syzbot


KASAN: use-after-free Read in kill_fasync

Status: upstream: reported C repro on 2022/07/11 06:41
Subsystems: fs (incorrect?)
Reported-by: syzbot+382c8824777dca2812fe@syzkaller.appspotmail.com
First crash: 261d, last: 52d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in kill_fasync (log)
Repro: C syz .config

Fix bisection: fixed by (bisect log) :
commit 69d4c0d3218692ffa56b0e1b9c76c50c699d7044
Author: Peter Zijlstra <peterz@infradead.org>
Date: Thu Jan 12 19:43:58 2023 +0000

  entry, kasan, x86: Disallow overriding mem*() functions

Last patch testing requests:
Created Duration User Patch Repo Result
2022/12/01 07:30 21m retest repro upstream OK log
2022/12/01 05:30 21m retest repro upstream OK log
2022/11/30 23:30 20m retest repro linux-next error
2022/11/30 23:30 21m retest repro upstream OK log
2022/11/30 23:30 19m retest repro upstream OK log
2022/07/12 10:52 18m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git cb71b93c2dc3 OK log
2022/07/11 11:11 10m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git cb71b93c2dc3 report log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in kill_fasync+0x45e/0x470 fs/fcntl.c:1014
Read of size 8 at addr ffff88807dc93168 by task kworker/0:2/144

CPU: 0 PID: 144 Comm: kworker/0:2 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
Workqueue: events key_garbage_collector
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:317 [inline]
 print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495
 kill_fasync+0x45e/0x470 fs/fcntl.c:1014
 post_one_notification.isra.0+0x6e4/0x990 kernel/watch_queue.c:128
 remove_watch_from_object+0x35a/0x9d0 kernel/watch_queue.c:527
 remove_watch_list include/linux/watch_queue.h:115 [inline]
 key_gc_unused_keys.constprop.0+0x2e5/0x600 security/keys/gc.c:135
 key_garbage_collector+0x3d7/0x920 security/keys/gc.c:297
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>

Allocated by task 5494:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 ____kasan_kmalloc mm/kasan/common.c:515 [inline]
 ____kasan_kmalloc mm/kasan/common.c:474 [inline]
 __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:733 [inline]
 alloc_pipe_info+0x105/0x590 fs/pipe.c:790
 get_pipe_inode fs/pipe.c:881 [inline]
 create_pipe_files+0x8d/0x880 fs/pipe.c:913
 __do_pipe_flags fs/pipe.c:962 [inline]
 do_pipe2+0x96/0x1b0 fs/pipe.c:1010
 __do_sys_pipe2 fs/pipe.c:1028 [inline]
 __se_sys_pipe2 fs/pipe.c:1026 [inline]
 __x64_sys_pipe2+0x50/0x70 fs/pipe.c:1026
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 5494:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:366 [inline]
 ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:328
 kasan_slab_free include/linux/kasan.h:200 [inline]
 slab_free_hook mm/slub.c:1754 [inline]
 slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780
 slab_free mm/slub.c:3534 [inline]
 kfree+0xe2/0x4d0 mm/slub.c:4562
 put_pipe_info fs/pipe.c:711 [inline]
 pipe_release+0x2b6/0x310 fs/pipe.c:734
 __fput+0x277/0x9d0 fs/file_table.c:317
 task_work_run+0xdd/0x1a0 kernel/task_work.c:177
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xaf1/0x29f0 kernel/exit.c:795
 do_group_exit+0xd2/0x2f0 kernel/exit.c:925
 __do_sys_exit_group kernel/exit.c:936 [inline]
 __se_sys_exit_group kernel/exit.c:934 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

The buggy address belongs to the object at ffff88807dc93000
 which belongs to the cache kmalloc-cg-512 of size 512
The buggy address is located 360 bytes inside of
 512-byte region [ffff88807dc93000, ffff88807dc93200)

