* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230119081633.3470-1-hdanton@sina.com>
@ 2023-02-01 16:41 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-02-01 16:41 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_fallback_req_func
==================================================================
BUG: KASAN: use-after-free in io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:253
Read of size 8 at addr ffff8880271e8948 by task kworker/0:5/5578
CPU: 0 PID: 5578 Comm: kworker/0:5 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events io_fallback_req_func
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:253
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2420
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 2822:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x203/0x248 io_uring/io_uring.c:2750
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2980
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff8880271e88c0
which belongs to the cache io_kiocb of size 232
The buggy address is located 136 bytes inside of
232-byte region [ffff8880271e88c0, ffff8880271e89a8)
The buggy address belongs to the physical page:
page:ffffea00009c7a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x271e8
memcg:ffff888017b98f01
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff888146255140 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888017b98f01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 91755579199, free_ts 91135623998
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2420
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff8880271e8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff8880271e8880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff8880271e8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880271e8980: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff8880271e8a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11ffb3b3480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=15114c2e480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230201233318.593-1-hdanton@sina.com>
@ 2023-02-02 5:24 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-02-02 5:24 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+e29d28728f38190cecfc@syzkaller.appspotmail.com
Tested on:
commit: 9f266cca Merge tag 'for_linus' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1288afb3480000
kernel config: https://syzkaller.appspot.com/x/.config?x=94f93727847d4d81
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230119030102.3388-1-hdanton@sina.com>
@ 2023-01-19 3:18 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-19 3:18 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_req_caches_free
==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:357 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x1a2/0x254 io_uring/io_uring.c:2748
Read of size 8 at addr ffff88801c8dc938 by task kworker/u4:2/41
CPU: 1 PID: 41 Comm: kworker/u4:2 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:357 [inline]
io_req_caches_free+0x1a2/0x254 io_uring/io_uring.c:2748
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2980
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5602:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1066
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2419
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 41:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x20f/0x254 io_uring/io_uring.c:2750
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2980
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff88801c8dc8c0
which belongs to the cache io_kiocb of size 232
The buggy address is located 120 bytes inside of
232-byte region [ffff88801c8dc8c0, ffff88801c8dc9a8)
The buggy address belongs to the physical page:
page:ffffea0000723700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c8dc
memcg:ffff888021840981
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801bf2ba00 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888021840981
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5602, tgid 5601 (syz-executor.0), ts 88366341970, free_ts 87676511455
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1066
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2419
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exec_mmap fs/exec.c:1034 [inline]
begin_new_exec+0x1027/0x2f80 fs/exec.c:1293
load_elf_binary+0x801/0x4ff0 fs/binfmt_elf.c:1001
search_binary_handler fs/exec.c:1736 [inline]
exec_binprm fs/exec.c:1778 [inline]
bprm_execve fs/exec.c:1853 [inline]
bprm_execve+0x7fd/0x1ae0 fs/exec.c:1809
do_execveat_common+0x72c/0x880 fs/exec.c:1960
do_execve fs/exec.c:2034 [inline]
__do_sys_execve fs/exec.c:2110 [inline]
__se_sys_execve fs/exec.c:2105 [inline]
__x64_sys_execve+0x93/0xc0 fs/exec.c:2105
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88801c8dc800: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
ffff88801c8dc880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88801c8dc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801c8dc980: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff88801c8dca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=110560fa480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1259a9b1480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230119012145.3304-1-hdanton@sina.com>
@ 2023-01-19 2:01 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-19 2:01 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_req_caches_free
==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2744
Read of size 8 at addr ffff88802990f938 by task kworker/u4:0/9
CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]
io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2744
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2976
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5595:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3438
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1b5/0x1f2 io_uring/io_uring.c:2746
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2976
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff88802990f8c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 120 bytes inside of
224-byte region [ffff88802990f8c0, ffff88802990f9a0)
The buggy address belongs to the physical page:
page:ffffea0000a643c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2990f
memcg:ffff888021c15d01
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801c3adc80 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888021c15d01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5595, tgid 5594 (syz-executor.0), ts 89945650593, free_ts 79190938979
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3438
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__folio_put_small mm/swap.c:106 [inline]
__folio_put+0xc5/0x140 mm/swap.c:129
folio_put include/linux/mm.h:1203 [inline]
put_page include/linux/mm.h:1272 [inline]
anon_pipe_buf_release+0x3fb/0x4c0 fs/pipe.c:138
pipe_buf_release include/linux/pipe_fs_i.h:183 [inline]
pipe_read+0x614/0x1110 fs/pipe.c:324
call_read_iter include/linux/fs.h:1846 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x7fa/0x930 fs/read_write.c:470
ksys_read+0x1ec/0x250 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88802990f800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88802990f880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88802990f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802990f980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802990fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11ac82b6480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=136278a9480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230118222858.3127-1-hdanton@sina.com>
@ 2023-01-19 1:13 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-19 1:13 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_fallback_req_func
