KASAN: slab-out-of-bounds Write in vcs

KASAN: slab-out-of-bounds Write in vcs_read
Status: upstream: reported C repro on 2020/08/21 00:27
Reported-by: syzbot+6d6e5b894ac34506362f@syzkaller.appspotmail.com
First crash: 301d, last: 295d

Cause bisection: introduced by (bisect log) :
commit b1c32fcfadf5593ab7a63261cc8a5747c36e627e
Author: Jiri Slaby <jslaby@suse.cz>
Date: Tue Aug 18 08:57:05 2020 +0000

vc_screen: extract vcs_read_buf_header

Crash: BUG: Bad page map (log)
Repro: C syz .config

Patch testing requests:
Created	Duration	User	Patch	Repo	Result
2020/08/26 15:36	16m	foxhlchen@gmail.com		https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master	OK
2020/08/25 14:16	16m	yepeilin.cs@gmail.com		upstream	OK

Sample crash report:

==================================================================
BUG: KASAN: slab-out-of-bounds in vcs_read_buf drivers/tty/vt/vc_screen.c:357 [inline]
BUG: KASAN: slab-out-of-bounds in vcs_read+0xaa7/0xb40 drivers/tty/vt/vc_screen.c:449
Write of size 2 at addr ffff8880a83de000 by task syz-executor717/6837

CPU: 0 PID: 6837 Comm: syz-executor717 Not tainted 5.9.0-rc1-next-20200821-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 vcs_read_buf drivers/tty/vt/vc_screen.c:357 [inline]
 vcs_read+0xaa7/0xb40 drivers/tty/vt/vc_screen.c:449
 do_loop_readv_writev fs/read_write.c:734 [inline]
 do_loop_readv_writev fs/read_write.c:721 [inline]
 do_iter_read+0x48e/0x6e0 fs/read_write.c:955
 vfs_readv+0xe5/0x150 fs/read_write.c:1073
 do_preadv fs/read_write.c:1165 [inline]
 __do_sys_preadv fs/read_write.c:1215 [inline]
 __se_sys_preadv fs/read_write.c:1210 [inline]
 __x64_sys_preadv+0x231/0x310 fs/read_write.c:1210
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440679
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe191489a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00007ffe191489b0 RCX: 0000000000440679
RDX: 0000000000000006 RSI: 0000000020001b00 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c40
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000401e80
R13: 0000000000401f10 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 4880:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 slab_post_alloc_hook mm/slab.h:517 [inline]
 slab_alloc mm/slab.c:3312 [inline]
 kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482
 shmem_alloc_inode+0x18/0x40 mm/shmem.c:3819
 alloc_inode+0x61/0x230 fs/inode.c:232
 new_inode_pseudo fs/inode.c:928 [inline]
 new_inode+0x27/0x2f0 fs/inode.c:957
 shmem_get_inode+0x18b/0xbb0 mm/shmem.c:2291
 shmem_mknod+0x5a/0x1f0 mm/shmem.c:2918
 lookup_open.isra.0+0xf85/0x1350 fs/namei.c:3103
 open_last_lookups fs/namei.c:3177 [inline]
 path_openat+0x96d/0x2730 fs/namei.c:3365
 do_filp_open+0x17e/0x3c0 fs/namei.c:3395
 do_sys_openat2+0x16d/0x420 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_sys_open fs/open.c:1192 [inline]
 __se_sys_open fs/open.c:1188 [inline]
 __x64_sys_open+0x119/0x1c0 fs/open.c:1188
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff8880a83de200
 which belongs to the cache shmem_inode_cache of size 1312
The buggy address is located 512 bytes to the left of
 1312-byte region [ffff8880a83de200, ffff8880a83de720)
The buggy address belongs to the page:
page:000000005ede4b9b refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a83dfffb pfn:0xa83de
head:000000005ede4b9b order:1 compound_mapcount:0
flags: 0xfffe0000010200(slab|head)
raw: 00fffe0000010200 ffffea0002a0eb88 ffffea0002a2f488 ffff8880aa241a00
raw: ffff8880a83dfffb ffff8880a83de200 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a83ddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880a83ddf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880a83de000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff8880a83de080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a83de100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (6):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro
ci-upstream-linux-next-kasan-gce-root	2020/08/23 09:40	linux-next	494d311a	1da71ab0	.config	log	report	syz	C
ci-upstream-linux-next-kasan-gce-root	2020/08/20 07:33	linux-next	605cbf3d	ed282a3a	.config	log	report	syz	C
ci-upstream-linux-next-kasan-gce-root	2020/08/25 17:52	linux-next	3a00d3df	344da168	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/08/25 10:28	linux-next	d8be0e12	344da168	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/08/24 08:36	linux-next	d8be0e12	cef5ae68	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/08/23 12:51	linux-next	494d311a	cef5ae68	.config	log	report