KASAN: use-after-free Write in page_counter_cancel

KASAN: use-after-free Write in page_counter_cancel

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    4993e4fe Add linux-next specific files for 20200814
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10d0d116900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2055bd0d83d5ee16
dashboard link: https://syzkaller.appspot.com/bug?extid=b5ea6fb6f139c8b9482b
compiler:       gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b5ea6fb6f139c8b9482b@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic64_sub_return include/asm-generic/atomic-instrumented.h:970 [inline]
BUG: KASAN: use-after-free in atomic_long_sub_return include/asm-generic/atomic-long.h:113 [inline]
BUG: KASAN: use-after-free in page_counter_cancel+0x1c/0x70 mm/page_counter.c:54
Write of size 8 at addr ffff88804ad14148 by task syz-executor.5/2783

CPU: 1 PID: 2783 Comm: syz-executor.5 Not tainted 5.8.0-next-20200814-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 check_memory_region_inline mm/kasan/generic.c:186 [inline]
 check_memory_region+0x13d/0x180 mm/kasan/generic.c:192
 instrument_atomic_write include/linux/instrumented.h:71 [inline]
 atomic64_sub_return include/asm-generic/atomic-instrumented.h:970 [inline]
 atomic_long_sub_return include/asm-generic/atomic-long.h:113 [inline]
 page_counter_cancel+0x1c/0x70 mm/page_counter.c:54
 page_counter_uncharge+0x2e/0x60 mm/page_counter.c:156
 uncharge_batch+0x67/0x450 mm/memcontrol.c:6764
 uncharge_page+0xfd/0x560 mm/memcontrol.c:6796
 uncharge_list mm/memcontrol.c:6835 [inline]
 mem_cgroup_uncharge_list+0xf6/0x180 mm/memcontrol.c:6877
 release_pages+0x637/0x17a0 mm/swap.c:912
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:242 [inline]
 tlb_flush_mmu mm/mmu_gather.c:249 [inline]
 tlb_finish_mmu+0x165/0x8c0 mm/mmu_gather.c:328
 exit_mmap+0x2d1/0x530 mm/mmap.c:3200
 __mmput+0x122/0x470 kernel/fork.c:1075
 mmput+0x53/0x60 kernel/fork.c:1096
 exit_mm kernel/exit.c:483 [inline]
 do_exit+0xa8b/0x29f0 kernel/exit.c:793
 do_group_exit+0x125/0x310 kernel/exit.c:903
 __do_sys_exit_group kernel/exit.c:914 [inline]
 __se_sys_exit_group kernel/exit.c:912 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d239
Code: Bad RIP value.
RSP: 002b:00007ffdf9f90358 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000001e RCX: 000000000045d239
RDX: 0000000000416b81 RSI: fffffffffffffff7 RDI: 0000000000000000
RBP: 0000000000000000 R08: 00000000c426f42b R09: 00007ffdf9f903b0
R10: 00000000c426f427 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdf9f903b0 R14: 0000000000000000 R15: 00007ffdf9f903c0

Allocated by task 2685:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 __do_kmalloc mm/slab.c:3655 [inline]
 __kmalloc+0x1a8/0x320 mm/slab.c:3664
 kmalloc include/linux/slab.h:559 [inline]
 kzalloc include/linux/slab.h:666 [inline]
 mem_cgroup_alloc mm/memcontrol.c:5210 [inline]
 mem_cgroup_css_alloc+0xc1/0x1bd0 mm/memcontrol.c:5278
 css_create kernel/cgroup/cgroup.c:5128 [inline]
 cgroup_apply_control_enable+0x478/0xc00 kernel/cgroup/cgroup.c:3059
 cgroup_apply_control kernel/cgroup/cgroup.c:3141 [inline]
 cgroup_subtree_control_write+0x7fc/0xcc0 kernel/cgroup/cgroup.c:3299
 cgroup_file_write+0x211/0x750 kernel/cgroup/cgroup.c:3697
 kernfs_fop_write+0x268/0x490 fs/kernfs/file.c:315
 vfs_write+0x2b0/0x730 fs/read_write.c:576
 ksys_write+0x12d/0x250 fs/read_write.c:631
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 20465:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422
 __cache_free mm/slab.c:3418 [inline]
 kfree+0x103/0x2c0 mm/slab.c:3756
 css_free_rwork_fn+0xf2/0x10c0 kernel/cgroup/cgroup.c:4941
 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Last call_rcu():
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346
 __call_rcu kernel/rcu/tree.c:2894 [inline]
 call_rcu+0x14f/0x7e0 kernel/rcu/tree.c:2968
 queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1747
 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Second to last call_rcu():
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346
 __call_rcu kernel/rcu/tree.c:2894 [inline]
 call_rcu+0x14f/0x7e0 kernel/rcu/tree.c:2968
 __percpu_ref_switch_to_atomic lib/percpu-refcount.c:192 [inline]
 __percpu_ref_switch_mode+0x365/0x700 lib/percpu-refcount.c:237
 percpu_ref_kill_and_confirm+0x94/0x350 lib/percpu-refcount.c:350
 kill_css+0x115/0x340 kernel/cgroup/cgroup.c:5451
 cgroup_apply_control_disable+0x3d8/0x500 kernel/cgroup/cgroup.c:3108
 cgroup_finalize_control kernel/cgroup/cgroup.c:3171 [inline]
 cgroup_subtree_control_write+0x83e/0xcc0 kernel/cgroup/cgroup.c:3300
 cgroup_file_write+0x211/0x750 kernel/cgroup/cgroup.c:3697
 kernfs_fop_write+0x268/0x490 fs/kernfs/file.c:315
 vfs_write+0x2b0/0x730 fs/read_write.c:576
 ksys_write+0x12d/0x250 fs/read_write.c:631
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88804ad14000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 328 bytes inside of
 4096-byte region [ffff88804ad14000, ffff88804ad15000)
The buggy address belongs to the page:
page:000000002f31f80d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ad14
head:000000002f31f80d order:1 compound_mapcount:0
flags: 0xfffe0000010200(slab|head)
raw: 00fffe0000010200 ffffea0001274388 ffffea00023b4188 ffff8880aa040900
raw: 0000000000000000 ffff88804ad14000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88804ad14000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804ad14080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804ad14100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88804ad14180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804ad14200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.