==================================================================
BUG: KASAN: use-after-free in io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:251
Read of size 8 at addr ffff888070652948 by task kworker/0:4/5090
CPU: 0 PID: 5090 Comm: kworker/0:4 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events io_fallback_req_func
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:251
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2414
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2744
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2974
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff8880706528c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of
224-byte region [ffff8880706528c0, ffff8880706529a0)
The buggy address belongs to the physical page:
page:ffffea0001c19480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70652
memcg:ffff888026aa6301
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff888146499780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888026aa6301
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 88591275349, free_ts 64543666654
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2414
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
__free_pages_ok+0x6ac/0xdc0 mm/page_alloc.c:1707
kvfree+0x46/0x50 mm/util.c:649
wg_destruct+0x2f4/0x400 drivers/net/wireguard/device.c:265
netdev_run_todo+0x6bf/0x1100 net/core/dev.c:10352
default_device_exit_batch+0x456/0x590 net/core/dev.c:11349
ops_exit_list+0x125/0x170 net/core/net_namespace.c:174
cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:606
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
Memory state around the buggy address:
ffff888070652800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888070652880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888070652900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888070652980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888070652a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=151c52a9480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=14f99661480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230118150448.3071-1-hdanton@sina.com>
@ 2023-01-18 15:27 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-18 15:27 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_req_caches_free
==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2745
Read of size 8 at addr ffff8880711c7938 by task kworker/u4:5/1184
CPU: 1 PID: 1184 Comm: kworker/u4:5 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]
io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2745
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2977
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5597:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 1184:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2747
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2977
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff8880711c78c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 120 bytes inside of
224-byte region [ffff8880711c78c0, ffff8880711c79a0)
The buggy address belongs to the physical page:
page:ffffea0001c471c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x711c7
memcg:ffff88802b0a9f01
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801c3f03c0 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88802b0a9f01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5597, tgid 5596 (syz-executor.0), ts 92319099413, free_ts 80415300921
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__folio_put_small mm/swap.c:106 [inline]
__folio_put+0xc5/0x140 mm/swap.c:129
folio_put include/linux/mm.h:1203 [inline]
put_page include/linux/mm.h:1272 [inline]
anon_pipe_buf_release+0x3fb/0x4c0 fs/pipe.c:138
pipe_buf_release include/linux/pipe_fs_i.h:183 [inline]
pipe_read+0x614/0x1110 fs/pipe.c:324
call_read_iter include/linux/fs.h:1846 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x7fa/0x930 fs/read_write.c:470
ksys_read+0x1ec/0x250 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff8880711c7800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff8880711c7880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff8880711c7900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880711c7980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880711c7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11b06c96480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1056f519480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230118094915.2906-1-hdanton@sina.com>
@ 2023-01-18 14:07 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-18 14:07 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in io_ring_exit_work
------------[ cut here ]------------
WARNING: CPU: 0 PID: 11 at io_uring/io_uring.c:2977 io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Modules linked in:
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
RIP: 0010:io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Code: 40 8c e8 57 f4 02 f8 48 8b 05 f0 59 74 02 31 ff 4c 8b 74 24 10 49 29 c6 4c 89 f6 e8 8e 21 b5 f7 4d 85 f6 79 10 e8 b4 24 b5 f7 <0f> 0b 48 c7 44 24 08 70 17 00 00 e8 a4 24 b5 f7 48 8b 74 24 08 48
RSP: 0018:ffffc90000107bd0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807969a838 RCX: 0000000000000000
RDX: ffff88813fe4ba80 RSI: ffffffff89cc982c RDI: 0000000000000007
RBP: ffff88807969a000 R08: 0000000000000007 R09: 0000000000000000
R10: fffffffffffffffe R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88807969a040 R14: fffffffffffffffe R15: ffff88807969a3c8
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555568ee708 CR3: 0000000029c9e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=118c8241480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=15607d19480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230118055330.2780-1-hdanton@sina.com>
@ 2023-01-18 7:06 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-18 7:06 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in io_ring_exit_work
------------[ cut here ]------------
WARNING: CPU: 1 PID: 75 at io_uring/io_uring.c:2977 io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Modules linked in:
CPU: 0 PID: 75 Comm: kworker/u4:4 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
RIP: 0010:io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Code: 40 8c e8 57 f4 02 f8 48 8b 05 f0 59 74 02 31 ff 4c 8b 74 24 10 49 29 c6 4c 89 f6 e8 8e 21 b5 f7 4d 85 f6 79 10 e8 b4 24 b5 f7 <0f> 0b 48 c7 44 24 08 70 17 00 00 e8 a4 24 b5 f7 48 8b 74 24 08 48
RSP: 0018:ffffc900020afbd0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807e004838 RCX: 0000000000000000
RDX: ffff888018ca57c0 RSI: ffffffff89cc982c RDI: 0000000000000007
RBP: ffff88807e004000 R08: 0000000000000007 R09: 0000000000000000
R10: fffffffffffffff9 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88807e004040 R14: fffffffffffffff9 R15: ffff88807e0043c8
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a8f42b70c0 CR3: 000000000c571000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=111bfc46480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=111aca96480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230118023942.2716-1-hdanton@sina.com>
@ 2023-01-18 2:59 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-18 2:59 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in tctx_task_work
==================================================================
BUG: KASAN: use-after-free in io_fallback_tw io_uring/io_uring.c:1252 [inline]
BUG: KASAN: use-after-free in tctx_task_work.cold+0x10a/0x11d io_uring/io_uring.c:1222
Read of size 8 at addr ffff888024f00948 by task syz-executor.0/5598
CPU: 1 PID: 5598 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_fallback_tw io_uring/io_uring.c:1252 [inline]
tctx_task_work.cold+0x10a/0x11d io_uring/io_uring.c:1222
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff84e88c0c9
Code: Unable to access opcode bytes at 0x7ff84e88c09f.
