87840e00 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: use-after-free Read in do_shrink_slab
* Struck through repros no longer work on HEAD.