Date:   Sat, 02 Dec 2017 08:08:01 -0800
From:   syzbot 
        <bot+f2a32269c7d88a3653ef36f3d516f19ece83fdb5@...kaller.appspotmail.com>
To:     dan.carpenter@...cle.com, gregkh@...uxfoundation.org,
        hdegoede@...hat.com, linux-kernel@...r.kernel.org,
        linux-usb@...r.kernel.org, mateuszb@...tmail.fm, mingo@...nel.org,
        mingo@...hat.com, peterz@...radead.org, stern@...land.harvard.edu,
        syzkaller-bugs@...glegroups.com, viro@...iv.linux.org.uk,
        vskrishn@...eaurora.org, yamada.masahiro@...ionext.com
Subject: KASAN: use-after-free Read in __lock_acquire (2)

syzkaller has found reproducer for the following crash on  
2db767d9889cef087149a5eaa35c1497671fa40f
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x465e/0x47f0  
kernel/locking/lockdep.c:3378
Read of size 8 at addr ffff8801cd8e13f0 by task syzkaller236979/3086

CPU: 1 PID: 3086 Comm: syzkaller236979 Not tainted 4.15.0-rc1+ #115
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  print_address_description+0x73/0x250 mm/kasan/report.c:252
  kasan_report_error mm/kasan/report.c:351 [inline]
  kasan_report+0x25b/0x340 mm/kasan/report.c:409
  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
  __lock_acquire+0x465e/0x47f0 kernel/locking/lockdep.c:3378
  lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004
  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
  _raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:159
  remove_wait_queue+0x81/0x350 kernel/sched/wait.c:50
  ep_remove_wait_queue fs/eventpoll.c:595 [inline]
  ep_unregister_pollwait.isra.7+0x18c/0x590 fs/eventpoll.c:613
  ep_free+0x13f/0x320 fs/eventpoll.c:830
  ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:862
  __fput+0x333/0x7f0 fs/file_table.c:210
  ____fput+0x15/0x20 fs/file_table.c:244
  task_work_run+0x199/0x270 kernel/task_work.c:113
  exit_task_work include/linux/task_work.h:22 [inline]
  do_exit+0x9bb/0x1ae0 kernel/exit.c:865
  do_group_exit+0x149/0x400 kernel/exit.c:968
  SYSC_exit_group kernel/exit.c:979 [inline]
  SyS_exit_group+0x1d/0x20 kernel/exit.c:977
  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125
RIP: 0023:0xf7f97c79
RSP: 002b:00000000ffcb51bc EFLAGS: 00000296 ORIG_RAX: 00000000000000fc
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000080f0298
RDX: 0000000000000000 RSI: 00000000080d9b18 RDI: 00000000080f02a0
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 3086:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
  kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3613
  kmalloc include/linux/slab.h:499 [inline]
  kzalloc include/linux/slab.h:688 [inline]
  binder_get_thread+0x1cf/0x870 drivers/android/binder.c:4184
  binder_poll+0x8c/0x390 drivers/android/binder.c:4286
  ep_item_poll.isra.10+0xec/0x320 fs/eventpoll.c:884
  ep_insert+0x6a3/0x1b10 fs/eventpoll.c:1455
  SYSC_epoll_ctl fs/eventpoll.c:2106 [inline]
  SyS_epoll_ctl+0x12e4/0x1ab0 fs/eventpoll.c:1992
  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125

Freed by task 3086:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
  __cache_free mm/slab.c:3491 [inline]
  kfree+0xca/0x250 mm/slab.c:3806
  binder_free_thread drivers/android/binder.c:4211 [inline]
  binder_thread_dec_tmpref+0x27f/0x310 drivers/android/binder.c:1808
  binder_thread_release+0x27d/0x540 drivers/android/binder.c:4275
  binder_ioctl+0xc05/0x141a drivers/android/binder.c:4492
  C_SYSC_ioctl fs/compat_ioctl.c:1473 [inline]
  compat_SyS_ioctl+0x151/0x2a30 fs/compat_ioctl.c:1419
  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125

The buggy address belongs to the object at ffff8801cd8e1340
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 176 bytes inside of
  512-byte region [ffff8801cd8e1340, ffff8801cd8e1540)
The buggy address belongs to the page:
page:000000005245354e count:1 mapcount:0 mapping:000000001b93048b  
index:0xffff8801cd8e1840
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801cd8e10c0 ffff8801cd8e1840 0000000100000005
raw: ffffea00073404e0 ffffea0007340920 ffff8801db000940 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801cd8e1280: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff8801cd8e1300: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff8801cd8e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                              ^
  ffff8801cd8e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801cd8e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


View attachment "config.txt" of type "text/plain" (126531 bytes)

Download attachment "raw.log" of type "application/octet-stream" (14358 bytes)

View attachment "repro.txt" of type "text/plain" (501 bytes)

Download attachment "repro.c" of type "application/octet-stream" (1650 bytes)

Powered by blists - more mailing lists