RSP: 002b:00007ff84f57d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007ff84e9abf80 RCX: 00007ff84e88c0c9
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 00007ff84e8e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd739e0c8f R14: 00007ff84f57d300 R15: 0000000000022000
</TASK>
Allocated by task 5598:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2409
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3433
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2741
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2971
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff888024f008c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of
224-byte region [ffff888024f008c0, ffff888024f009a0)
The buggy address belongs to the physical page:
page:ffffea000093c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24f00
memcg:ffff88801264c781
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88814614c640 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88801264c781
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5598, tgid 5597 (syz-executor.0), ts 86881423641, free_ts 86232019510
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2409
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3433
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888024f00800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888024f00880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888024f00900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888024f00980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888024f00a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11d23496480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=11b23c41480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230117093837.2433-1-hdanton@sina.com>
@ 2023-01-17 17:54 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-17 17:54 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_fallback_tw
==================================================================
BUG: KASAN: use-after-free in io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1252
Read of size 8 at addr ffff888070672948 by task syz-executor.0/5596
CPU: 0 PID: 5596 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1252
tctx_task_work.cold+0xf/0x2c io_uring/io_uring.c:1222
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fee6588c0c9
Code: Unable to access opcode bytes at 0x7fee6588c09f.
RSP: 002b:00007fee66584168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007fee659abf80 RCX: 00007fee6588c0c9
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 00007fee658e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff6c752b9f R14: 00007fee66584300 R15: 0000000000022000
</TASK>
Allocated by task 5596:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 2864:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2747
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2977
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff8880706728c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of
224-byte region [ffff8880706728c0, ffff8880706729a0)
The buggy address belongs to the physical page:
page:ffffea0001c19c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70672
memcg:ffff888029e25881
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801bf30780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888029e25881
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5596, tgid 5595 (syz-executor.0), ts 114425164040, free_ts 101753733828
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x17c/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc+0x4a/0xd0 mm/slab_common.c:980
kmalloc include/linux/slab.h:584 [inline]
tomoyo_realpath_from_path+0xc3/0x600 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x217/0x570 security/tomoyo/file.c:723
security_file_ioctl+0x54/0xb0 security/security.c:1624
__do_sys_ioctl fs/ioctl.c:864 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0xb7/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888070672800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888070672880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888070672900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888070672980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888070672a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1189dc39480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1004dc7e480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230117015907.2238-1-hdanton@sina.com>
@ 2023-01-17 2:39 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-17 2:39 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_req_caches_free
==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2743
Read of size 8 at addr ffff88802848f938 by task kworker/u4:2/29
CPU: 0 PID: 29 Comm: kworker/u4:2 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: events_unbound io_ring_exit_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]
io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2743
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2975
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3437
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 29:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2745
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2975
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff88802848f8c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 120 bytes inside of
224-byte region [ffff88802848f8c0, ffff88802848f9a0)
The buggy address belongs to the physical page:
page:ffffea0000a123c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2848f
memcg:ffff888028e66b81
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801bcba780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888028e66b81
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 86682323238, free_ts 86643623166
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3437
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x17c/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc_node+0x4d/0xd0 mm/slab_common.c:974
kmalloc_node include/linux/slab.h:610 [inline]
kvmalloc_node+0xa2/0x1a0 mm/util.c:603
kvmalloc include/linux/slab.h:737 [inline]
seq_buf_alloc fs/seq_file.c:38 [inline]
seq_read_iter+0x7fb/0x1280 fs/seq_file.c:210
kernfs_fop_read_iter+0x4ce/0x690 fs/kernfs/file.c:279
call_read_iter include/linux/fs.h:1846 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x681/0x930 fs/read_write.c:470
ksys_read+0x12b/0x250 fs/read_write.c:613
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88802848f800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88802848f880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88802848f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802848f980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802848fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17950e0e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=15cf6919480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230116053340.1952-1-hdanton@sina.com>
@ 2023-01-16 12:44 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-16 12:44 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_poll_remove_all_table
==================================================================
BUG: KASAN: use-after-free in io_poll_remove_all_table+0x161/0x2bd io_uring/poll.c:740
Read of size 8 at addr ffff888070848958 by task syz-executor.0/5603
CPU: 0 PID: 5603 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_poll_remove_all_table+0x161/0x2bd io_uring/poll.c:740
io_poll_remove_all+0x2e/0x4b io_uring/poll.c:761
io_ring_ctx_wait_and_kill+0x1a0/0x340 io_uring/io_uring.c:3024
io_uring_release+0x46/0x4a io_uring/io_uring.c:3049
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7efcf9a8c0c9
Code: Unable to access opcode bytes at 0x7efcf9a8c09f.
