* [syzbot] KASAN: use-after-free Read in register_shrinker_prepared (2)
@ 2022-09-27 10:52 syzbot
2022-10-07 14:21 ` syzbot
2022-10-09 19:45 ` syzbot
0 siblings, 2 replies; 3+ messages in thread
From: syzbot @ 2022-09-27 10:52 UTC (permalink / raw)
To: akpm, linux-kernel, linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: aaa11ce2ffc8 Add linux-next specific files for 20220923
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=139c8540880000
kernel config: https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294
dashboard link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/95c7bf83c07e/disk-aaa11ce2.raw.xz
vmlinux: https://storage.googleapis.com/b161cd56a7a3/vmlinux-aaa11ce2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __list_add_valid+0xa5/0xb0 lib/list_debug.c:30
Read of size 8 at addr ffff88807c60b5c8 by task syz-executor.0/9090
CPU: 1 PID: 9090 Comm: syz-executor.0 Not tainted 6.0.0-rc6-next-20220923-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:395
kasan_report+0xbb/0x1f0 mm/kasan/report.c:495
__list_add_valid+0xa5/0xb0 lib/list_debug.c:30
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
register_shrinker_prepared+0x37/0x120 mm/vmscan.c:695
sget_fc+0x5e7/0x7c0 fs/super.c:581
vfs_get_super fs/super.c:1163 [inline]
get_tree_nodev+0x24/0x1d0 fs/super.c:1198
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f691348a669
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6914629168 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f69135abf80 RCX: 00007f691348a669
RDX: 0000000020000100 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007f69134e5560 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffda5cb705f R14: 00007f6914629300 R15: 0000000000022000
</TASK>
Allocated by task 9062:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
kasan_set_track+0x21/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa1/0xb0 mm/kasan/common.c:380
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:934 [inline]
__kmalloc+0x54/0xc0 mm/slab_common.c:947
kmalloc include/linux/slab.h:564 [inline]
kzalloc include/linux/slab.h:695 [inline]
ops_init+0xfb/0x470 net/core/net_namespace.c:125
setup_net+0x5d1/0xc50 net/core/net_namespace.c:326
copy_net_ns+0x318/0x760 net/core/net_namespace.c:472
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3193
__do_sys_unshare kernel/fork.c:3264 [inline]
__se_sys_unshare kernel/fork.c:3262 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3262
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9062:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
kasan_set_track+0x21/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2a/0x40 mm/kasan/generic.c:511
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1669 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1695
slab_free mm/slub.c:3599 [inline]
__kmem_cache_free+0xab/0x3b0 mm/slub.c:3612
ops_init+0xcd/0x470 net/core/net_namespace.c:140
setup_net+0x5d1/0xc50 net/core/net_namespace.c:326
copy_net_ns+0x318/0x760 net/core/net_namespace.c:472
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3193
__do_sys_unshare kernel/fork.c:3264 [inline]
__se_sys_unshare kernel/fork.c:3262 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3262
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
call_rcu+0x99/0x820 kernel/rcu/tree.c:2796
netlink_release+0xeff/0x1db0 net/netlink/af_netlink.c:815
__sock_release net/socket.c:650 [inline]
sock_release+0x87/0x1b0 net/socket.c:678
netlink_kernel_release+0x4b/0x60 net/netlink/af_netlink.c:2107
genl_pernet_exit+0x34/0x70 net/netlink/genetlink.c:1416
ops_exit_list+0xb0/0x170 net/core/net_namespace.c:163
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
call_rcu+0x99/0x820 kernel/rcu/tree.c:2796
netlink_release+0xeff/0x1db0 net/netlink/af_netlink.c:815
__sock_release net/socket.c:650 [inline]
sock_release+0x87/0x1b0 net/socket.c:678
netlink_kernel_release+0x4b/0x60 net/netlink/af_netlink.c:2107
rdma_dev_exit_net+0x32e/0x550 drivers/infiniband/core/device.c:1152
ops_exit_list+0xb0/0x170 net/core/net_namespace.c:163
