KASAN: use-after-free Write in nr

KASAN: use-after-free Write in nr_release
Status: upstream: reported syz repro on 2019/11/29 08:16
Reported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com
First crash: 568d, last: 37d

Cause bisection: the cause commit could be any of (bisect log):
  9211bfbff80a netfilter: add missing IS_ENABLED(CONFIG_BRIDGE_NETFILTER) checks to header-file.
  47e640af2e49 netfilter: add missing IS_ENABLED(CONFIG_NF_TABLES) check to header-file.
  a1b2f04ea527 netfilter: add missing includes to a number of header-files.
  0abc8bf4f284 netfilter: add missing IS_ENABLED(CONFIG_NF_CONNTRACK) checks to some header-files.
  bd96b4c75675 netfilter: inline four headers files into another one.
  43dd16efc7f2 netfilter: nf_tables: store data in offload context registers
  78458e3e08cd netfilter: add missing IS_ENABLED(CONFIG_NETFILTER) checks to some header-files.
  20a9379d9a03 netfilter: remove "#ifdef __KERNEL__" guards from some headers.
  bd8699e9e292 netfilter: nft_bitwise: add offload support
  2a475c409fe8 kbuild: remove all netfilter headers from header-test blacklist.
  7e59b3fea2a2 netfilter: remove unnecessary spaces
  1b90af292e71 ipvs: Improve robustness to the ipvs sysctl
  5785cf15fd74 netfilter: nf_tables: add missing prototypes.
  0a30ba509fde netfilter: nf_nat_proto: make tables static
  e84fb4b3666d netfilter: conntrack: use shared sysctl constants
  105333435b4f netfilter: connlabels: prefer static lock initialiser
  8c0bb7873815 netfilter: synproxy: rename mss synproxy_options field
  c162610c7db2 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Fix bisection: failed (bisect log)

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	KASAN: use-after-free Read in nr_release	C			114	14d	680d	0/1	upstream: reported C repro on 2019/08/10 01:07
linux-4.14	KASAN: use-after-free Read in nr_release	syz			86	7d11h	676d	0/1	upstream: reported syz repro on 2019/08/13 12:20

Sample crash report:

==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline]
BUG: KASAN: use-after-free in refcount_add include/linux/refcount.h:201 [inline]
BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:241 [inline]
BUG: KASAN: use-after-free in sock_hold include/net/sock.h:692 [inline]
BUG: KASAN: use-after-free in nr_release+0x5c/0x430 net/netrom/af_netrom.c:520
Write of size 4 at addr ffff888086b2d080 by task syz-executor.0/12299

CPU: 0 PID: 12299 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1f0/0x31e lib/dump_stack.c:118
 print_address_description+0x66/0x620 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report+0x132/0x1d0 mm/kasan/report.c:530
 check_memory_region_inline mm/kasan/generic.c:183 [inline]
 check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:192
 instrument_atomic_write include/linux/instrumented.h:71 [inline]
 atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline]
 refcount_add include/linux/refcount.h:201 [inline]
 refcount_inc include/linux/refcount.h:241 [inline]
 sock_hold include/net/sock.h:692 [inline]
 nr_release+0x5c/0x430 net/netrom/af_netrom.c:520
 __sock_release net/socket.c:596 [inline]
 sock_close+0xd8/0x260 net/socket.c:1277
 __fput+0x34f/0x7b0 fs/file_table.c:281
 task_work_run+0x137/0x1c0 kernel/task_work.c:135
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:139 [inline]
 exit_to_user_mode_prepare+0xfa/0x1c0 kernel/entry/common.c:166
 syscall_exit_to_user_mode+0x5e/0x1a0 kernel/entry/common.c:241
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x416981
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fffd9c8a030 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000416981
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 00007fffd9c8a120 R11: 0000000000000293 R12: 000000000118c920
R13: 000000000118c920 R14: ffffffffffffffff R15: 000000000118c10c