RSP: 002b:00007efcfa823168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007efcf9babf80 RCX: 00007efcf9a8c0c9
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 00007efcf9ae7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdae1fefdf R14: 00007efcfa823300 R15: 0000000000022000
</TASK>
Allocated by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_free_batch_list+0xdc/0x7d0 io_uring/io_uring.c:1466
__io_submit_flush_completions+0x4ea/0x940 io_uring/io_uring.c:1501
io_submit_flush_completions io_uring/io_uring.c:173 [inline]
ctx_flush_and_put+0x13c/0x210 io_uring/io_uring.c:1145
tctx_task_work+0x1af/0x530 io_uring/io_uring.c:1236
task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff8880708488c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 152 bytes inside of
224-byte region [ffff8880708488c0, ffff8880708489a0)
The buggy address belongs to the physical page:
page:ffffea0001c21200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70848
memcg:ffff888017e79781
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8881463e0500 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888017e79781
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 91825186400, free_ts 91803934935
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888070848800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff888070848880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888070848900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888070848980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888070848a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15640391480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=175567ba480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230116012417.1876-1-hdanton@sina.com>
@ 2023-01-16 1:55 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-16 1:55 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_req_caches_free
==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2750
Read of size 8 at addr ffff88801da98938 by task kworker/u4:3/46
CPU: 1 PID: 46 Comm: kworker/u4:3 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: events_unbound io_ring_exit_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]
io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2750
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2982
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5596:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3444
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 46:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1b5/0x1f2 io_uring/io_uring.c:2752
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2982
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff88801da988c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 120 bytes inside of
224-byte region [ffff88801da988c0, ffff88801da989a0)
The buggy address belongs to the physical page:
page:ffffea000076a600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1da98
memcg:ffff88801cfa1401
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801bf2a280 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff88801cfa1401
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5596, tgid 5595 (syz-executor.0), ts 93592785724, free_ts 93586502326
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3444
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2637
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc_lru+0x20e/0x580 mm/slub.c:3483
alloc_inode_sb include/linux/fs.h:2692 [inline]
sock_alloc_inode+0x27/0x1d0 net/socket.c:304
alloc_inode+0x61/0x230 fs/inode.c:260
new_inode_pseudo+0x17/0x80 fs/inode.c:1019
sock_alloc+0x40/0x270 net/socket.c:627
__sock_create+0xbd/0x810 net/socket.c:1479
io_uring_get_file io_uring/io_uring.c:3604 [inline]
io_uring_create io_uring/io_uring.c:3785 [inline]
io_uring_setup.cold+0x1913/0x1d97 io_uring/io_uring.c:3835
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88801da98800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88801da98880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88801da98900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801da98980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801da98a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1073daa6480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=17832c5e480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230116000718.1809-1-hdanton@sina.com>
@ 2023-01-16 0:34 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-16 0:34 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: ODEBUG bug in __io_put_task
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
------------[ cut here ]------------
ODEBUG: free active (active state 1) object: ffff88802a236ca8 object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 899 at lib/debugobjects.c:509 debug_print_object+0x194/0x2c0 lib/debugobjects.c:509
Modules linked in:
CPU: 0 PID: 899 Comm: kworker/0:2 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: events io_fallback_req_func
RIP: 0010:debug_print_object+0x194/0x2c0 lib/debugobjects.c:509
Code: df 48 89 fe 48 c1 ee 03 80 3c 16 00 0f 85 c7 00 00 00 48 8b 14 dd c0 dc a6 8a 50 4c 89 ee 48 c7 c7 80 d0 a6 8a e8 40 76 ae 05 <0f> 0b 58 83 05 0e 25 66 0a 01 48 83 c4 20 5b 5d 41 5c 41 5d 41 5e
RSP: 0018:ffffc90004aef950 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff88801eba3a80 RSI: ffffffff8166972c RDI: fffff5200095df1c
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8a4dd0a0
R13: ffffffff8aa6d580 R14: ffff888070a92da8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005639964dc950 CR3: 000000007dcca000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__debug_check_no_obj_freed lib/debugobjects.c:996 [inline]
debug_check_no_obj_freed+0x305/0x420 lib/debugobjects.c:1027
slab_free_hook mm/slub.c:1756 [inline]
slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
put_task_struct_many include/linux/sched/task.h:125 [inline]