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff88807c60b000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1480 bytes inside of
2048-byte region [ffff88807c60b000, ffff88807c60b800)
The buggy address belongs to the physical page:
page:ffffea0001f18200 refcount:1 mapcount:0 mapping:0000000000000000 index:0xdead000000000100 pfn:0x7c608
head:ffffea0001f18200 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffff888011842000 dead000000080008 0000000000000000
raw: dead000000000100 dead000000000122 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5290, tgid 5287 (syz-executor.3), ts 351717085963, free_ts 351714173315
prep_new_page mm/page_alloc.c:2538 [inline]
get_page_from_freelist+0x1092/0x2d20 mm/page_alloc.c:4287
__alloc_pages+0x1c7/0x5a0 mm/page_alloc.c:5546
alloc_pages+0x1a6/0x270 mm/mempolicy.c:2280
alloc_slab_page mm/slub.c:1739 [inline]
allocate_slab+0x213/0x300 mm/slub.c:1884
new_slab mm/slub.c:1937 [inline]
___slab_alloc+0xac1/0x1430 mm/slub.c:3119
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3217
slab_alloc_node mm/slub.c:3302 [inline]
__kmem_cache_alloc_node+0x18a/0x3d0 mm/slub.c:3375
__do_kmalloc_node mm/slab_common.c:933 [inline]
__kmalloc+0x44/0xc0 mm/slab_common.c:947
kmalloc include/linux/slab.h:564 [inline]
kzalloc include/linux/slab.h:695 [inline]
ops_init+0xfb/0x470 net/core/net_namespace.c:125
setup_net+0x5d1/0xc50 net/core/net_namespace.c:326
copy_net_ns+0x318/0x760 net/core/net_namespace.c:472
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3193
__do_sys_unshare kernel/fork.c:3264 [inline]
__se_sys_unshare kernel/fork.c:3262 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3262
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1458 [inline]
free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1508
free_unref_page_prepare mm/page_alloc.c:3386 [inline]
free_unref_page+0x19/0x4d0 mm/page_alloc.c:3482
__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2532
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x62/0x80 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:754 [inline]
slab_alloc_node mm/slub.c:3336 [inline]
slab_alloc mm/slub.c:3344 [inline]
__kmem_cache_alloc_lru mm/slub.c:3351 [inline]
kmem_cache_alloc+0x2b7/0x3d0 mm/slub.c:3360
getname_flags.part.0+0x50/0x4f0 fs/namei.c:139
getname_flags+0x9a/0xe0 include/linux/audit.h:320
vfs_fstatat+0x73/0xb0 fs/stat.c:266
__do_sys_newfstatat+0x94/0x120 fs/stat.c:437
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88807c60b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807c60b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807c60b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807c60b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807c60b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in register_shrinker_prepared (2)
2022-09-27 10:52 [syzbot] KASAN: use-after-free Read in register_shrinker_prepared (2) syzbot
@ 2022-10-07 14:21 ` syzbot
2022-10-09 19:45 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2022-10-07 14:21 UTC (permalink / raw)
To: akpm, linux-kernel, linux-mm, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: ffb39098bf87 Merge tag 'linux-kselftest-kunit-6.1-rc1' of ..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1183721a880000
kernel config: https://syzkaller.appspot.com/x/.config?x=4de111f81d6bee57
dashboard link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1694d842880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e32a2f9d1ae7/disk-ffb39098.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/35e85ab79689/vmlinux-ffb39098.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __list_add_valid+0xa5/0xb0 lib/list_debug.c:30
Read of size 8 at addr ffff8880793fe5c8 by task syz-executor.1/4191
CPU: 1 PID: 4191 Comm: syz-executor.1 Not tainted 6.0.0-syzkaller-06205-gffb39098bf87 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
__list_add_valid+0xa5/0xb0 lib/list_debug.c:30
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
register_shrinker_prepared+0x37/0x120 mm/vmscan.c:684
sget_fc+0x5e7/0x7c0 fs/super.c:581
vfs_get_super fs/super.c:1163 [inline]
