All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+9b2492a161dae05a29f0@syzkaller.appspotmail.com>
To: acme@kernel.org, alexander.shishkin@linux.intel.com,
	jolsa@redhat.com, linux-kernel@vger.kernel.org,
	mark.rutland@arm.com, mingo@redhat.com, namhyung@kernel.org,
	peterz@infradead.org, syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in find_uprobe
Date: Thu, 04 Feb 2021 09:40:17 -0800	[thread overview]
Message-ID: <00000000000064319505ba86323c@google.com> (raw)
In-Reply-To: <0000000000006637f205ba55aa77@google.com>

syzbot has found a reproducer for the following issue on:

HEAD commit:    0e2c50f4 Add linux-next specific files for 20210204
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12665674d00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b5009c5bf1512a87
dashboard link: https://syzkaller.appspot.com/bug?extid=9b2492a161dae05a29f0
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178163e8d00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1094915f500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9b2492a161dae05a29f0@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in uprobe_cmp kernel/events/uprobes.c:620 [inline]
BUG: KASAN: use-after-free in __uprobe_cmp_key kernel/events/uprobes.c:646 [inline]
BUG: KASAN: use-after-free in rb_find include/linux/rbtree.h:289 [inline]
BUG: KASAN: use-after-free in __find_uprobe kernel/events/uprobes.c:661 [inline]
BUG: KASAN: use-after-free in find_uprobe+0x12c/0x150 kernel/events/uprobes.c:678
Read of size 8 at addr ffff888017f05d68 by task syz-executor109/8411

CPU: 1 PID: 8411 Comm: syz-executor109 Not tainted 5.11.0-rc6-next-20210204-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 uprobe_cmp kernel/events/uprobes.c:620 [inline]
 __uprobe_cmp_key kernel/events/uprobes.c:646 [inline]
 rb_find include/linux/rbtree.h:289 [inline]
 __find_uprobe kernel/events/uprobes.c:661 [inline]
 find_uprobe+0x12c/0x150 kernel/events/uprobes.c:678
 uprobe_unregister+0x1e/0x70 kernel/events/uprobes.c:1111
 __probe_event_disable+0x11e/0x240 kernel/trace/trace_uprobe.c:1084
 probe_event_disable+0x155/0x1c0 kernel/trace/trace_uprobe.c:1171
 trace_uprobe_register+0x45a/0x880 kernel/trace/trace_uprobe.c:1459
 perf_trace_event_unreg.isra.0+0xac/0x250 kernel/trace/trace_event_perf.c:162
 perf_uprobe_destroy+0xbb/0x130 kernel/trace/trace_event_perf.c:349
 _free_event+0x2ee/0x1380 kernel/events/core.c:4830
 put_event kernel/events/core.c:4924 [inline]
 perf_event_release_kernel+0xa24/0xe00 kernel/events/core.c:5039
 perf_release+0x33/0x40 kernel/events/core.c:5049
 __fput+0x283/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x190 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0xc5c/0x2ae0 kernel/exit.c:825
 do_group_exit+0x125/0x310 kernel/exit.c:922
 __do_sys_exit_group kernel/exit.c:933 [inline]
 __se_sys_exit_group kernel/exit.c:931 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43daf9
Code: Unable to access opcode bytes at RIP 0x43dacf.
RSP: 002b:00007ffd1d03f8e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004ae230 RCX: 000000000043daf9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000004ae230
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001

Allocated by task 8411:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:403 [inline]
 ____kasan_kmalloc mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc.constprop.0+0xa0/0xd0 mm/kasan/common.c:406
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:686 [inline]
 alloc_uprobe kernel/events/uprobes.c:731 [inline]
 __uprobe_register+0x19c/0x850 kernel/events/uprobes.c:1167
 trace_uprobe_enable kernel/trace/trace_uprobe.c:1060 [inline]
 probe_event_enable+0x357/0xa00 kernel/trace/trace_uprobe.c:1129
 trace_uprobe_register+0x443/0x880 kernel/trace/trace_uprobe.c:1456
 perf_trace_event_reg kernel/trace/trace_event_perf.c:129 [inline]
 perf_trace_event_init+0x549/0xa20 kernel/trace/trace_event_perf.c:204
 perf_uprobe_init+0x16f/0x210 kernel/trace/trace_event_perf.c:336
 perf_uprobe_event_init+0xff/0x1c0 kernel/events/core.c:9721
 perf_try_init_event+0x12a/0x560 kernel/events/core.c:11038
 perf_init_event kernel/events/core.c:11090 [inline]
 perf_event_alloc.part.0+0xe3b/0x3960 kernel/events/core.c:11370
 perf_event_alloc kernel/events/core.c:11749 [inline]
 __do_sys_perf_event_open+0x647/0x2e60 kernel/events/core.c:11847
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 8411:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357
 ____kasan_slab_free.part.0+0xe1/0x110 mm/kasan/common.c:364
 kasan_slab_free include/linux/kasan.h:191 [inline]
 slab_free_hook mm/slub.c:1562 [inline]
 slab_free_freelist_hook+0x82/0x1d0 mm/slub.c:1600
 slab_free mm/slub.c:3161 [inline]
 kfree+0xe5/0x7b0 mm/slub.c:4202
 put_uprobe kernel/events/uprobes.c:612 [inline]
 put_uprobe+0x13b/0x190 kernel/events/uprobes.c:601
 uprobe_apply+0xfc/0x130 kernel/events/uprobes.c:1231
 uprobe_perf_open kernel/trace/trace_uprobe.c:1311 [inline]
 trace_uprobe_register+0x5c9/0x880 kernel/trace/trace_uprobe.c:1463
 perf_trace_event_open kernel/trace/trace_event_perf.c:186 [inline]
 perf_trace_event_init kernel/trace/trace_event_perf.c:208 [inline]
 perf_trace_event_init+0x17a/0xa20 kernel/trace/trace_event_perf.c:195
 perf_uprobe_init+0x16f/0x210 kernel/trace/trace_event_perf.c:336
 perf_uprobe_event_init+0xff/0x1c0 kernel/events/core.c:9721
 perf_try_init_event+0x12a/0x560 kernel/events/core.c:11038
 perf_init_event kernel/events/core.c:11090 [inline]
 perf_event_alloc.part.0+0xe3b/0x3960 kernel/events/core.c:11370
 perf_event_alloc kernel/events/core.c:11749 [inline]
 __do_sys_perf_event_open+0x647/0x2e60 kernel/events/core.c:11847
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff888017f05c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 360 bytes inside of
 512-byte region [ffff888017f05c00, ffff888017f05e00)
The buggy address belongs to the page:
page:00000000b82340ef refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17f04
head:00000000b82340ef order:1 compound_mapcount:0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888010841c80
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888017f05c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888017f05c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888017f05d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff888017f05d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888017f05e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


      reply	other threads:[~2021-02-04 17:42 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-02  7:46 KASAN: use-after-free Read in find_uprobe syzbot
2021-02-04 17:40 ` syzbot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=00000000000064319505ba86323c@google.com \
    --to=syzbot+9b2492a161dae05a29f0@syzkaller.appspotmail.com \
    --cc=acme@kernel.org \
    --cc=alexander.shishkin@linux.intel.com \
    --cc=jolsa@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=mingo@redhat.com \
    --cc=namhyung@kernel.org \
    --cc=peterz@infradead.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.