__io_put_task+0x155/0x1e0 io_uring/io_uring.c:729
io_put_task io_uring/io_uring.h:328 [inline]
__io_req_complete_post+0x7ec/0xd20 io_uring/io_uring.c:982
io_req_complete_post+0xf1/0x1a0 io_uring/io_uring.c:998
io_req_task_complete+0x189/0x260 io_uring/io_uring.c:1636
io_poll_task_func+0xa95/0x1220 io_uring/poll.c:347
io_fallback_req_func+0xfd/0x204 io_uring/io_uring.c:252
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17a99c7a480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1145447e480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230115232650.1752-1-hdanton@sina.com>
@ 2023-01-15 23:43 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-15 23:43 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_fallback_req_func
==================================================================
BUG: KASAN: use-after-free in io_fallback_req_func+0xce/0x2fd io_uring/io_uring.c:251
Read of size 8 at addr ffff88807ed29948 by task kworker/1:4/5593
CPU: 1 PID: 5593 Comm: kworker/1:4 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: events io_fallback_req_func
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_fallback_req_func+0xce/0x2fd io_uring/io_uring.c:251
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
process_scheduled_works kernel/workqueue.c:2356 [inline]
worker_thread+0x807/0x1090 kernel/workqueue.c:2445
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Allocated by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 1170:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2751
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2981
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff88807ed298c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of
224-byte region [ffff88807ed298c0, ffff88807ed299a0)
The buggy address belongs to the physical page:
page:ffffea0001fb4a40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ed29
memcg:ffff8880290cd081
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8881462e6280 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff8880290cd081
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 89380836523, free_ts 88705663139
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88807ed29800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88807ed29880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88807ed29900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807ed29980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807ed29a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=172d8f86480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16fabd5e480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230115220938.1677-1-hdanton@sina.com>
@ 2023-01-15 22:31 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-15 22:31 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in dummy_pcm_prepare
==================================================================
BUG: KASAN: use-after-free in dummy_pcm_prepare+0xae/0xc0 sound/drivers/dummy.c:504
Read of size 8 at addr ffff888077855200 by task syz-executor.0/5606
CPU: 1 PID: 5606 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
dummy_pcm_prepare+0xae/0xc0 sound/drivers/dummy.c:504
snd_pcm_do_prepare+0x6a/0xb0 sound/core/pcm_native.c:1959
snd_pcm_action_single+0x75/0x130 sound/core/pcm_native.c:1281
snd_pcm_action_nonatomic+0x12b/0x160 sound/core/pcm_native.c:1400
snd_pcm_kernel_ioctl+0x264/0x2e0 sound/core/pcm_native.c:3450
snd_pcm_oss_prepare+0x44/0x220 sound/core/oss/pcm_oss.c:1154
snd_pcm_oss_make_ready+0x161/0x1b0 sound/core/oss/pcm_oss.c:1182
snd_pcm_oss_set_trigger.isra.0+0x30f/0x6e0 sound/core/oss/pcm_oss.c:2092
snd_pcm_oss_poll+0x613/0xab0 sound/core/oss/pcm_oss.c:2878
vfs_poll include/linux/poll.h:88 [inline]
io_poll_check_events io_uring/poll.c:279 [inline]
io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327
handle_tw_list+0x253/0x540 io_uring/io_uring.c:1177
tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1235
task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7faa7168c0c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa72462168 EFLAGS: 00000246
ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007faa717abf80 RCX: 00007faa7168c0c9
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 00007faa716e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd3b035a6f R14: 00007faa72462300 R15: 0000000000022000
</TASK>
Allocated by task 5606:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
dummy_hrtimer_create+0x45/0x190 sound/drivers/dummy.c:456
dummy_pcm_open+0xd4/0x5a0 sound/drivers/dummy.c:556
snd_pcm_open_substream+0xa92/0x1820 sound/core/pcm_native.c:2748
snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2454 [inline]
snd_pcm_oss_open.part.0+0x6dc/0x1330 sound/core/oss/pcm_oss.c:2535
snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499
soundcore_open+0x452/0x620 sound/sound_core.c:593
chrdev_open+0x26a/0x770 fs/char_dev.c:414
do_dentry_open+0x6cc/0x13f0 fs/open.c:883
do_open fs/namei.c:3558 [inline]
path_openat+0x1bc1/0x2b40 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x16d/0x4c0 fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_sys_openat fs/open.c:1343 [inline]
__se_sys_openat fs/open.c:1338 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1338
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 5605:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800
dummy_pcm_close+0x93/0xc0 sound/drivers/dummy.c:589
snd_pcm_release_substream.part.0+0x10e/0x330 sound/core/pcm_native.c:2714
snd_pcm_release_substream+0x5b/0x70 sound/core/pcm_native.c:2707
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2413 [inline]
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline]
snd_pcm_oss_release+0x175/0x300 sound/core/oss/pcm_oss.c:2592
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff888077855200
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
128-byte region [ffff888077855200, ffff888077855280)
