From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0E4FC63777 for ; Mon, 30 Nov 2020 18:03:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 87E9F206F9 for ; Mon, 30 Nov 2020 18:03:49 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="u1KoQyd3" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387901AbgK3SDd (ORCPT ); Mon, 30 Nov 2020 13:03:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727952AbgK3SDd (ORCPT ); Mon, 30 Nov 2020 13:03:33 -0500 Received: from mail-pf1-x442.google.com (mail-pf1-x442.google.com [IPv6:2607:f8b0:4864:20::442]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1325DC0613D3 for ; Mon, 30 Nov 2020 10:02:53 -0800 (PST) Received: by mail-pf1-x442.google.com with SMTP id s21so10885588pfu.13 for ; Mon, 30 Nov 2020 10:02:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+KnM4rylz+5JwN8e2LD/Oqgwh76AHtfh1H1sva0UHVg=; b=u1KoQyd3tUhYzE94pnCh3hGRa3bI8yAM5cTH0eDsK5GMQopZ4S39Ca8DSIE8BJ0Q61 s2xyzoLzu9y+LiBUAeCAsFO7gXiVtn9kCy9XpyS8S7S11ZsVn0Vr50tsh8WEiUJOzHkv hTmVmKKhRMjz0qp23axgJ9zFPV8RvCCAr9PFjWWdqLxhT4RehQxFcjXXDemSTt/gfquj hTVXSrcWjzFbmqpD7Te4GzF64ENcQD1ZKY/L1vilGSjobSFagqf54Sofn/EKBvJOFLbr qpwk8RujMTlQEihs0WM8mjLylAIkci8UxUomUwIAjRh4Ve5FL88LaGR4Hu4X9WmsYmcJ cJVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+KnM4rylz+5JwN8e2LD/Oqgwh76AHtfh1H1sva0UHVg=; b=GyAfHgapNYlZH9jMUN+UNZ6ZX1eY+7LYFRW0DofQBlacnEN/8lBfIgrJq5xoNlcZvU ShVzMaafmHCop5EZJBINQErXMYZRlQ8KvpaykTWpAHoCYpWHHbeTb760XbIxU07xXfeQ sj9PsCEnWEU1VuuC+t3I/+zU0tuE1fnCQIZpPRleyVM6YUAi7hhftkstkBr9hbIQYtfI 1GZ6tG2j13iKtFsQS9jbXHdo3X8gJs6p0FnfNwWGtZrPE3+3oW6renDgW56LFAAHSs9m tAHH61As5zb2S/4cZMZZhVdKFrLDVzhh7GQrmZWbcjeSJD/+LOmKZSqkQyEx0wlm5ize CiNg== X-Gm-Message-State: AOAM532Xx9nyRAFggj8ggWb3GsRzMKYwuZm18DtQbOkJ0nqpLl6y4j0i icUufViZfNcfjNyyLl1+lJH/J5cZKVbAD/cFfOsNaA== X-Google-Smtp-Source: ABdhPJy16oGd1bpoVV1qk31yKXrKAyRUPjykBfaOCbpMCZiyksP5brGc1PuMzuKMTYMnc/AYZnLzXah5RQTl0REqkc0= X-Received: by 2002:a63:f1b:: with SMTP id e27mr8455904pgl.12.1606759372462; Mon, 30 Nov 2020 10:02:52 -0800 (PST) MIME-Version: 1.0 References: <000000000000b8a70905b54ef5ca@google.com> <000000000000d0f2fb05b552b3f3@google.com> In-Reply-To: <000000000000d0f2fb05b552b3f3@google.com> From: Axel Rasmussen Date: Mon, 30 Nov 2020 10:02:16 -0800 Message-ID: Subject: Re: KASAN: use-after-free Write in kernfs_path_from_node_locked To: syzbot Cc: Andrew Morton , "David S. Miller" , dsahern@kernel.org, gregkh@linuxfoundation.org, kuba@kernel.org, LKML , liuhangbin@gmail.com, netdev@vger.kernel.org, sfr@canb.auug.org.au, syzkaller-bugs@googlegroups.com, tj@kernel.org, Vlastimil Babka Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I spent some time looking into this: I think there are actually two bugs here. The write-after-free in kernfs_path_from_node_locked has an entirely different call trace (towards the end of this log: https://syzkaller.appspot.com/text?tag=CrashLog&x=16b1e0e9500000) compared to the NULL pointer dereference in neigh_periodic_work crash. For the neigh_periodic_work crash, I struggle to see how this is related to 0f818c4bc1. It looks like what happens is at some point (I haven't spotted where) we free struct neighbour->lock, and then later when the workqueue calls into us we try to acquire it. I don't see any connection between this code and 0f818c4bc1. The lock in question isn't mmap_lock, but rather a separate lock owned by the struct neighbour. For the kernfs_path_from_node_locked crash, that one *does* look related to 0f818c4bc1. I'll continue debugging and send a patch. On Mon, Nov 30, 2020 at 5:08 AM syzbot wrote: > > syzbot has bisected this issue to: > > commit 0f818c4bc1f3dc0d6d0ea916e0ab30cf5e75f4c0 > Author: Axel Rasmussen > Date: Tue Nov 24 05:37:42 2020 +0000 > > mm: mmap_lock: add tracepoints around lock acquisition > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1626291d500000 > start commit: 6174f052 Add linux-next specific files for 20201127 > git tree: linux-next > final oops: https://syzkaller.appspot.com/x/report.txt?x=1526291d500000 > console output: https://syzkaller.appspot.com/x/log.txt?x=1126291d500000 > kernel config: https://syzkaller.appspot.com/x/.config?x=79c69cf2521bef9c > dashboard link: https://syzkaller.appspot.com/bug?extid=19e6dd9943972fa1c58a > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12c3351d500000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14c28809500000 > > Reported-by: syzbot+19e6dd9943972fa1c58a@syzkaller.appspotmail.com > Fixes: 0f818c4bc1f3 ("mm: mmap_lock: add tracepoints around lock acquisition") > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection