* BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown
@ 2021-10-21 12:01 Naresh Kamboju
2021-10-21 12:17 ` John Garry
2021-10-21 12:20 ` Arnd Bergmann
0 siblings, 2 replies; 5+ messages in thread
From: Naresh Kamboju @ 2021-10-21 12:01 UTC (permalink / raw)
To: linux-block, open list, linux-scsi
Cc: kashyap.desai, Hannes Reinecke, ming.lei, John Garry,
Arnd Bergmann, lkft-triage, Anders Roxell
Following KASAN BUG noticed on linux next 20211021 while booting qemu-arm64
with allmodconfig.
[ 77.613151][ T5] BUG: KASAN: use-after-free in
blk_mq_sched_tags_teardown+0x54/0x140
[ 77.616733][ T5] Read of size 4 at addr ffff000010d9b258 by task
kworker/0:0/5
[ 77.620107][ T5]
[ 77.621306][ T5] CPU: 0 PID: 5 Comm: kworker/0:0 Tainted: G
W T 5.15.0-rc6-next-20211021 #1
4d661763b10b5f85042868a82a033ba2fc3e45c4
[ 77.626986][ T5] Hardware name: linux,dummy-virt (DT)
[ 77.629480][ T5] Workqueue: events kobject_delayed_cleanup
[ 77.632269][ T5] Call trace:
[ 77.633853][ T5] dump_backtrace+0x0/0x340
[ 77.635938][ T5] show_stack+0x34/0x80
[ 77.637934][ T5] dump_stack_lvl+0x88/0xd8
[ 77.640070][ T5] print_address_description.constprop.0+0x38/0x340
[ 77.643034][ T5] __kasan_report+0x160/0x200
[ 77.645227][ T5] kasan_report+0x5c/0x180
[ 77.647312][ T5] __asan_load4+0xc8/0x100
[ 77.649391][ T5] blk_mq_sched_tags_teardown+0x54/0x140
[ 77.651984][ T5] blk_mq_exit_sched+0x128/0x180
[ 77.654299][ T5] __elevator_exit+0x44/0x80
[ 77.656415][ T5] blk_release_queue+0x138/0x200
[ 77.658710][ T5] kobject_cleanup+0x144/0x200
[ 77.660971][ T5] kobject_delayed_cleanup+0x1c/0x40
[ 77.663404][ T5] process_one_work+0x50c/0x880
[ 77.665684][ T5] worker_thread+0x3ec/0x740
[ 77.667838][ T5] kthread+0x220/0x240
[ 77.669740][ T5] ret_from_fork+0x10/0x20
[ 77.671778][ T5]
[ 77.672974][ T5] Allocated by task 1:
[ 77.674888][ T5] kasan_save_stack+0x30/0x80
[ 77.677082][ T5] __kasan_kmalloc+0x78/0x100
[ 77.679235][ T5] kmem_cache_alloc_trace+0x360/0x400
[ 77.681707][ T5] add_mtd_blktrans_dev+0x274/0x6c0
[ 77.684079][ T5] mtdblock_add_mtd+0x110/0x180
[ 77.686333][ T5] blktrans_notify_add+0x68/0xc0
[ 77.688521][ T5] add_mtd_device+0x4e8/0x6c0
[ 77.690659][ T5] mtd_device_parse_register+0x13c/0x3c0
[ 77.693258][ T5] physmap_flash_probe+0x83c/0x8c0
[ 77.695630][ T5] platform_probe+0x98/0x140
[ 77.697776][ T5] really_probe+0x234/0x6c0
[ 77.699913][ T5] __driver_probe_device+0x144/0x240
[ 77.702307][ T5] driver_probe_device+0x68/0x140
[ 77.704502][ T5] __driver_attach+0x1f0/0x280
[ 77.706598][ T5] bus_for_each_dev+0xdc/0x1c0
[ 77.708669][ T5] driver_attach+0x40/0x80
[ 77.710621][ T5] bus_add_driver+0x1c0/0x300
[ 77.712660][ T5] driver_register+0x170/0x200
[ 77.714749][ T5] __platform_driver_register+0x50/0x80
[ 77.717148][ T5] physmap_init+0x5c/0xfc
[ 77.719074][ T5] do_one_initcall+0xb0/0x2c0
[ 77.721127][ T5] do_initcalls+0x17c/0x244
[ 77.723109][ T5] kernel_init_freeable+0x2d4/0x378
[ 77.725376][ T5] kernel_init+0x34/0x180
[ 77.727304][ T5] ret_from_fork+0x10/0x20
[ 77.729261][ T5]
[ 77.730367][ T5] Freed by task 1:
[ 77.732009][ T5] kasan_save_stack+0x30/0x80
[ 77.734083][ T5] kasan_set_track+0x30/0x80
[ 77.736085][ T5] kasan_set_free_info+0x34/0x80