The buggy address belongs to the physical page:
page:ffffea0001de1540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77855
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8880124418c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5553, tgid 5553 (syz-executor.0), ts 119232426868, free_ts 118550967401
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_slab_page mm/slub.c:1853 [inline]
allocate_slab+0xa7/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
__kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc_node+0x4d/0xd0 mm/slab_common.c:974
kmalloc_array_node include/linux/slab.h:697 [inline]
kcalloc_node include/linux/slab.h:702 [inline]
memcg_alloc_slab_cgroups+0x8f/0x150 mm/memcontrol.c:2899
memcg_slab_post_alloc_hook+0xa9/0x390 mm/slab.h:546
slab_post_alloc_hook mm/slab.h:777 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc+0x1a7/0x320 mm/slub.c:3476
copy_sighand kernel/fork.c:1668 [inline]
copy_process+0x26c4/0x7740 kernel/fork.c:2266
kernel_clone+0xeb/0x9a0 kernel/fork.c:2687
__do_sys_clone+0xba/0x100 kernel/fork.c:2828
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888077855100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
ffff888077855180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888077855200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888077855280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888077855300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=137d2c5e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=14260046480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230115122106.1614-1-hdanton@sina.com>
@ 2023-01-15 16:04 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-15 16:04 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in __io_req_task_work_add
------------[ cut here ]------------
WARNING: CPU: 1 PID: 0 at io_uring/refs.h:31 req_ref_get io_uring/refs.h:31 [inline]
WARNING: CPU: 1 PID: 0 at io_uring/refs.h:31 __io_req_task_work_add+0x763/0x850 io_uring/io_uring.c:1310
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:req_ref_get io_uring/refs.h:31 [inline]
RIP: 0010:__io_req_task_work_add+0x763/0x850 io_uring/io_uring.c:1310
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 e6 00 00 00 49 8b 7c 24 18 be 01 00 00 00 e8 e7 28 57 fd e9 00 fe ff ff e8 cd 73 80 fd <0f> 0b e9 fd f9 ff ff e8 c1 73 80 fd 0f 0b e9 56 fa ff ff e8 b5 73
RSP: 0018:ffffc900001e0a48 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880711ba8c0 RCX: 0000000000000100
RDX: ffff88813feb9d40 RSI: ffffffff84014913 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: ffff88807e836000
R13: ffff8880711ba920 R14: ffff88801cfd4c00 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f00038cf5a8 CR3: 0000000027f59000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
io_req_task_work_add io_uring/io_uring.h:95 [inline]
__io_poll_execute io_uring/poll.c:366 [inline]
io_poll_wake+0x243/0x600 io_uring/poll.c:441
__wake_up_common+0x147/0x650 kernel/sched/wait.c:107
__wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138
snd_pcm_update_state+0x445/0x510 sound/core/pcm_lib.c:204
snd_pcm_update_hw_ptr0+0xada/0x1af0 sound/core/pcm_lib.c:465
snd_pcm_period_elapsed_under_stream_lock+0x156/0x220 sound/core/pcm_lib.c:1817
snd_pcm_period_elapsed+0x2c/0x50 sound/core/pcm_lib.c:1849
dummy_hrtimer_callback+0x98/0x1b0 sound/drivers/dummy.c:385
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x600/0xcf0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x17f/0x360 kernel/time/hrtimer.c:1766
__do_softirq+0x1fb/0xaf6 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x1fd/0x2a0 drivers/acpi/processor_idle.c:570
Code: 89 de e8 36 39 7b f7 84 db 75 ac e8 bd 3c 7b f7 e8 38 bd 81 f7 66 90 e8 b1 3c 7b f7 0f 00 2d 2a 44 ab 00 e8 a5 3c 7b f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 60 39 7b f7 48 85 db
RSP: 0018:ffffc90000177d10 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88813feb9d40 RSI: ffffffff8a06803b RDI: 0000000000000000
RBP: ffff888012684864 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888012684800 R14: ffff888012684864 R15: ffff88801c228004
acpi_idle_enter+0x368/0x510 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x1af/0xd40 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3f7/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:400
start_secondary+0x256/0x300 arch/x86/kernel/smpboot.c:264
secondary_startup_64_no_verify+0xce/0xdb
</TASK>
----------------
Code disassembly (best guess):
0: 89 de mov %ebx,%esi
2: e8 36 39 7b f7 callq 0xf77b393d
7: 84 db test %bl,%bl
9: 75 ac jne 0xffffffb7
b: e8 bd 3c 7b f7 callq 0xf77b3ccd
10: e8 38 bd 81 f7 callq 0xf781bd4d
15: 66 90 xchg %ax,%ax
17: e8 b1 3c 7b f7 callq 0xf77b3ccd
1c: 0f 00 2d 2a 44 ab 00 verw 0xab442a(%rip) # 0xab444d
23: e8 a5 3c 7b f7 callq 0xf77b3ccd
28: fb sti
29: f4 hlt
* 2a: 9c pushfq <-- trapping instruction
2b: 5b pop %rbx
2c: 81 e3 00 02 00 00 and $0x200,%ebx
32: fa cli
33: 31 ff xor %edi,%edi
35: 48 89 de mov %rbx,%rsi
38: e8 60 39 7b f7 callq 0xf77b399d
3d: 48 85 db test %rbx,%rbx
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17d091ee480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1100ada1480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230115074631.1541-1-hdanton@sina.com>
@ 2023-01-15 8:06 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-15 8:06 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_fallback_tw
==================================================================
BUG: KASAN: use-after-free in io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1253
Read of size 8 at addr ffff888029b7c948 by task syz-executor.0/5601
CPU: 1 PID: 5601 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1253
tctx_task_work.cold+0xf/0x2c io_uring/io_uring.c:1223
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f9fa6c8c0c9
Code: Unable to access opcode bytes at 0x7f9fa6c8c09f.
