Re: [syzbot] [f2fs?] KASAN: slab-use-after-free Read in f2fs_filemap_fault

From: "Ed Tsai (蔡宗軒)" <Ed.Tsai@mediatek.com>
To: "jaegeuk@kernel.org" <jaegeuk@kernel.org>,
	"hdanton@sina.com" <hdanton@sina.com>
Cc: "Light Hsieh (謝明燈)" <Light.Hsieh@mediatek.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-f2fs-devel@lists.sourceforge.net"
	<linux-f2fs-devel@lists.sourceforge.net>,
	"Freddy Hsin (辛恒豐)" <Freddy.Hsin@mediatek.com>,
	"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
	"Chun-Hung Wu (巫駿宏)" <Chun-hung.Wu@mediatek.com>
Subject: Re: [syzbot] [f2fs?] KASAN: slab-use-after-free Read in f2fs_filemap_fault
Date: Tue, 12 Mar 2024 01:33:40 +0000	[thread overview]
Message-ID: <4bbab168407600a07e1a0921a1569c96e4a1df31.camel@mediatek.com> (raw)
In-Reply-To: <20240115120535.850-1-hdanton@sina.com>

On Mon, 2024-01-15 at 20:05 +0800, Hillf Danton wrote:
> 
> ...
> 
> --- x/fs/f2fs/file.c
> +++ y/fs/f2fs/file.c
> @@ -39,6 +39,7 @@
>  static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
>  {
>         struct inode *inode = file_inode(vmf->vma->vm_file);
> +       vm_flags_t flags = vmf->vma->vm_flags;
>         vm_fault_t ret;
>  
>         ret = filemap_fault(vmf);
> @@ -46,7 +47,7 @@ static vm_fault_t f2fs_filemap_fault(str
>                 f2fs_update_iostat(F2FS_I_SB(inode), inode,
>                                         APP_MAPPED_READ_IO,
> F2FS_BLKSIZE);
>  
> -       trace_f2fs_filemap_fault(inode, vmf->pgoff, vmf->vma-
> >vm_flags, ret);
> +       trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret);
>  
>         return ret;
>  }
> --

Hi Jaegeuk,

We recently encountered this slabe-use-after-free issue in KASAN as
well. Could you please review the patch above and merge it into f2fs?

Best,
Ed

==================================================================
[29195.369964][T31720] BUG: KASAN: slab-use-after-free in
f2fs_filemap_fault+0x50/0xe0
[29195.370971][T31720] Read at addr f7ffff80454ebde0 by task AsyncTask
#11/31720
[29195.371881][T31720] Pointer tag: [f7], memory tag: [f1]
[29195.372549][T31720] 
[29195.372838][T31720] CPU: 2 PID: 31720 Comm: AsyncTask #11 Tainted:
G        W  OE      6.6.17-android15-0-gcb5ba718a525 #1
[29195.374862][T31720] Call trace:
[29195.375268][T31720]  dump_backtrace+0xec/0x138
[29195.375848][T31720]  show_stack+0x18/0x24
[29195.376365][T31720]  dump_stack_lvl+0x50/0x6c
[29195.376943][T31720]  print_report+0x1b0/0x714
[29195.377520][T31720]  kasan_report+0xc4/0x124
[29195.378076][T31720]  __do_kernel_fault+0xb8/0x26c
[29195.378694][T31720]  do_bad_area+0x30/0xdc
[29195.379226][T31720]  do_tag_check_fault+0x20/0x34
[29195.379834][T31720]  do_mem_abort+0x58/0x104
[29195.380388][T31720]  el1_abort+0x3c/0x5c
[29195.380899][T31720]  el1h_64_sync_handler+0x54/0x90
[29195.381529][T31720]  el1h_64_sync+0x68/0x6c
[29195.382069][T31720]  f2fs_filemap_fault+0x50/0xe0
[29195.382678][T31720]  __do_fault+0xc8/0xfc
[29195.383209][T31720]  handle_mm_fault+0xb44/0x10c4
[29195.383816][T31720]  do_page_fault+0x294/0x48c
[29195.384395][T31720]  do_translation_fault+0x38/0x54
[29195.385023][T31720]  do_mem_abort+0x58/0x104
[29195.385577][T31720]  el0_da+0x44/0x78
[29195.386057][T31720]  el0t_64_sync_handler+0x98/0xbc
[29195.386688][T31720]  el0t_64_sync+0x1a8/0x1ac
[29195.387249][T31720] 
[29195.387534][T31720] Allocated by task 14784:
[29195.388085][T31720]  kasan_save_stack+0x40/0x70
[29195.388672][T31720]  save_stack_info+0x34/0x128
[29195.389259][T31720]  kasan_save_alloc_info+0x14/0x20
[29195.389901][T31720]  __kasan_slab_alloc+0x168/0x174
[29195.390530][T31720]  slab_post_alloc_hook+0x88/0x3a4
[29195.391168][T31720]  kmem_cache_alloc+0x18c/0x2c8
[29195.391771][T31720]  vm_area_alloc+0x2c/0xe8
[29195.392327][T31720]  mmap_region+0x440/0xa94
[29195.392888][T31720]  do_mmap+0x3d0/0x524
[29195.393399][T31720]  vm_mmap_pgoff+0x1a0/0x1f8
[29195.393980][T31720]  ksys_mmap_pgoff+0x78/0xf4
[29195.394557][T31720]  __arm64_sys_mmap+0x34/0x44
[29195.395138][T31720]  invoke_syscall+0x58/0x114
[29195.395727][T31720]  el0_svc_common+0x80/0xe0
[29195.396292][T31720]  do_el0_svc+0x1c/0x28
[29195.396812][T31720]  el0_svc+0x38/0x68
[29195.397302][T31720]  el0t_64_sync_handler+0x68/0xbc
[29195.397932][T31720]  el0t_64_sync+0x1a8/0x1ac
[29195.398492][T31720] 
[29195.398778][T31720] Freed by task 0:
[29195.399240][T31720]  kasan_save_stack+0x40/0x70
[29195.399825][T31720]  save_stack_info+0x34/0x128
[29195.400412][T31720]  kasan_save_free_info+0x18/0x28
[29195.401043][T31720]  ____kasan_slab_free+0x254/0x25c
[29195.401682][T31720]  __kasan_slab_free+0x10/0x20
[29195.402278][T31720]  slab_free_freelist_hook+0x174/0x1e0
[29195.402961][T31720]  kmem_cache_free+0xc4/0x348
[29195.403544][T31720]  __vm_area_free+0x84/0xa4
[29195.404103][T31720]  vm_area_free_rcu_cb+0x10/0x20
[29195.404719][T31720]  rcu_do_batch+0x214/0x720
[29195.405284][T31720]  rcu_core+0x1b0/0x408
[29195.405800][T31720]  rcu_core_si+0x10/0x20
[29195.406348][T31720]  __do_softirq+0x120/0x3f4
[29195.406907][T31720] 
[29195.407191][T31720] The buggy address belongs to the object at
ffffff80454ebdc0
[29195.407191][T31720]  which belongs to the cache vm_area_struct of
size 176
[29195.408978][T31720] The buggy address is located 32 bytes inside of
[29195.408978][T31720]  176-byte region [ffffff80454ebdc0,
ffffff80454ebe70)
[29195.410625][T31720] 
[29195.410911][T31720] The buggy address belongs to the physical page:
[29195.411709][T31720] page:0000000058f0f2f1 refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0xc54eb
[29195.412980][T31720] anon flags:
0x4000000000000800(slab|zone=1|kasantag=0x0)
[29195.413880][T31720] page_type: 0xffffffff()
[29195.414418][T31720] raw: 4000000000000800 f6ffff8002904500
fffffffe076fc8c0 dead000000000007
[29195.415488][T31720] raw: 0000000000000000 0000000000170017
00000001ffffffff 0000000000000000