syzbot


KASAN: use-after-free Read in reqsk_queue_unlink

Status: internal: reported on 2022/10/10 13:08
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 740ea3c4a0b2 tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 111d, last: 60d

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline]
BUG: KASAN: use-after-free in reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913
Read of size 8 at addr ffff88804b438500 by task udevd/18900

CPU: 0 PID: 18900 Comm: udevd Not tainted 6.1.0-rc5-syzkaller-00081-ge493bec343fa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15e/0x45d mm/kasan/report.c:395
 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
 tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline]
 reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913
 inet_csk_reqsk_queue_drop net/ipv4/inet_connection_sock.c:927 [inline]
 inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:939 [inline]
 reqsk_timer_handler+0x728/0x1160 net/ipv4/inet_connection_sock.c:1053
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb7/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:find_stack lib/stackdepot.c:304 [inline]
RIP: 0010:__stack_depot_save+0x139/0x560 lib/stackdepot.c:452
Code: 89 da 23 15 a5 54 9e 0d 4c 8d 0c d0 49 8b 09 48 85 c9 75 11 e9 99 00 00 00 48 8b 09 48 85 c9 0f 84 8d 00 00 00 39 59 08 75 ef <44> 3b 41 0c 75 e9 31 c0 48 8b 74 c1 18 49 39 34 c7 75 dc 48 83 c0
RSP: 0018:ffffc900054cf6e8 EFLAGS: 00000246
RAX: ffff88823b400000 RBX: 00000000e29af0e9 RCX: ffff8880482b5e90
RDX: 00000000000af0e9 RSI: 0000000000000003 RDI: 000000007793b0c6
RBP: 0000000000000000 R08: 000000000000000f R09: ffff88823b978748
R10: 000000000000000f R11: 0000000000092080 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000012b20 R15: ffffc900054cf760
 kasan_save_stack+0x35/0x40 mm/kasan/common.c:46
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slab.h:737 [inline]
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 fill_pool+0x264/0x5c0 lib/debugobjects.c:168
 __debug_object_init+0x7a/0xd10 lib/debugobjects.c:562
 debug_object_init lib/debugobjects.c:617 [inline]
 debug_object_activate+0x330/0x3e0 lib/debugobjects.c:703
 debug_rcu_head_queue kernel/rcu/rcu.h:189 [inline]
 call_rcu+0x30/0x820 kernel/rcu/tree.c:2783
 destroy_inode+0x129/0x1b0 fs/inode.c:314
 iput_final fs/inode.c:1747 [inline]
 iput.part.0+0x59b/0x880 fs/inode.c:1773
 iput+0x5c/0x80 fs/inode.c:1763
 do_unlinkat+0x41f/0x660 fs/namei.c:4326
 __do_sys_unlink fs/namei.c:4367 [inline]
 __se_sys_unlink fs/namei.c:4365 [inline]
 __x64_sys_unlink+0xca/0x110 fs/namei.c:4365
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb4357272d7
Code: f0 ff ff 73 01 c3 48 8b 0d 9e db 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 71 db 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe219fdb58 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000556eeddd8120 RCX: 00007fb4357272d7
RDX: 00007ffe219fdb7c RSI: 0000556eeddbc4cd RDI: 00007ffe219fdb68
RBP: 0000556eee5c4330 R08: 0000000000000000 R09: 00007ffe219fda00
R10: 0000000000000c39 R11: 0000000000000202 R12: 0000000000000c39
R13: 00007ffe219fdb68 R14: 0000000003938700 R15: 0000556eeddd8160
 </TASK>

Allocated by task 3667:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slab.h:737 [inline]
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 net_alloc net/core/net_namespace.c:410 [inline]
 copy_net_ns+0x129/0x760 net/core/net_namespace.c:465
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc5/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x449/0x920 kernel/fork.c:3188
 __do_sys_unshare kernel/fork.c:3259 [inline]
 __se_sys_unshare kernel/fork.c:3257 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3257
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 14435:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:511
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1750
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0xee/0x5c0 mm/slub.c:3683
 net_free net/core/net_namespace.c:439 [inline]
 net_free net/core/net_namespace.c:435 [inline]
 cleanup_net+0x8be/0xb00 net/core/net_namespace.c:622
 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
 worker_thread+0x669/0x1090 kernel/workqueue.c:2436
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Last potentially related work creation:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
 insert_work+0x48/0x350 kernel/workqueue.c:1358
 __queue_work+0x693/0x13b0 kernel/workqueue.c:1517
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1514 [inline]
 __run_timers.part.0+0x4a3/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0x156/0x1d0 kernel/time/timer.c:1805
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571