RSP: 002b:00007f9fa7a98168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007f9fa6dabf80 RCX: 00007f9fa6c8c0c9
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 00007f9fa6ce7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdca0565bf R14: 00007f9fa7a98300 R15: 0000000000022000
</TASK>
Allocated by task 5601:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1064
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2412
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3434
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 33:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2742
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2972
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff888029b7c8c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of
224-byte region [ffff888029b7c8c0, ffff888029b7c9a0)
The buggy address belongs to the physical page:
page:ffffea0000a6df00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29b7c
memcg:ffff88801de69981
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff888146395500 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88801de69981
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5601, tgid 5600 (syz-executor.0), ts 79202512513, free_ts 51400073995
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1064
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2412
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3434
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__vunmap+0x7fe/0xc00 mm/vmalloc.c:2746
__vfree+0x3c/0xd0 mm/vmalloc.c:2794
vfree+0x5e/0x90 mm/vmalloc.c:2825
kcov_put kernel/kcov.c:428 [inline]
kcov_put+0x26/0x40 kernel/kcov.c:424
kcov_close+0x10/0x20 kernel/kcov.c:524
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
Memory state around the buggy address:
ffff888029b7c800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888029b7c880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888029b7c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888029b7c980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888029b7ca00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14412b16480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=15c09ea6480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
[not found] <20230113113404.879-1-hdanton@sina.com>
@ 2023-01-13 11:59 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-13 11:59 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in snd_pcm_oss_poll
==================================================================
BUG: KASAN: use-after-free in snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849
Read of size 8 at addr ffff888017b9dda0 by task syz-executor.0/5602
CPU: 0 PID: 5602 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849
vfs_poll include/linux/poll.h:88 [inline]
io_poll_check_events io_uring/poll.c:279 [inline]
io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327
handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169
tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224
task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5fc228c0c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5fc2f2e168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007f5fc23abf80 RCX: 00007f5fc228c0c9
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 00007f5fc22e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff0b78073f R14: 00007f5fc2f2e300 R15: 0000000000022000
</TASK>
Allocated by task 5602:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2433 [inline]
snd_pcm_oss_open.part.0+0x558/0x1330 sound/core/oss/pcm_oss.c:2535
snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499
soundcore_open+0x452/0x620 sound/sound_core.c:593
chrdev_open+0x26a/0x770 fs/char_dev.c:414
do_dentry_open+0x6cc/0x13f0 fs/open.c:883
do_open fs/namei.c:3558 [inline]
path_openat+0x1bc1/0x2b40 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x16d/0x4c0 fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_sys_openat fs/open.c:1343 [inline]
__se_sys_openat fs/open.c:1338 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1338
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 5601:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2415 [inline]
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline]
snd_pcm_oss_release+0x182/0x300 sound/core/oss/pcm_oss.c:2592
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff888017b9dda0
which belongs to the cache kmalloc-16 of size 16
The buggy address is located 0 bytes inside of
16-byte region [ffff888017b9dda0, ffff888017b9ddb0)
The buggy address belongs to the physical page:
page:ffffea00005ee740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888017b9dd60 pfn:0x17b9d
anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8880124413c0 0000000000000000 dead000000000001
raw: ffff888017b9dd60 0000000080800076 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2868545565, free_ts 0
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2114
alloc_pages+0x233/0x270 mm/mempolicy.c:2276
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
__kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc+0x4a/0xd0 mm/slab_common.c:980
acpi_ns_get_normalized_pathname+0x4d/0x9f drivers/acpi/acpica/nsnames.c:306
acpi_ex_start_trace_method+0x2e/0x343 drivers/acpi/acpica/extrace.c:176
acpi_ds_begin_method_execution+0x46/0x7c3 drivers/acpi/acpica/dsmethod.c:304
acpi_ps_execute_method+0x94/0x620 drivers/acpi/acpica/psxface.c:105
acpi_ns_evaluate+0x6d4/0x973 drivers/acpi/acpica/nseval.c:205
acpi_ut_evaluate_object+0xf5/0x3fa drivers/acpi/acpica/uteval.c:60
acpi_ut_execute_STA+0x86/0x17f drivers/acpi/acpica/uteval.c:223
page_owner free stack trace missing
Memory state around the buggy address:
ffff888017b9dc80: fb fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc
ffff888017b9dd00: 00 00 fc fc 00 05 fc fc 00 00 fc fc fb fb fc fc
>ffff888017b9dd80: fb fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc
^
ffff888017b9de00: fa fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc
ffff888017b9de80: fa fb fc fc 00 00 fc fc fa fb fc fc fb fb fc fc
==================================================================
Tested on:
commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13dcf65e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16f75c7e480000
^ permalink raw reply [flat|nested] 20+ messages in thread
* [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
@ 2023-01-13 7:30 syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2023-01-13 7:30 UTC (permalink / raw)
To: alsa-devel, linux-kernel, perex, syzkaller-bugs, tiwai
Hello,
syzbot found the following issue on:
HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=123b545e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17530902480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e29d28728f38190cecfc@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:100
Read of size 8 at addr ffff88801eb938f0 by task syz-executor234/5078
CPU: 0 PID: 5078 Comm: syz-executor234 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
__wake_up_common+0x637/0x650 kernel/sched/wait.c:100
__wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138
snd_pcm_post_stop+0x91/0x1f0 sound/core/pcm_native.c:1522
snd_pcm_action_single+0xf4/0x130 sound/core/pcm_native.c:1283
snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364
snd_pcm_stop sound/core/pcm_native.c:1543 [inline]
snd_pcm_drop+0x165/0x2b0 sound/core/pcm_native.c:2227
snd_pcm_kernel_ioctl+0x243/0x2e0 sound/core/pcm_native.c:3456
snd_pcm_oss_sync+0x230/0x810 sound/core/oss/pcm_oss.c:1746
snd_pcm_oss_release+0x27a/0x300 sound/core/oss/pcm_oss.c:2590
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f864105c209
Code: Unable to access opcode bytes at 0x7f864105c1df.