[ 77.738261][ T5] ____kasan_slab_free+0xfc/0x1c0
[ 77.740433][ T5] __kasan_slab_free+0x3c/0x80
[ 77.742518][ T5] slab_free_freelist_hook+0x1d4/0x2c0
[ 77.744892][ T5] kfree+0x160/0x300
[ 77.746618][ T5] blktrans_dev_release+0x64/0x100
[ 77.748821][ T5] del_mtd_blktrans_dev+0x1c0/0x240
[ 77.751079][ T5] mtdblock_remove_dev+0x28/0x80
[ 77.753246][ T5] blktrans_notify_remove+0xa4/0x140
[ 77.755507][ T5] del_mtd_device+0x84/0x1c0
[ 77.757541][ T5] mtd_device_unregister+0x90/0xc0
[ 77.759764][ T5] physmap_flash_remove+0x58/0x180
[ 77.762012][ T5] platform_remove+0x48/0xc0
[ 77.764032][ T5] __device_release_driver+0x1dc/0x340
[ 77.766393][ T5] driver_detach+0x138/0x200
[ 77.768396][ T5] bus_remove_driver+0x100/0x180
[ 77.770554][ T5] driver_unregister+0x64/0xc0
[ 77.772633][ T5] platform_driver_unregister+0x28/0x80
[ 77.775042][ T5] physmap_init+0xc4/0xfc
[ 77.776994][ T5] do_one_initcall+0xb0/0x2c0
[ 77.779028][ T5] do_initcalls+0x17c/0x244
[ 77.781023][ T5] kernel_init_freeable+0x2d4/0x378
[ 77.783269][ T5] kernel_init+0x34/0x180
[ 77.785196][ T5] ret_from_fork+0x10/0x20
[ 77.787135][ T5]
[ 77.788230][ T5] The buggy address belongs to the object at
ffff000010d9b200
[ 77.788230][ T5] which belongs to the cache kmalloc-512 of size 512
[ 77.793866][ T5] The buggy address is located 88 bytes inside of
[ 77.793866][ T5] 512-byte region [ffff000010d9b200, ffff000010d9b400)
[ 77.799169][ T5] The buggy address belongs to the page:
[ 77.801555][ T5] page:fffffc0000436600 refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x50d98
[ 77.805683][ T5] head:fffffc0000436600 order:2
compound_mapcount:0 compound_pincount:0
[ 77.809109][ T5] flags:
0x1fffe0000010200(slab|head|node=0|zone=0|lastcpupid=0xffff)
[ 77.812496][ T5] raw: 01fffe0000010200 fffffc0000436408
fffffc0000436908 ffff000006c03080
[ 77.816037][ T5] raw: 0000000000000000 00000000000a000a
00000001ffffffff 0000000000000000
[ 77.819566][ T5] page dumped because: kasan: bad access detected
[ 77.822255][ T5]
[ 77.823357][ T5] Memory state around the buggy address:
[ 77.825747][ T5] ffff000010d9b100: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[ 77.829081][ T5] ffff000010d9b180: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[ 77.832393][ T5] >ffff000010d9b200: fa fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 77.835714][ T5] ^
[ 77.838602][ T5] ffff000010d9b280: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 77.841936][ T5] ffff000010d9b300: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
full boot log link,
https://pastebin.com/xL5MYSD6
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown
2021-10-21 12:01 BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown Naresh Kamboju
@ 2021-10-21 12:17 ` John Garry
2021-10-21 13:35 ` Anders Roxell
2021-10-21 12:20 ` Arnd Bergmann
1 sibling, 1 reply; 5+ messages in thread
From: John Garry @ 2021-10-21 12:17 UTC (permalink / raw)
To: Naresh Kamboju, linux-block, open list, linux-scsi
Cc: kashyap.desai, Hannes Reinecke, ming.lei, Arnd Bergmann,
lkft-triage, Anders Roxell
On 21/10/2021 13:01, Naresh Kamboju wrote:
> Following KASAN BUG noticed on linux next 20211021 while booting qemu-arm64
> with allmodconfig.
Thanks for the report.