Allocated by task 12300:
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc+0x100/0x130 mm/kasan/common.c:461
 __do_kmalloc mm/slab.c:3655 [inline]
 __kmalloc+0x218/0x320 mm/slab.c:3664
 kmalloc include/linux/slab.h:559 [inline]
 sk_prot_alloc+0xa7/0x2b0 net/core/sock.c:1685
 sk_alloc+0x35/0x300 net/core/sock.c:1739
 nr_create+0x9f/0x4e0 net/netrom/af_netrom.c:433
 __sock_create+0x5b3/0x8c0 net/socket.c:1427
 sock_create net/socket.c:1478 [inline]
 __sys_socket+0xde/0x2d0 net/socket.c:1520
 __do_sys_socket net/socket.c:1529 [inline]
 __se_sys_socket net/socket.c:1527 [inline]
 __x64_sys_socket+0x76/0x80 net/socket.c:1527
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 12299:
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track+0x3d/0x70 mm/kasan/common.c:56
 kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0xdd/0x110 mm/kasan/common.c:422
 __cache_free mm/slab.c:3418 [inline]
 kfree+0x10a/0x220 mm/slab.c:3756
 sk_prot_free net/core/sock.c:1722 [inline]
 __sk_destruct+0x612/0x770 net/core/sock.c:1807
 sock_put include/net/sock.h:1781 [inline]
 nr_release+0x224/0x430 net/netrom/af_netrom.c:554
 __sock_release net/socket.c:596 [inline]
 sock_close+0xd8/0x260 net/socket.c:1277
 __fput+0x34f/0x7b0 fs/file_table.c:281
 task_work_run+0x137/0x1c0 kernel/task_work.c:135
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:139 [inline]
 exit_to_user_mode_prepare+0xfa/0x1c0 kernel/entry/common.c:166
 syscall_exit_to_user_mode+0x5e/0x1a0 kernel/entry/common.c:241
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff888086b2d000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 128 bytes inside of
 2048-byte region [ffff888086b2d000, ffff888086b2d800)
The buggy address belongs to the page:
page:000000004aedf0be refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x86b2d
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea000269ac08 ffffea0002278108 ffff8880aa440800
raw: 0000000000000000 ffff888086b2d000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888086b2cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888086b2d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888086b2d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888086b2d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888086b2d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (478):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	VM info	Title
ci-upstream-kasan-gce-smack-root	2020/08/11 20:30	upstream	00e4db51	bacaf5fa	.config	log	report	syz
ci-upstream-kasan-gce-smack-root	2020/04/11 07:52	upstream	ab6f762f	a8c6a3f8	.config	log	report	syz
ci-upstream-kasan-gce-selinux-root	2020/04/10 21:16	upstream	c0cc2711	a8c6a3f8	.config	log	report	syz
ci-upstream-kasan-gce-selinux-root	2019/12/20 09:36	upstream	7e0165b2	e30cbdae	.config	log	report	syz
ci-upstream-linux-next-kasan-gce-root	2020/03/17 03:09	linux-next	770fbb32	749688d2	.config	log	report	syz
ci-upstream-linux-next-kasan-gce-root	2020/03/06 01:03	linux-next	c99b17ac	c88c7b75	.config	log	report	syz
ci-upstream-linux-next-kasan-gce-root	2019/12/28 20:42	linux-next	7ddd09fc	af6b8ef8	.config	log	report	syz
ci-upstream-kasan-gce-smack-root	2021/05/13 19:26	upstream	c06a2ba6	80f9b418	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-root	2021/05/09 14:16	upstream	b7415964	bc5434be	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-smack-root	2021/03/22 12:00	upstream	0d02ec6b	bea32f74	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-selinux-root	2021/03/14 04:38	upstream	88fe4924	4a003785	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-selinux-root	2021/03/05 14:08	upstream	280d542f	9d751681	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-selinux-root	2021/03/03 00:50	upstream	7a7fd0de	e5b64d68	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-selinux-root	2021/03/02 11:38	upstream	7a7fd0de	92ead296	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-selinux-root	2021/02/27 08:05	upstream	3fb6d0e0	4c37c133	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-smack-root	2021/02/21 20:15	upstream	55f62bc8	a659b3f1	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-root	2021/02/02 08:39	upstream	88bb507a	19e09687	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-net-this-kasan-gce	2021/02/28 05:33	net	eee7ede6	4c37c133	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-net-kasan-gce	2021/03/05 12:23	net-next	d310ec03	9d751681	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-net-kasan-gce	2021/02/11 13:18	net-next	e4b62cf7	a52ee10a	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-net-kasan-gce	2021/01/27 14:32	net-next	6626a026	a0ebf917	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-linux-next-kasan-gce-root	2021/04/08 19:56	linux-next	6145d80c	6a81331a	.config	log	report		info	KASAN: use-after-free Write in nr_release
ci-upstream-kasan-gce-root	2020/11/16 10:43	upstream	09162bc3	1bf9a662	.config	log	report		info
ci-upstream-kasan-gce-root	2020/10/08 22:50	upstream	3d006ee4	92390980	.config	log	report		info
ci-upstream-kasan-gce-smack-root	2020/09/24 09:49	upstream	c9c9e6a4	54289b08	.config	log	report		info
ci-upstream-kasan-gce-root	2020/08/25 21:01	upstream	abb3438d	344da168	.config	log	report
ci-upstream-kasan-gce-root	2020/08/21 12:29	upstream	da2968ff	6436ce4b	.config	log	report
ci-upstream-kasan-gce-smack-root	2020/08/19 02:08	upstream	18445bf4	e1c29030	.config	log	report
ci-upstream-kasan-gce-smack-root	2020/08/12 09:30	upstream	c636eef2	bb3e5fe6	.config	log	report
ci-upstream-kasan-gce-root	2020/08/11 07:16	upstream	fc80c51f	7adc7b65	.config	log	report
ci-upstream-kasan-gce-root	2019/11/29 06:03	upstream	81b6b964	76357d6f	.config	log	report
ci-upstream-net-this-kasan-gce	2020/09/20 19:27	net	f13d783a	9564d2e9	.config	log	report		info
ci-upstream-net-this-kasan-gce	2020/09/15 12:57	net	8e1b3ac4	6989d6f6	.config	log	report		info
ci-upstream-net-this-kasan-gce	2020/09/12 01:18	net	cdb0e6dc	79fb24e2	.config	log	report
ci-upstream-net-this-kasan-gce	2020/09/04 23:15	net	b61ac5bb	abf9ba4f	.config	log	report
ci-upstream-net-this-kasan-gce	2020/08/26 00:03	net	b274e47d	344da168	.config	log	report
ci-upstream-net-this-kasan-gce	2020/08/24 09:57	net	cb957121	cef5ae68	.config	log	report
ci-upstream-net-this-kasan-gce	2020/08/24 01:44	net	cb957121	cef5ae68	.config	log	report
ci-upstream-net-this-kasan-gce	2020/08/15 22:54	net	4ca0d9ac	424dd8e7	.config	log	report
ci-upstream-net-this-kasan-gce	2020/08/14 16:49	net	a1d21081	424dd8e7	.config	log	report
ci-upstream-net-this-kasan-gce	2020/08/03 23:13	net	ac3a0c84	196277c4	.config	log	report
ci-upstream-net-kasan-gce	2020/12/12 22:20	net-next	00f7763a	bca53db9	.config	log	report		info
ci-upstream-net-kasan-gce	2020/10/06 14:02	net-next	8b0308fe	1880b4a9	.config	log	report		info
ci-upstream-net-kasan-gce	2020/10/04 19:50	net-next	456afe01	5ef9c291	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/26 07:58	net-next	6fba737a	4a006f63	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/25 08:40	net-next	3fc826f1	54289b08	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/23 00:23	net-next	92ec804f	3e8f6c27	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/22 03:13	net-next	b696db59	9e1fa68e	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/21 16:03	net-next	3cec0369	9e1fa68e	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/20 07:03	net-next	a5a3303e	53ce8104	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/15 14:16	net-next	ed6d9b02	6989d6f6	.config	log	report		info
ci-upstream-net-kasan-gce	2020/09/06 16:54	net-next	be239c4d	abf9ba4f	.config	log	report
ci-upstream-net-kasan-gce	2020/09/06 12:16	net-next	be239c4d	abf9ba4f	.config	log	report
ci-upstream-net-kasan-gce	2020/09/06 00:46	net-next	447a851b	abf9ba4f	.config	log	report
ci-upstream-net-kasan-gce	2020/08/29 21:53	net-next	0f091e43	d5a3ae1f	.config	log	report
ci-upstream-net-kasan-gce	2020/08/17 22:18	net-next	7fca4dee	424dd8e7	.config	log	report
ci-upstream-net-kasan-gce	2020/08/13 08:19	net-next	bfdd5aaa	bc15f7db	.config	log	report
ci-upstream-net-kasan-gce	2020/08/08 12:27	net-next	bfdd5aaa	ff51e522	.config	log	report
ci-upstream-net-kasan-gce	2020/08/08 08:49	net-next	bfdd5aaa	ff51e522	.config	log	report
ci-upstream-net-kasan-gce	2020/07/31 16:33	net-next	bd69058f	d895b3be	.config	log	report
ci-upstream-net-kasan-gce	2020/07/31 14:39	net-next	41d707b7	8df85ed9	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/07/19 21:59	linux-next	4c43049f	9c812472	.config	log	report