The buggy address belongs to the physical page:
page:ffffea0001f72400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7dc90
head:ffffea0001f72400 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842dc0
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5470, tgid 5470 (syz-executor105), ts 76271246150, free_ts 76264094282
 prep_new_page mm/page_alloc.c:2535 [inline]
 get_page_from_freelist+0x210d/0x3a30 mm/page_alloc.c:4282
 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5506
 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2280
 alloc_slab_page mm/slub.c:1824 [inline]
 allocate_slab+0x27e/0x3d0 mm/slub.c:1969
 new_slab mm/slub.c:2029 [inline]
 ___slab_alloc+0x89d/0xef0 mm/slub.c:3031
 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118
 slab_alloc_node mm/slub.c:3209 [inline]
 slab_alloc mm/slub.c:3251 [inline]
 kmem_cache_alloc_trace+0x323/0x3e0 mm/slub.c:3282
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:733 [inline]
 alloc_pipe_info+0x105/0x590 fs/pipe.c:790
 get_pipe_inode fs/pipe.c:881 [inline]
 create_pipe_files+0x8d/0x880 fs/pipe.c:913
 __do_pipe_flags fs/pipe.c:962 [inline]
 do_pipe2+0x96/0x1b0 fs/pipe.c:1010
 __do_sys_pipe2 fs/pipe.c:1028 [inline]
 __se_sys_pipe2 fs/pipe.c:1026 [inline]
 __x64_sys_pipe2+0x50/0x70 fs/pipe.c:1026
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1453 [inline]
 free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1503
 free_unref_page_prepare mm/page_alloc.c:3383 [inline]
 free_unref_page+0x19/0x4d0 mm/page_alloc.c:3479
 __stack_depot_save+0x168/0x500 lib/stackdepot.c:489
 kasan_save_stack+0x2e/0x40 mm/kasan/common.c:39
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 ____kasan_kmalloc mm/kasan/common.c:515 [inline]
 ____kasan_kmalloc mm/kasan/common.c:474 [inline]
 __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
 kmalloc include/linux/slab.h:605 [inline]
 kzalloc include/linux/slab.h:733 [inline]
 kobject_get_path+0xbe/0x230 lib/kobject.c:147
 kobject_uevent_env+0x254/0x1640 lib/kobject_uevent.c:529
 call_crda+0x17e/0x3b0 net/wireless/reg.c:583
 reg_query_database net/wireless/reg.c:1158 [inline]
 reg_process_hint_core net/wireless/reg.c:2693 [inline]
 reg_process_hint+0x925/0x1710 net/wireless/reg.c:3036
 reg_process_pending_hints net/wireless/reg.c:3124 [inline]
 reg_todo+0x1a5/0x7d0 net/wireless/reg.c:3212
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Memory state around the buggy address:
 ffff88807dc93000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807dc93080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807dc93100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff88807dc93180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807dc93200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (40):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-linux-next-kasan-gce-root 2022/07/08 06:08 linux-next cb71b93c2dc3 bff65f44 .config console log report syz C KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-root 2022/07/17 15:27 upstream 972a278fe60c 95cb00d1 .config console log report syz C KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/08 07:21 upstream e8a4e1c1bb69 bff65f44 .config console log report syz C KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-smack-root 2022/07/08 06:53 upstream e8a4e1c1bb69 bff65f44 .config console log report syz C KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/08 06:51 upstream e8a4e1c1bb69 bff65f44 .config console log report syz C KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/08 06:29 upstream e8a4e1c1bb69 bff65f44 .config console log report syz C KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/20 00:39 upstream ca85855bdcae 775344bc .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/19 17:22 upstream ca85855bdcae 72a3cc0c .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/19 05:46 upstream ca85855bdcae ff988920 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/18 17:43 upstream ff6992735ade ff988920 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-qemu-upstream 2022/07/18 13:56 upstream 4a57a8400075 ff988920 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-root 2022/07/17 10:37 upstream 972a278fe60c 95cb00d1 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/16 23:14 upstream c658cabbfd32 95cb00d1 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-qemu-upstream 2022/07/15 21:03 upstream 4a57a8400075 95cb00d1 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/15 13:06 upstream e5d523f1ae8f 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/14 00:29 upstream 4a57a8400075 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/13 21:55 upstream 4a57a8400075 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/13 20:55 upstream 4a57a8400075 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/13 10:19 upstream b047602d579b 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-root 2022/07/13 10:11 upstream b047602d579b 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-smack-root 2022/07/13 09:46 upstream b047602d579b 5d921b08 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-root 2022/07/12 19:13 upstream 72a8e05d4f66 d91dd8ea .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/12 17:53 upstream 72a8e05d4f66 d91dd8ea .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/12 16:58 upstream 72a8e05d4f66 d91dd8ea .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-root 2022/07/12 14:43 upstream 5a29232d870d d91dd8ea .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/12 03:19 upstream 5a29232d870d da3d6955 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-smack-root 2022/07/11 14:03 upstream 32346491ddf2 da3d6955 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-qemu-upstream 2022/07/11 12:34 upstream 32346491ddf2 f3f217ff .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/11 12:15 upstream 32346491ddf2 da3d6955 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-smack-root 2022/07/11 10:52 upstream 32346491ddf2 da3d6955 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-qemu-upstream 2022/07/11 09:25 upstream 32346491ddf2 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/10 23:21 upstream d9919d43cbf6 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-selinux-root 2022/07/10 03:13 upstream b1c428b6c368 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-smack-root 2022/07/10 03:10 upstream b1c428b6c368 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-qemu-upstream 2022/07/10 02:39 upstream b1c428b6c368 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-qemu-upstream 2022/07/09 09:58 upstream e5524c2a1fc4 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-root 2022/07/09 08:34 upstream e5524c2a1fc4 b5765a15 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce 2022/07/08 06:02 upstream e8a4e1c1bb69 bff65f44 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-kasan-gce-smack-root 2022/07/08 05:45 upstream e8a4e1c1bb69 bff65f44 .config console log report info KASAN: use-after-free Read in kill_fasync
ci-upstream-linux-next-kasan-gce-root 2022/07/08 05:49 linux-next cb71b93c2dc3 bff65f44 .config console log report info KASAN: use-after-free Read in kill_fasync
* Struck through repros no longer work on HEAD.