get_tree_nodev+0x24/0x1d0 fs/super.c:1198
mqueue_get_tree+0xee/0x130 ipc/mqueue.c:435
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
fc_mount+0x13/0xc0 fs/namespace.c:1043
mq_create_mount ipc/mqueue.c:485 [inline]
mq_init_ns+0x43e/0x630 ipc/mqueue.c:1701
create_ipc_ns ipc/namespace.c:58 [inline]
copy_ipcs+0x35e/0x5e0 ipc/namespace.c:94
create_new_namespaces+0x210/0xb20 kernel/nsproxy.c:90
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3181
__do_sys_unshare kernel/fork.c:3252 [inline]
__se_sys_unshare kernel/fork.c:3250 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3250
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7dfe68a5a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7dfdddd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f7dfe7ac2c0 RCX: 00007f7dfe68a5a9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c060000
RBP: 00007f7dfe6e5580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7dfecdfb1f R14: 00007f7dfdddd300 R15: 0000000000022000
</TASK>
Allocated by task 4187:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:437 [inline]
____kasan_kmalloc mm/kasan/common.c:516 [inline]
____kasan_kmalloc mm/kasan/common.c:475 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525
kmalloc include/linux/slab.h:605 [inline]
kzalloc include/linux/slab.h:733 [inline]
ops_init+0xfb/0x470 net/core/net_namespace.c:124
setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3181
__do_sys_unshare kernel/fork.c:3252 [inline]
__se_sys_unshare kernel/fork.c:3250 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3250
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 4187:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:367 [inline]
____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1759 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785
slab_free mm/slub.c:3539 [inline]
kfree+0xe2/0x580 mm/slub.c:4567
ops_init+0xcd/0x470 net/core/net_namespace.c:139
setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3181
__do_sys_unshare kernel/fork.c:3252 [inline]
__se_sys_unshare kernel/fork.c:3250 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3250
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff8880793fe000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1480 bytes inside of
2048-byte region [ffff8880793fe000, ffff8880793fe800)
The buggy address belongs to the physical page:
page:ffffea0001e4fe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x793f8
head:ffffea0001e4fe00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4194, tgid 4172 (syz-executor.1), ts 468583017791, free_ts 468503068379
prep_new_page mm/page_alloc.c:2532 [inline]
get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5549
alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:1829 [inline]
allocate_slab+0x27e/0x3d0 mm/slub.c:1974
new_slab mm/slub.c:2034 [inline]
___slab_alloc+0x84f/0xe80 mm/slub.c:3036
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3123
slab_alloc_node mm/slub.c:3214 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmalloc+0x32b/0x340 mm/slub.c:4425
kmalloc include/linux/slab.h:605 [inline]
sk_prot_alloc+0x143/0x290 net/core/sock.c:2030
sk_alloc+0x36/0x770 net/core/sock.c:2083
__netlink_create+0x63/0x380 net/netlink/af_netlink.c:647
netlink_create+0x3ad/0x5e0 net/netlink/af_netlink.c:710
__sock_create+0x355/0x790 net/socket.c:1515
sock_create net/socket.c:1566 [inline]
__sys_socket_create net/socket.c:1603 [inline]
__sys_socket_create net/socket.c:1588 [inline]
__sys_socket+0x12f/0x240 net/socket.c:1636
__do_sys_socket net/socket.c:1649 [inline]
__se_sys_socket net/socket.c:1647 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1449 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
free_unref_page_prepare mm/page_alloc.c:3380 [inline]
free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2553
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3248 [inline]
slab_alloc mm/slub.c:3256 [inline]
kmem_cache_alloc_trace+0x2c0/0x3e0 mm/slub.c:3287
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
kobject_uevent_env+0x230/0x1640 lib/kobject_uevent.c:524
__kobject_del+0x160/0x1f0 lib/kobject.c:585
kobject_cleanup lib/kobject.c:664 [inline]
kobject_release lib/kobject.c:704 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x2ed/0x4c0 lib/kobject.c:721
net_rx_queue_update_kobjects+0x3f3/0x510 net/core/net-sysfs.c:1128
remove_queue_kobjects net/core/net-sysfs.c:1829 [inline]
netdev_unregister_kobject+0x158/0x280 net/core/net-sysfs.c:1983
unregister_netdevice_many+0xe3a/0x1980 net/core/dev.c:10870
ip_tunnel_delete_nets+0x39f/0x5b0 net/ipv4/ip_tunnel.c:1126
ops_exit_list+0x125/0x170 net/core/net_namespace.c:167
setup_net+0x7fb/0xc50 net/core/net_namespace.c:348
Memory state around the buggy address:
ffff8880793fe480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880793fe500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880793fe580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880793fe600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880793fe680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in register_shrinker_prepared (2)
2022-09-27 10:52 [syzbot] KASAN: use-after-free Read in register_shrinker_prepared (2) syzbot
2022-10-07 14:21 ` syzbot
@ 2022-10-09 19:45 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2022-10-09 19:45 UTC (permalink / raw)
To: akpm, linux-kernel, linux-mm, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: a6afa4199d3d Merge tag 'mailbox-v6.1' of git://git.linaro...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1796508a880000
kernel config: https://syzkaller.appspot.com/x/.config?x=e2021a61197ebe02
dashboard link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=105ee158880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a7ea78880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4ab7841430f9/disk-a6afa419.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/85d7d196fbe9/vmlinux-a6afa419.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __list_add_valid+0xa5/0xb0 lib/list_debug.c:30
Read of size 8 at addr ffff8880262715c8 by task syz-executor161/5975
CPU: 0 PID: 5975 Comm: syz-executor161 Not tainted 6.0.0-syzkaller-09039-ga6afa4199d3d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
__list_add_valid+0xa5/0xb0 lib/list_debug.c:30
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
register_shrinker_prepared+0x37/0x120 mm/vmscan.c:684
sget_fc+0x5e7/0x7c0 fs/super.c:581
vfs_get_super fs/super.c:1163 [inline]
get_tree_nodev+0x24/0x1d0 fs/super.c:1198
mqueue_get_tree+0xee/0x130 ipc/mqueue.c:435
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
fc_mount+0x13/0xc0 fs/namespace.c:1043
mq_create_mount ipc/mqueue.c:485 [inline]
mq_init_ns+0x43e/0x630 ipc/mqueue.c:1701
create_ipc_ns ipc/namespace.c:58 [inline]
copy_ipcs+0x35e/0x5e0 ipc/namespace.c:94
create_new_namespaces+0x210/0xb20 kernel/nsproxy.c:90
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3181
__do_sys_unshare kernel/fork.c:3252 [inline]
__se_sys_unshare kernel/fork.c:3250 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3250
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f878917a909
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f878912c318 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f87892023e8 RCX: 00007f878917a909
RDX: 00007f878912c700 RSI: 8c53bf579e072fbf RDI: 000000006c060000
RBP: 00007f87892023e0 R08: 00007f878912c700 R09: 0000000000000000
R10: 00007f878912c700 R11: 0000000000000246 R12: 00007f87892023ec
R13: 00007ffe4e8905ff R14: 00007f878912c400 R15: 0000000000022000
</TASK>
Allocated by task 5969:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:437 [inline]
____kasan_kmalloc mm/kasan/common.c:516 [inline]
____kasan_kmalloc mm/kasan/common.c:475 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525
kmalloc include/linux/slab.h:605 [inline]
kzalloc include/linux/slab.h:733 [inline]
ops_init+0xfb/0x470 net/core/net_namespace.c:124
setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3181
__do_sys_unshare kernel/fork.c:3252 [inline]
__se_sys_unshare kernel/fork.c:3250 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3250
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 5969:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:367 [inline]
____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1759 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785
slab_free mm/slub.c:3539 [inline]
kfree+0xe2/0x580 mm/slub.c:4567
ops_init+0xcd/0x470 net/core/net_namespace.c:139
setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3181
__do_sys_unshare kernel/fork.c:3252 [inline]
__se_sys_unshare kernel/fork.c:3250 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3250
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x625/0x1200 kernel/workqueue.c:1517
queue_work_on+0xee/0x110 kernel/workqueue.c:1545
queue_work include/linux/workqueue.h:503 [inline]
afs_queue_server_manager fs/afs/server.c:612 [inline]
afs_purge_servers+0xea/0x340 fs/afs/server.c:626
afs_net_exit+0x16d/0x320 fs/afs/main.c:157
ops_exit_list+0xb0/0x170 net/core/net_namespace.c:162
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x625/0x1200 kernel/workqueue.c:1517
queue_work_on+0xee/0x110 kernel/workqueue.c:1545
queue_work include/linux/workqueue.h:503 [inline]
afs_queue_cell_manager+0x64/0xe0 fs/afs/cell.c:520
afs_cell_purge+0x105/0x2b0 fs/afs/cell.c:946
afs_net_exit+0x165/0x320 fs/afs/main.c:156
ops_exit_list+0xb0/0x170 net/core/net_namespace.c:162
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff888026271000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1480 bytes inside of
2048-byte region [ffff888026271000, ffff888026271800)
The buggy address belongs to the physical page:
page:ffffea0000989c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26270
head:ffffea0000989c00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea0001c6ba00 dead000000000002 ffff888011842000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3757, tgid 3755 (syz-executor161), ts 54893932773, free_ts 54834561262
prep_new_page mm/page_alloc.c:2532 [inline]
get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5549
alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270
alloc_slab_page mm/slub.c:1829 [inline]
allocate_slab+0x27e/0x3d0 mm/slub.c:1974
new_slab mm/slub.c:2034 [inline]
___slab_alloc+0x84f/0xe80 mm/slub.c:3036
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3123
slab_alloc_node mm/slub.c:3214 [inline]
slab_alloc mm/slub.c:3256 [inline]
__kmalloc+0x32b/0x340 mm/slub.c:4425
kmalloc include/linux/slab.h:605 [inline]
sk_prot_alloc+0x143/0x290 net/core/sock.c:2030
sk_alloc+0x36/0x770 net/core/sock.c:2083
__netlink_create+0x63/0x380 net/netlink/af_netlink.c:647
__netlink_kernel_create+0x110/0x850 net/netlink/af_netlink.c:2045
netlink_kernel_create include/linux/netlink.h:62 [inline]
genl_pernet_init+0xa9/0x140 net/netlink/genetlink.c:1433
ops_init+0xaf/0x470 net/core/net_namespace.c:134
setup_net+0x5d1/0xc50 net/core/net_namespace.c:325
copy_net_ns+0x318/0x760 net/core/net_namespace.c:471
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1449 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
free_unref_page_prepare mm/page_alloc.c:3380 [inline]
free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2553
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3248 [inline]
kmem_cache_alloc_node+0x2b1/0x3f0 mm/slub.c:3298
alloc_task_struct_node kernel/fork.c:172 [inline]
dup_task_struct kernel/fork.c:969 [inline]
copy_process+0x5c2/0x7090 kernel/fork.c:2085
kernel_clone+0xe7/0xab0 kernel/fork.c:2671
__do_sys_clone+0xba/0x100 kernel/fork.c:2805
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888026271480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888026271500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888026271580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888026271600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888026271680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-10-09 19:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-27 10:52 [syzbot] KASAN: use-after-free Read in register_shrinker_prepared (2) syzbot
2022-10-07 14:21 ` syzbot
2022-10-09 19:45 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).