I can't read comments and have broken the same thing twice ... please
try this change:
---8<---
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index e85b7556b096..6a9444848e3a 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -541,7 +541,7 @@ static void blk_mq_sched_tags_teardown(struct
request_queue *q, unsigned int fla
queue_for_each_hw_ctx(q, hctx, i) {
if (hctx->sched_tags) {
- if (!blk_mq_is_shared_tags(q->tag_set->flags))
+ if (!blk_mq_is_shared_tags(flags))
blk_mq_free_rq_map(hctx->sched_tags);
hctx->sched_tags = NULL;
}
--- >8 ---
thanks
>
> [ 77.613151][ T5] BUG: KASAN: use-after-free in
> blk_mq_sched_tags_teardown+0x54/0x140
> [ 77.616733][ T5] Read of size 4 at addr ffff000010d9b258 by task
> kworker/0:0/5
> [ 77.620107][ T5]
> [ 77.621306][ T5] CPU: 0 PID: 5 Comm: kworker/0:0 Tainted: G
> W T 5.15.0-rc6-next-20211021 #1
> 4d661763b10b5f85042868a82a033ba2fc3e45c4
> [ 77.626986][ T5] Hardware name: linux,dummy-virt (DT)
> [ 77.629480][ T5] Workqueue: events kobject_delayed_cleanup
> [ 77.632269][ T5] Call trace:
> [ 77.633853][ T5] dump_backtrace+0x0/0x340
> [ 77.635938][ T5] show_stack+0x34/0x80
> [ 77.637934][ T5] dump_stack_lvl+0x88/0xd8
> [ 77.640070][ T5] print_address_description.constprop.0+0x38/0x340
> [ 77.643034][ T5] __kasan_report+0x160/0x200
> [ 77.645227][ T5] kasan_report+0x5c/0x180
> [ 77.647312][ T5] __asan_load4+0xc8/0x100
> [ 77.649391][ T5] blk_mq_sched_tags_teardown+0x54/0x140
> [ 77.651984][ T5] blk_mq_exit_sched+0x128/0x180
> [ 77.654299][ T5] __elevator_exit+0x44/0x80
> [ 77.656415][ T5] blk_release_queue+0x138/0x200
> [ 77.658710][ T5] kobject_cleanup+0x144/0x200
> [ 77.660971][ T5] kobject_delayed_cleanup+0x1c/0x40
> [ 77.663404][ T5] process_one_work+0x50c/0x880
> [ 77.665684][ T5] worker_thread+0x3ec/0x740
> [ 77.667838][ T5] kthread+0x220/0x240
> [ 77.669740][ T5] ret_from_fork+0x10/0x20
> [ 77.671778][ T5]
> [ 77.672974][ T5] Allocated by task 1:
> [ 77.674888][ T5] kasan_save_stack+0x30/0x80
> [ 77.677082][ T5] __kasan_kmalloc+0x78/0x100
> [ 77.679235][ T5] kmem_cache_alloc_trace+0x360/0x400
> [ 77.681707][ T5] add_mtd_blktrans_dev+0x274/0x6c0
> [ 77.684079][ T5] mtdblock_add_mtd+0x110/0x180
> [ 77.686333][ T5] blktrans_notify_add+0x68/0xc0
> [ 77.688521][ T5] add_mtd_device+0x4e8/0x6c0
> [ 77.690659][ T5] mtd_device_parse_register+0x13c/0x3c0
> [ 77.693258][ T5] physmap_flash_probe+0x83c/0x8c0
> [ 77.695630][ T5] platform_probe+0x98/0x140
> [ 77.697776][ T5] really_probe+0x234/0x6c0
> [ 77.699913][ T5] __driver_probe_device+0x144/0x240
> [ 77.702307][ T5] driver_probe_device+0x68/0x140
> [ 77.704502][ T5] __driver_attach+0x1f0/0x280
> [ 77.706598][ T5] bus_for_each_dev+0xdc/0x1c0
> [ 77.708669][ T5] driver_attach+0x40/0x80
> [ 77.710621][ T5] bus_add_driver+0x1c0/0x300
> [ 77.712660][ T5] driver_register+0x170/0x200
> [ 77.714749][ T5] __platform_driver_register+0x50/0x80
> [ 77.717148][ T5] physmap_init+0x5c/0xfc
> [ 77.719074][ T5] do_one_initcall+0xb0/0x2c0
> [ 77.721127][ T5] do_initcalls+0x17c/0x244
> [ 77.723109][ T5] kernel_init_freeable+0x2d4/0x378
> [ 77.725376][ T5] kernel_init+0x34/0x180
> [ 77.727304][ T5] ret_from_fork+0x10/0x20
> [ 77.729261][ T5]
> [ 77.730367][ T5] Freed by task 1:
> [ 77.732009][ T5] kasan_save_stack+0x30/0x80
> [ 77.734083][ T5] kasan_set_track+0x30/0x80
> [ 77.736085][ T5] kasan_set_free_info+0x34/0x80
> [ 77.738261][ T5] ____kasan_slab_free+0xfc/0x1c0
> [ 77.740433][ T5] __kasan_slab_free+0x3c/0x80
> [ 77.742518][ T5] slab_free_freelist_hook+0x1d4/0x2c0
> [ 77.744892][ T5] kfree+0x160/0x300
> [ 77.746618][ T5] blktrans_dev_release+0x64/0x100
> [ 77.748821][ T5] del_mtd_blktrans_dev+0x1c0/0x240
> [ 77.751079][ T5] mtdblock_remove_dev+0x28/0x80
> [ 77.753246][ T5] blktrans_notify_remove+0xa4/0x140
> [ 77.755507][ T5] del_mtd_device+0x84/0x1c0
> [ 77.757541][ T5] mtd_device_unregister+0x90/0xc0
> [ 77.759764][ T5] physmap_flash_remove+0x58/0x180
> [ 77.762012][ T5] platform_remove+0x48/0xc0
> [ 77.764032][ T5] __device_release_driver+0x1dc/0x340
> [ 77.766393][ T5] driver_detach+0x138/0x200
> [ 77.768396][ T5] bus_remove_driver+0x100/0x180
