From: butt3rflyh4ck <butterflyhuangxx@gmail.com>
To: security@kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alsa-devel@alsa-project.org,
syzkaller <syzkaller@googlegroups.com>,
tiwai@suse.com, linux-kernel@vger.kernel.org
Subject: KASAN: use-after-free Write in snd_rawmidi_kernel_write1
Date: Thu, 7 May 2020 15:54:34 +0800 [thread overview]
Message-ID: <CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com> (raw)
I report a bug (in linux-5.7-rc1) found by syzkaller.
kernel config:
https://github.com/butterflyhack/syzkaller-fuzz/blob/master/v5.7.0-rc1.config
reproducer:
https://github.com/butterflyhack/syzkaller-fuzz/blob/master/repro.cprog
I test the reproducer in linux-5.7-rc4 and crash too.
crash log:
==================================================================
BUG: KASAN: use-after-free in _copy_from_user+0x113/0x1a0 lib/usercopy.c:13
Write of size 1 at addr ffff888069da43ca by task syz-executor611/6797
CPU: 0 PID: 6797 Comm: syz-executor611 Not tainted 5.7.0-rc1 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1
04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x347 mm/kasan/report.c:382
__kasan_report.cold+0x35/0x4d mm/kasan/report.c:511
kasan_report+0x33/0x50 mm/kasan/common.c:625
check_memory_region_inline mm/kasan/generic.c:187 [inline]
check_memory_region+0x141/0x190 mm/kasan/generic.c:193
_copy_from_user+0x113/0x1a0 lib/usercopy.c:13
copy_from_user include/linux/uaccess.h:144 [inline]
snd_rawmidi_kernel_write1+0x320/0x6f0 sound/core/rawmidi.c:1363
snd_rawmidi_write+0x2e4/0xb80 sound/core/rawmidi.c:1429
__vfs_write+0x76/0x100 fs/read_write.c:495
vfs_write+0x268/0x5d0 fs/read_write.c:559
ksys_write+0x1ee/0x250 fs/read_write.c:612
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x4553a9
Code: 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f556b7f5cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000006d9588 RCX: 00000000004553a9
RDX: 00000000fffffc85 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000006d9580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006d958c
R13: 0000000000000000 R14: 00000000006d9580 R15: 00007fff34bcb390
Allocated by task 6797:
save_stack+0x1b/0x40 mm/kasan/common.c:49
set_track mm/kasan/common.c:57 [inline]
__kasan_kmalloc mm/kasan/common.c:495 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468
kmalloc_node include/linux/slab.h:578 [inline]
kvmalloc_node+0x61/0xf0 mm/util.c:574
kvmalloc include/linux/mm.h:757 [inline]
kvzalloc include/linux/mm.h:765 [inline]
snd_rawmidi_runtime_create sound/core/rawmidi.c:141 [inline]
open_substream+0x33d/0x880 sound/core/rawmidi.c:285
rawmidi_open_priv+0x58e/0x6e0 sound/core/rawmidi.c:336
snd_rawmidi_open+0x455/0xb20 sound/core/rawmidi.c:433
snd_open+0x212/0x3d0 sound/core/sound.c:163
chrdev_open+0x219/0x5c0 fs/char_dev.c:414
do_dentry_open+0x4ba/0x1290 fs/open.c:797
do_open fs/namei.c:3229 [inline]
path_openat+0x1e59/0x27d0 fs/namei.c:3346
do_filp_open+0x192/0x260 fs/namei.c:3373
do_sys_openat2+0x585/0x7d0 fs/open.c:1148
do_sys_open+0xc3/0x140 fs/open.c:1164
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
Freed by task 6798:
save_stack+0x1b/0x40 mm/kasan/common.c:49
set_track mm/kasan/common.c:57 [inline]
kasan_set_free_info mm/kasan/common.c:317 [inline]
__kasan_slab_free+0x126/0x170 mm/kasan/common.c:456
slab_free_hook mm/slub.c:1445 [inline]
slab_free_freelist_hook+0xc4/0x1c0 mm/slub.c:1478
slab_free mm/slub.c:3035 [inline]
kfree+0xd8/0x330 mm/slub.c:4003
kvfree+0x42/0x50 mm/util.c:603
resize_runtime_buffer+0x29e/0x370 sound/core/rawmidi.c:677
snd_rawmidi_output_params+0x128/0x170 sound/core/rawmidi.c:690
snd_rawmidi_ioctl+0x544/0x5b0 sound/core/rawmidi.c:841
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
The buggy address belongs to the object at ffff888069da4000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 970 bytes inside of
4096-byte region [ffff888069da4000, ffff888069da5000)
The buggy address belongs to the page:
page:ffffea0001a76800 refcount:1 mapcount:0 mapping:00000000c136e8e7
index:0x0 head:ffffea0001a76800 order:3 compound_mapcount:0
compound_pincount:0
flags: 0xfffe0000010200(slab|head)
raw: 00fffe0000010200 dead000000000100 dead000000000122 ffff88806bc0c280
raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888069da4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888069da4300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888069da4380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888069da4400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888069da4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Regards,
butt3rflyh4ck
next reply other threads:[~2020-05-07 9:24 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 7:54 butt3rflyh4ck [this message]
2020-05-07 8:23 ` KASAN: use-after-free Write in snd_rawmidi_kernel_write1 Greg Kroah-Hartman
2020-05-07 9:50 ` Takashi Iwai
2020-05-07 9:50 ` Takashi Iwai
2020-05-07 10:01 ` butt3rflyh4ck
2020-05-07 10:01 ` butt3rflyh4ck
2020-05-07 8:04 butt3rflyh4ck
2020-05-07 8:04 ` butt3rflyh4ck
2020-05-07 8:23 ` Greg Kroah-Hartman
2020-05-07 9:56 ` Takashi Iwai
2020-05-07 9:56 ` Takashi Iwai
2020-05-07 10:13 ` Greg Kroah-Hartman
2020-05-07 10:13 ` Greg Kroah-Hartman
2020-05-07 10:19 ` Takashi Iwai
2020-05-07 10:19 ` Takashi Iwai
2020-05-07 11:07 ` Greg Kroah-Hartman
2020-05-07 11:07 ` Greg Kroah-Hartman
2020-05-07 10:27 ` Amadeusz Sławiński
2020-05-07 10:27 ` Amadeusz Sławiński
2020-05-07 10:36 ` Takashi Iwai
2020-05-07 10:36 ` Takashi Iwai
2020-05-07 10:42 ` Takashi Iwai
2020-05-07 10:42 ` Takashi Iwai
2020-05-07 11:44 ` Takashi Iwai
2020-05-07 11:44 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com' \
--to=butterflyhuangxx@gmail.com \
--cc=alsa-devel@alsa-project.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=security@kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.