Second to last potentially related work creation:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
 insert_work+0x48/0x350 kernel/workqueue.c:1358
 __queue_work+0x693/0x13b0 kernel/workqueue.c:1517
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1514 [inline]
 __run_timers.part.0+0x4a3/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0x156/0x1d0 kernel/time/timer.c:1805
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571

The buggy address belongs to the object at ffff88804b438000
 which belongs to the cache net_namespace of size 6976
The buggy address is located 1280 bytes inside of
 6976-byte region [ffff88804b438000, ffff88804b439b40)

The buggy address belongs to the physical page:
page:ffffea00012d0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804b43d4c0 pfn:0x4b438
head:ffffea00012d0e00 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88807c8b7781
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff8880121e1500
raw: ffff88804b43d4c0 0000000080040003 00000001ffffffff ffff88807c8b7781
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3667, tgid 3667 (syz-executor.4), ts 147084717567, free_ts 13284951095
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4288
 __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5555
 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
 alloc_slab_page mm/slub.c:1794 [inline]
 allocate_slab+0x213/0x300 mm/slub.c:1939
 new_slab mm/slub.c:1992 [inline]
 ___slab_alloc+0xa91/0x1400 mm/slub.c:3180
 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3279
 slab_alloc_node mm/slub.c:3364 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x31a/0x3d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 net_alloc net/core/net_namespace.c:410 [inline]
 copy_net_ns+0x129/0x760 net/core/net_namespace.c:465
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc5/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x449/0x920 kernel/fork.c:3188
 __do_sys_unshare kernel/fork.c:3259 [inline]
 __se_sys_unshare kernel/fork.c:3257 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3257
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1509
 free_unref_page_prepare mm/page_alloc.c:3387 [inline]
 free_unref_page+0x1d/0x4d0 mm/page_alloc.c:3483
 free_contig_range+0xb5/0x180 mm/page_alloc.c:9493
 destroy_args+0xa8/0x64c mm/debug_vm_pgtable.c:1031
 debug_vm_pgtable+0x2958/0x29e9 mm/debug_vm_pgtable.c:1354
 do_one_initcall+0x141/0x780 init/main.c:1303
 do_initcall_level init/main.c:1376 [inline]
 do_initcalls init/main.c:1392 [inline]
 do_basic_setup init/main.c:1411 [inline]
 kernel_init_freeable+0x6ff/0x788 init/main.c:1631
 kernel_init+0x1e/0x1d0 init/main.c:1519
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Memory state around the buggy address:
 ffff88804b438400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804b438480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804b438500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88804b438580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804b438600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	89 da                	mov    %ebx,%edx
   2:	23 15 a5 54 9e 0d    	and    0xd9e54a5(%rip),%edx        # 0xd9e54ad
   8:	4c 8d 0c d0          	lea    (%rax,%rdx,8),%r9
   c:	49 8b 09             	mov    (%r9),%rcx
   f:	48 85 c9             	test   %rcx,%rcx
  12:	75 11                	jne    0x25
  14:	e9 99 00 00 00       	jmpq   0xb2
  19:	48 8b 09             	mov    (%rcx),%rcx
  1c:	48 85 c9             	test   %rcx,%rcx
  1f:	0f 84 8d 00 00 00    	je     0xb2
  25:	39 59 08             	cmp    %ebx,0x8(%rcx)
  28:	75 ef                	jne    0x19
* 2a:	44 3b 41 0c          	cmp    0xc(%rcx),%r8d <-- trapping instruction
  2e:	75 e9                	jne    0x19
  30:	31 c0                	xor    %eax,%eax
  32:	48 8b 74 c1 18       	mov    0x18(%rcx,%rax,8),%rsi
  37:	49 39 34 c7          	cmp    %rsi,(%r15,%rax,8)
  3b:	75 dc                	jne    0x19
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c0                   	.byte 0xc0

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-net-this-kasan-gce 2022/11/30 03:28 net e493bec343fa 05dc7993 .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in reqsk_queue_unlink
ci-upstream-net-this-kasan-gce 2022/11/11 09:34 net 4bbf3422df78 3ead01ad .config console log report info [disk image] [vmlinux] [kernel image] KASAN: use-after-free Read in reqsk_queue_unlink
ci-upstream-net-this-kasan-gce 2022/10/10 13:07 net af7d23f9d96a aea5da89 .config console log report info [disk image] [vmlinux] KASAN: use-after-free Read in reqsk_queue_unlink
ci-upstream-bpf-next-kasan-gce 2022/10/12 17:19 bpf-next d31ada3b5111 89b5a509 .config console log report info [disk image] [vmlinux] KASAN: use-after-free Read in reqsk_queue_unlink
* Struck through repros no longer work on HEAD.