> [ 77.770554][ T5] driver_unregister+0x64/0xc0
> [ 77.772633][ T5] platform_driver_unregister+0x28/0x80
> [ 77.775042][ T5] physmap_init+0xc4/0xfc
> [ 77.776994][ T5] do_one_initcall+0xb0/0x2c0
> [ 77.779028][ T5] do_initcalls+0x17c/0x244
> [ 77.781023][ T5] kernel_init_freeable+0x2d4/0x378
> [ 77.783269][ T5] kernel_init+0x34/0x180
> [ 77.785196][ T5] ret_from_fork+0x10/0x20
> [ 77.787135][ T5]
> [ 77.788230][ T5] The buggy address belongs to the object at
> ffff000010d9b200
> [ 77.788230][ T5] which belongs to the cache kmalloc-512 of size 512
> [ 77.793866][ T5] The buggy address is located 88 bytes inside of
> [ 77.793866][ T5] 512-byte region [ffff000010d9b200, ffff000010d9b400)
> [ 77.799169][ T5] The buggy address belongs to the page:
> [ 77.801555][ T5] page:fffffc0000436600 refcount:1 mapcount:0
> mapping:0000000000000000 index:0x0 pfn:0x50d98
> [ 77.805683][ T5] head:fffffc0000436600 order:2
> compound_mapcount:0 compound_pincount:0
> [ 77.809109][ T5] flags:
> 0x1fffe0000010200(slab|head|node=0|zone=0|lastcpupid=0xffff)
> [ 77.812496][ T5] raw: 01fffe0000010200 fffffc0000436408
> fffffc0000436908 ffff000006c03080
> [ 77.816037][ T5] raw: 0000000000000000 00000000000a000a
> 00000001ffffffff 0000000000000000
> [ 77.819566][ T5] page dumped because: kasan: bad access detected
> [ 77.822255][ T5]
> [ 77.823357][ T5] Memory state around the buggy address:
> [ 77.825747][ T5] ffff000010d9b100: fc fc fc fc fc fc fc fc fc
> fc fc fc fc fc fc fc
> [ 77.829081][ T5] ffff000010d9b180: fc fc fc fc fc fc fc fc fc
> fc fc fc fc fc fc fc
> [ 77.832393][ T5] >ffff000010d9b200: fa fb fb fb fb fb fb fb fb
> fb fb fb fb fb fb fb
> [ 77.835714][ T5] ^
> [ 77.838602][ T5] ffff000010d9b280: fb fb fb fb fb fb fb fb fb
> fb fb fb fb fb fb fb
> [ 77.841936][ T5] ffff000010d9b300: fb fb fb fb fb fb fb fb fb
> fb fb fb fb fb fb fb
>
> full boot log link,
> https://pastebin.com/xL5MYSD6
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
>
> --
> Linaro LKFT
> https://lkft.linaro.org
>
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown
2021-10-21 12:01 BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown Naresh Kamboju
2021-10-21 12:17 ` John Garry
@ 2021-10-21 12:20 ` Arnd Bergmann
2021-10-21 13:20 ` John Garry
1 sibling, 1 reply; 5+ messages in thread
From: Arnd Bergmann @ 2021-10-21 12:20 UTC (permalink / raw)
To: Naresh Kamboju
Cc: linux-block, open list, linux-scsi, Kashyap Desai,
Hannes Reinecke, Ming Lei, John Garry, Arnd Bergmann,
lkft-triage, Anders Roxell, Miquel Raynal, Richard Weinberger,
Vignesh R, linux-mtd
On Thu, Oct 21, 2021 at 2:01 PM Naresh Kamboju
<naresh.kamboju@linaro.org> wrote:
>
> Following KASAN BUG noticed on linux next 20211021 while booting qemu-arm64
> with allmodconfig.
> [ 77.730367][ T5] Freed by task 1:
> [ 77.732009][ T5] kasan_save_stack+0x30/0x80
> [ 77.734083][ T5] kasan_set_track+0x30/0x80
> [ 77.736085][ T5] kasan_set_free_info+0x34/0x80
> [ 77.738261][ T5] ____kasan_slab_free+0xfc/0x1c0
> [ 77.740433][ T5] __kasan_slab_free+0x3c/0x80
> [ 77.742518][ T5] slab_free_freelist_hook+0x1d4/0x2c0
> [ 77.744892][ T5] kfree+0x160/0x300
> [ 77.746618][ T5] blktrans_dev_release+0x64/0x100
> [ 77.748821][ T5] del_mtd_blktrans_dev+0x1c0/0x240
> [ 77.751079][ T5] mtdblock_remove_dev+0x28/0x80
> [ 77.753246][ T5] blktrans_notify_remove+0xa4/0x140
> [ 77.755507][ T5] del_mtd_device+0x84/0x1c0
> [ 77.757541][ T5] mtd_device_unregister+0x90/0xc0
> [ 77.759764][ T5] physmap_flash_remove+0x58/0x180
> [ 77.762012][ T5] platform_remove+0x48/0xc0
> [ 77.764032][ T5] __device_release_driver+0x1dc/0x340
> [ 77.766393][ T5] driver_detach+0x138/0x200
> [ 77.768396][ T5] bus_remove_driver+0x100/0x180
> [ 77.770554][ T5] driver_unregister+0x64/0xc0
> [ 77.772633][ T5] platform_driver_unregister+0x28/0x80
> [ 77.775042][ T5] physmap_init+0xc4/0xfc
> [ 77.776994][ T5] do_one_initcall+0xb0/0x2c0
> [ 77.779028][ T5] do_initcalls+0x17c/0x244
> [ 77.781023][ T5] kernel_init_freeable+0x2d4/0x378
> [ 77.783269][ T5] kernel_init+0x34/0x180
> [ 77.785196][ T5] ret_from_fork+0x10/0x20
> [ 77.787135][ T5]
> ...
> full boot log link,
> https://pastebin.com/xL5MYSD6
I think this is related to an earlier bug that Anders reported a while ago,
see [1]. I had looked at it originally, and found that this probably a
device that gets probed from CONFIG_MTD_PHYSMAP_COMPAT
and then freed again immediately after we find the device does not
exist, starting with commit dcb3e137ce9b ("[MTD] physmap: make
physmap compat explicit").
It's not really the fault of CONFIG_MTD_PHYSMAP_COMPAT
describing a nonexisting device, but instead it's something in the
cleanup path.
Arnd
[1] https://lore.kernel.org/linux-mtd/CADYN=9Kjw_3cDGAvh9=+nNwdYof1kUPKG-SUOP5FsQhZ+gz62Q@mail.gmail.com/
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown
2021-10-21 12:20 ` Arnd Bergmann
@ 2021-10-21 13:20 ` John Garry
0 siblings, 0 replies; 5+ messages in thread
From: John Garry @ 2021-10-21 13:20 UTC (permalink / raw)
To: Arnd Bergmann, Naresh Kamboju
Cc: linux-block, open list, linux-scsi, Kashyap Desai,
Hannes Reinecke, Ming Lei, lkft-triage, Anders Roxell,
Miquel Raynal, Richard Weinberger, Vignesh R, linux-mtd
On 21/10/2021 13:20, Arnd Bergmann wrote:
> On Thu, Oct 21, 2021 at 2:01 PM Naresh Kamboju
> <naresh.kamboju@linaro.org> wrote:
>>
>> Following KASAN BUG noticed on linux next 20211021 while booting qemu-arm64
>> with allmodconfig.
>
>> [ 77.730367][ T5] Freed by task 1:
>> [ 77.732009][ T5] kasan_save_stack+0x30/0x80
>> [ 77.734083][ T5] kasan_set_track+0x30/0x80
>> [ 77.736085][ T5] kasan_set_free_info+0x34/0x80
>> [ 77.738261][ T5] ____kasan_slab_free+0xfc/0x1c0
>> [ 77.740433][ T5] __kasan_slab_free+0x3c/0x80
>> [ 77.742518][ T5] slab_free_freelist_hook+0x1d4/0x2c0
>> [ 77.744892][ T5] kfree+0x160/0x300
>> [ 77.746618][ T5] blktrans_dev_release+0x64/0x100
>> [ 77.748821][ T5] del_mtd_blktrans_dev+0x1c0/0x240
>> [ 77.751079][ T5] mtdblock_remove_dev+0x28/0x80
>> [ 77.753246][ T5] blktrans_notify_remove+0xa4/0x140
>> [ 77.755507][ T5] del_mtd_device+0x84/0x1c0
>> [ 77.757541][ T5] mtd_device_unregister+0x90/0xc0
>> [ 77.759764][ T5] physmap_flash_remove+0x58/0x180
>> [ 77.762012][ T5] platform_remove+0x48/0xc0
>> [ 77.764032][ T5] __device_release_driver+0x1dc/0x340
>> [ 77.766393][ T5] driver_detach+0x138/0x200
>> [ 77.768396][ T5] bus_remove_driver+0x100/0x180
>> [ 77.770554][ T5] driver_unregister+0x64/0xc0
>> [ 77.772633][ T5] platform_driver_unregister+0x28/0x80
>> [ 77.775042][ T5] physmap_init+0xc4/0xfc
>> [ 77.776994][ T5] do_one_initcall+0xb0/0x2c0
>> [ 77.779028][ T5] do_initcalls+0x17c/0x244
>> [ 77.781023][ T5] kernel_init_freeable+0x2d4/0x378
>> [ 77.783269][ T5] kernel_init+0x34/0x180
>> [ 77.785196][ T5] ret_from_fork+0x10/0x20
>> [ 77.787135][ T5]
>> ...
>> full boot log link,
>> https://pastebin.com/xL5MYSD6
>
> I think this is related to an earlier bug that Anders reported a while ago,
> see [1]. I had looked at it originally, and found that this probably a
> device that gets probed from CONFIG_MTD_PHYSMAP_COMPAT
> and then freed again immediately after we find the device does not
> exist, starting with commit dcb3e137ce9b ("[MTD] physmap: make
> physmap compat explicit").