RSP: 002b:00007fff6e56b898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 00007f864105c209
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 0000000000000000 R08: 00007fff6e56ba38 R09: 00007fff6e56ba38
R10: 000000000000000d R11: 0000000000000246 R12: 00007f864101f800
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
</TASK>
Allocated by task 5078:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 1002:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2737
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2967
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
The buggy address belongs to the object at ffff88801eb938c0
which belongs to the cache io_kiocb of size 216
The buggy address is located 48 bytes inside of
216-byte region [ffff88801eb938c0, ffff88801eb93998)
The buggy address belongs to the physical page:
page:ffffea00007ae4c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eb93
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801bc32dc0 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5078, tgid 5078 (syz-executor234), ts 58909389529, free_ts 58908987546
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
skb_free_frag include/linux/skbuff.h:3193 [inline]
skb_free_head+0x96/0x110 net/core/skbuff.c:818
skb_release_data+0x5f4/0x870 net/core/skbuff.c:849
skb_release_all net/core/skbuff.c:914 [inline]
__kfree_skb+0x4f/0x70 net/core/skbuff.c:928
tcp_rcv_established+0x15fd/0x2270 net/ipv4/tcp_input.c:5927
tcp_v4_do_rcv+0x663/0x9d0 net/ipv4/tcp_ipv4.c:1721
tcp_v4_rcv+0x2eab/0x3280 net/ipv4/tcp_ipv4.c:2142
ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x2ec/0x4f0 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:302 [inline]
NF_HOOK include/linux/netfilter.h:296 [inline]
ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:454 [inline]
ip_sublist_rcv_finish+0x9a/0x2c0 net/ipv4/ip_input.c:580
ip_list_rcv_finish.constprop.0+0x4f9/0x6c0 net/ipv4/ip_input.c:630
ip_sublist_rcv net/ipv4/ip_input.c:638 [inline]
ip_list_rcv+0x347/0x4a0 net/ipv4/ip_input.c:673
__netif_receive_skb_list_ptype net/core/dev.c:5525 [inline]
__netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5573
__netif_receive_skb_list net/core/dev.c:5625 [inline]
netif_receive_skb_list_internal+0x75f/0xdc0 net/core/dev.c:5716
Memory state around the buggy address:
ffff88801eb93780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801eb93800: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
>ffff88801eb93880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88801eb93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801eb93980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2023-02-02 5:24 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20230119081633.3470-1-hdanton@sina.com>
2023-02-01 16:41 ` [syzbot] KASAN: use-after-free Read in snd_pcm_post_stop syzbot
[not found] <20230201233318.593-1-hdanton@sina.com>
2023-02-02 5:24 ` syzbot
[not found] <20230119030102.3388-1-hdanton@sina.com>
2023-01-19 3:18 ` syzbot
[not found] <20230119012145.3304-1-hdanton@sina.com>
2023-01-19 2:01 ` syzbot
[not found] <20230118222858.3127-1-hdanton@sina.com>
2023-01-19 1:13 ` syzbot
[not found] <20230118150448.3071-1-hdanton@sina.com>
2023-01-18 15:27 ` syzbot
[not found] <20230118094915.2906-1-hdanton@sina.com>
2023-01-18 14:07 ` syzbot
[not found] <20230118055330.2780-1-hdanton@sina.com>
2023-01-18 7:06 ` syzbot
[not found] <20230118023942.2716-1-hdanton@sina.com>
2023-01-18 2:59 ` syzbot
[not found] <20230117093837.2433-1-hdanton@sina.com>
2023-01-17 17:54 ` syzbot
[not found] <20230117015907.2238-1-hdanton@sina.com>
2023-01-17 2:39 ` syzbot
[not found] <20230116053340.1952-1-hdanton@sina.com>
2023-01-16 12:44 ` syzbot
[not found] <20230116012417.1876-1-hdanton@sina.com>
2023-01-16 1:55 ` syzbot
[not found] <20230116000718.1809-1-hdanton@sina.com>
2023-01-16 0:34 ` syzbot
[not found] <20230115232650.1752-1-hdanton@sina.com>
2023-01-15 23:43 ` syzbot
[not found] <20230115220938.1677-1-hdanton@sina.com>
2023-01-15 22:31 ` syzbot
[not found] <20230115122106.1614-1-hdanton@sina.com>
2023-01-15 16:04 ` syzbot
[not found] <20230115074631.1541-1-hdanton@sina.com>
2023-01-15 8:06 ` syzbot
[not found] <20230113113404.879-1-hdanton@sina.com>
2023-01-13 11:59 ` syzbot
2023-01-13 7:30 syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).