>
> It's not really the fault of CONFIG_MTD_PHYSMAP_COMPAT
> describing a nonexisting device, but instead it's something in the
> cleanup path.
>
Maybe there is more than one issue, but the fix I mentioned in my
earlier reply resolves a UAF which can I trigger on my system:
[ 674.333618] FAT-fs (sda1): unable to read boot sector to mark fs as dirty
[ 674.422877]
==================================================================
[ 674.430097] BUG: KASAN: use-after-free in
blk_mq_sched_tags_teardown+0xb4/0x12c
[ 674.437412] Read of size 4 at addr ffff001053f40100 by task umount/557
[ 674.443934]
[ 674.445418] CPU: 6 PID: 557 Comm: umount Not tainted
5.15.0-rc3-00045-g000f88ac8830 #420
[ 674.453502] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon
D05 IT21 Nemo 2.0 RC0 04/18/2018
[ 674.462626] Call trace:
[ 674.465063] dump_backtrace+0x0/0x2b4
[ 674.468724] show_stack+0x1c/0x30
[ 674.472036] dump_stack_lvl+0x68/0x84
[ 674.475695] print_address_description.constprop.0+0x74/0x2b8
[ 674.481438] kasan_report+0x1e4/0x24c
[ 674.485096] __asan_load4+0x98/0xd0
[ 674.488579] blk_mq_sched_tags_teardown+0xb4/0x12c
[ 674.493366] blk_mq_exit_sched+0x110/0x140
[ 674.497459] __elevator_exit+0x38/0x60
[ 674.501203] blk_release_queue+0x10c/0x1cc
[ 674.505295] kobject_put+0xac/0x180
[ 674.508780] blk_put_queue+0x18/0x24
[ 674.512350] disk_release+0x64/0x90
[ 674.515836] device_release+0x98/0x110
[ 674.519581] kobject_put+0xac/0x180
[ 674.523065] put_device+0x18/0x30
[ 674.526374] put_disk+0x30/0x44
[ 674.529511] part_release+0x28/0x4c
[ 674.532993] device_release+0x98/0x110
[ 674.536737] kobject_put+0xac/0x180
[ 674.540221] put_device+0x18/0x30
[ 674.543531] blkdev_put+0xe4/0x340
[ 674.546930] kill_block_super+0x60/0xa0
[ 674.550762] deactivate_locked_super+0x78/0x104
[ 674.555289] deactivate_super+0x90/0xac
[ 674.559121] cleanup_mnt+0x164/0x214
[ 674.562691] __cleanup_mnt+0x18/0x24
[ 674.566260] task_work_run+0xb8/0x1cc
[ 674.569918] do_notify_resume+0x11a8/0x1abc
[ 674.574098] el0_svc+0x6c/0x7c
[ 674.577148] el0t_64_sync_handler+0x1a8/0x1b0
[ 674.581500] el0t_64_sync+0x1a0/0x1a4
[ 674.585157]
[ 674.586639] The buggy address belongs to the page:
[ 674.591420] page:(____ptrval____) refcount:0 mapcount:-128
mapping:0000000000000000 index:0x0 pfn:0x1053f40
[ 674.601154] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff)
[ 674.607594] raw: 0bfffc0000000000 fffffc00415ff008 ffff0017fbffebb0
0000000000000000
[ 674.615331] raw: 0000000000000000 0000000000000006 00000000ffffff7f
0000000000000000
[ 674.623065] page dumped because: kasan: bad access detected
[ 674.628628]
[ 674.630109] Memory state around the buggy address:
[ 674.634891] ffff001053f40000: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff
[ 674.642105] ffff001053f40080: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff
[ 674.649319] >ffff001053f40100: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff
[ 674.656531] ^
[ 674.659751] ffff001053f40180: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff
[ 674.666964] ffff001053f40200: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff
[ 674.674177]
==================================================================
[ 674.681389] Disabling lock debugging due to kernel taint
root@(none)$
root@(none)$
Note that my baseline includes recent block changes which would be on
next 20211021
Thanks,
John
> Arnd
>
> [1] https://lore.kernel.org/linux-mtd/CADYN=9Kjw_3cDGAvh9=+nNwdYof1kUPKG-SUOP5FsQhZ+gz62Q@mail.gmail.com/
> .
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown
2021-10-21 12:17 ` John Garry
@ 2021-10-21 13:35 ` Anders Roxell
0 siblings, 0 replies; 5+ messages in thread
From: Anders Roxell @ 2021-10-21 13:35 UTC (permalink / raw)
To: John Garry
Cc: Naresh Kamboju, linux-block, open list, linux-scsi,
kashyap.desai, Hannes Reinecke, ming.lei, Arnd Bergmann,
lkft-triage
On Thu, 21 Oct 2021 at 14:17, John Garry <john.garry@huawei.com> wrote:
>
> On 21/10/2021 13:01, Naresh Kamboju wrote:
> > Following KASAN BUG noticed on linux next 20211021 while booting qemu-arm64
> > with allmodconfig.
>
> Thanks for the report.
>
> I can't read comments and have broken the same thing twice ... please
> try this change:
>
> ---8<---
>
> diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
> index e85b7556b096..6a9444848e3a 100644
> --- a/block/blk-mq-sched.c
> +++ b/block/blk-mq-sched.c
> @@ -541,7 +541,7 @@ static void blk_mq_sched_tags_teardown(struct
> request_queue *q, unsigned int fla
>
> queue_for_each_hw_ctx(q, hctx, i) {
> if (hctx->sched_tags) {
> - if (!blk_mq_is_shared_tags(q->tag_set->flags))
> + if (!blk_mq_is_shared_tags(flags))
> blk_mq_free_rq_map(hctx->sched_tags);
> hctx->sched_tags = NULL;
> }
That fixed this issue.
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Cheers,
Anders
>
>
> --- >8 ---
>
> thanks
>
> >
> > [ 77.613151][ T5] BUG: KASAN: use-after-free in
> > blk_mq_sched_tags_teardown+0x54/0x140
> > [ 77.616733][ T5] Read of size 4 at addr ffff000010d9b258 by task
> > kworker/0:0/5
> > [ 77.620107][ T5]
> > [ 77.621306][ T5] CPU: 0 PID: 5 Comm: kworker/0:0 Tainted: G
> > W T 5.15.0-rc6-next-20211021 #1
> > 4d661763b10b5f85042868a82a033ba2fc3e45c4
> > [ 77.626986][ T5] Hardware name: linux,dummy-virt (DT)
> > [ 77.629480][ T5] Workqueue: events kobject_delayed_cleanup
> > [ 77.632269][ T5] Call trace:
> > [ 77.633853][ T5] dump_backtrace+0x0/0x340
> > [ 77.635938][ T5] show_stack+0x34/0x80
> > [ 77.637934][ T5] dump_stack_lvl+0x88/0xd8
> > [ 77.640070][ T5] print_address_description.constprop.0+0x38/0x340
> > [ 77.643034][ T5] __kasan_report+0x160/0x200
> > [ 77.645227][ T5] kasan_report+0x5c/0x180
> > [ 77.647312][ T5] __asan_load4+0xc8/0x100
> > [ 77.649391][ T5] blk_mq_sched_tags_teardown+0x54/0x140
> > [ 77.651984][ T5] blk_mq_exit_sched+0x128/0x180
> > [ 77.654299][ T5] __elevator_exit+0x44/0x80
> > [ 77.656415][ T5] blk_release_queue+0x138/0x200
> > [ 77.658710][ T5] kobject_cleanup+0x144/0x200
> > [ 77.660971][ T5] kobject_delayed_cleanup+0x1c/0x40
> > [ 77.663404][ T5] process_one_work+0x50c/0x880
> > [ 77.665684][ T5] worker_thread+0x3ec/0x740
> > [ 77.667838][ T5] kthread+0x220/0x240
> > [ 77.669740][ T5] ret_from_fork+0x10/0x20
> > [ 77.671778][ T5]
> > [ 77.672974][ T5] Allocated by task 1:
> > [ 77.674888][ T5] kasan_save_stack+0x30/0x80
> > [ 77.677082][ T5] __kasan_kmalloc+0x78/0x100
> > [ 77.679235][ T5] kmem_cache_alloc_trace+0x360/0x400
> > [ 77.681707][ T5] add_mtd_blktrans_dev+0x274/0x6c0
> > [ 77.684079][ T5] mtdblock_add_mtd+0x110/0x180
> > [ 77.686333][ T5] blktrans_notify_add+0x68/0xc0
> > [ 77.688521][ T5] add_mtd_device+0x4e8/0x6c0
> > [ 77.690659][ T5] mtd_device_parse_register+0x13c/0x3c0
> > [ 77.693258][ T5] physmap_flash_probe+0x83c/0x8c0
> > [ 77.695630][ T5] platform_probe+0x98/0x140
> > [ 77.697776][ T5] really_probe+0x234/0x6c0
> > [ 77.699913][ T5] __driver_probe_device+0x144/0x240
> > [ 77.702307][ T5] driver_probe_device+0x68/0x140
> > [ 77.704502][ T5] __driver_attach+0x1f0/0x280
> > [ 77.706598][ T5] bus_for_each_dev+0xdc/0x1c0
> > [ 77.708669][ T5] driver_attach+0x40/0x80
> > [ 77.710621][ T5] bus_add_driver+0x1c0/0x300
> > [ 77.712660][ T5] driver_register+0x170/0x200
> > [ 77.714749][ T5] __platform_driver_register+0x50/0x80
> > [ 77.717148][ T5] physmap_init+0x5c/0xfc
> > [ 77.719074][ T5] do_one_initcall+0xb0/0x2c0
> > [ 77.721127][ T5] do_initcalls+0x17c/0x244
> > [ 77.723109][ T5] kernel_init_freeable+0x2d4/0x378
> > [ 77.725376][ T5] kernel_init+0x34/0x180
> > [ 77.727304][ T5] ret_from_fork+0x10/0x20
> > [ 77.729261][ T5]
> > [ 77.730367][ T5] Freed by task 1:
> > [ 77.732009][ T5] kasan_save_stack+0x30/0x80
> > [ 77.734083][ T5] kasan_set_track+0x30/0x80
> > [ 77.736085][ T5] kasan_set_free_info+0x34/0x80
> > [ 77.738261][ T5] ____kasan_slab_free+0xfc/0x1c0
> > [ 77.740433][ T5] __kasan_slab_free+0x3c/0x80
> > [ 77.742518][ T5] slab_free_freelist_hook+0x1d4/0x2c0
> > [ 77.744892][ T5] kfree+0x160/0x300
> > [ 77.746618][ T5] blktrans_dev_release+0x64/0x100
> > [ 77.748821][ T5] del_mtd_blktrans_dev+0x1c0/0x240
> > [ 77.751079][ T5] mtdblock_remove_dev+0x28/0x80
> > [ 77.753246][ T5] blktrans_notify_remove+0xa4/0x140
> > [ 77.755507][ T5] del_mtd_device+0x84/0x1c0
> > [ 77.757541][ T5] mtd_device_unregister+0x90/0xc0
> > [ 77.759764][ T5] physmap_flash_remove+0x58/0x180
> > [ 77.762012][ T5] platform_remove+0x48/0xc0
> > [ 77.764032][ T5] __device_release_driver+0x1dc/0x340
> > [ 77.766393][ T5] driver_detach+0x138/0x200
> > [ 77.768396][ T5] bus_remove_driver+0x100/0x180
> > [ 77.770554][ T5] driver_unregister+0x64/0xc0
> > [ 77.772633][ T5] platform_driver_unregister+0x28/0x80
> > [ 77.775042][ T5] physmap_init+0xc4/0xfc
> > [ 77.776994][ T5] do_one_initcall+0xb0/0x2c0
> > [ 77.779028][ T5] do_initcalls+0x17c/0x244
> > [ 77.781023][ T5] kernel_init_freeable+0x2d4/0x378
> > [ 77.783269][ T5] kernel_init+0x34/0x180
> > [ 77.785196][ T5] ret_from_fork+0x10/0x20
> > [ 77.787135][ T5]
> > [ 77.788230][ T5] The buggy address belongs to the object at
> > ffff000010d9b200
> > [ 77.788230][ T5] which belongs to the cache kmalloc-512 of size 512
> > [ 77.793866][ T5] The buggy address is located 88 bytes inside of
> > [ 77.793866][ T5] 512-byte region [ffff000010d9b200, ffff000010d9b400)
> > [ 77.799169][ T5] The buggy address belongs to the page:
> > [ 77.801555][ T5] page:fffffc0000436600 refcount:1 mapcount:0
> > mapping:0000000000000000 index:0x0 pfn:0x50d98
> > [ 77.805683][ T5] head:fffffc0000436600 order:2
> > compound_mapcount:0 compound_pincount:0
> > [ 77.809109][ T5] flags:
> > 0x1fffe0000010200(slab|head|node=0|zone=0|lastcpupid=0xffff)
> > [ 77.812496][ T5] raw: 01fffe0000010200 fffffc0000436408
> > fffffc0000436908 ffff000006c03080
> > [ 77.816037][ T5] raw: 0000000000000000 00000000000a000a
> > 00000001ffffffff 0000000000000000
> > [ 77.819566][ T5] page dumped because: kasan: bad access detected
> > [ 77.822255][ T5]
> > [ 77.823357][ T5] Memory state around the buggy address:
> > [ 77.825747][ T5] ffff000010d9b100: fc fc fc fc fc fc fc fc fc
> > fc fc fc fc fc fc fc
> > [ 77.829081][ T5] ffff000010d9b180: fc fc fc fc fc fc fc fc fc
> > fc fc fc fc fc fc fc
> > [ 77.832393][ T5] >ffff000010d9b200: fa fb fb fb fb fb fb fb fb
> > fb fb fb fb fb fb fb
> > [ 77.835714][ T5] ^
> > [ 77.838602][ T5] ffff000010d9b280: fb fb fb fb fb fb fb fb fb
> > fb fb fb fb fb fb fb
> > [ 77.841936][ T5] ffff000010d9b300: fb fb fb fb fb fb fb fb fb
> > fb fb fb fb fb fb fb
> >
> > full boot log link,
> > https://pastebin.com/xL5MYSD6
> >
> > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> >
> > --
> > Linaro LKFT
> > https://lkft.linaro.org
> >
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-10-21 13:35 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-21 12:01 BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown Naresh Kamboju
2021-10-21 12:17 ` John Garry
2021-10-21 13:35 ` Anders Roxell
2021-10-21 12:20 ` Arnd Bergmann
2021-10-21 13:20 ` John Garry
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).