linux-kernel - KASAN: use-after-free in membarrier_mm_sync_core_before

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+ZVgqy=1LjN9p7ojbrbN6079JmZ+JeTUHN2+RLeNFM4Pw@mail.gmail.com>
Date:   Wed, 15 Nov 2017 11:44:12 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Michal Hocko <mhocko@...e.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Andrea Arcangeli <aarcange@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: KASAN: use-after-free in membarrier_mm_sync_core_before_usermode

Hello,

I've tried to run latest linux-next on:

commit 63fb091c80188ec51f53514d07de907c1dd3d61d
Author: Stephen Rothwell <sfr@...>
Date:   Wed Nov 15 16:44:31 2017 +1100
    Add linux-next specific files for 20171115

and it crashes during boot with:

==================================================================
BUG: KASAN: use-after-free in __read_once_size
include/linux/compiler.h:183 [inline]
BUG: KASAN: use-after-free in atomic_read
arch/x86/include/asm/atomic.h:27 [inline]
BUG: KASAN: use-after-free in membarrier_mm_sync_core_before_usermode
include/linux/sched/mm.h:216 [inline]
BUG: KASAN: use-after-free in finish_task_switch+0x61f/0x7c0
kernel/sched/core.c:2712
Read of size 4 at addr ffff880064fe5170 by task rc/1535

CPU: 0 PID: 1535 Comm: rc Not tainted 4.14.0-next-20171115 #22
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
 __read_once_size include/linux/compiler.h:183 [inline]
 atomic_read arch/x86/include/asm/atomic.h:27 [inline]
 membarrier_mm_sync_core_before_usermode include/linux/sched/mm.h:216 [inline]
 finish_task_switch+0x61f/0x7c0 kernel/sched/core.c:2712
 schedule_tail+0xe/0x100 kernel/sched/core.c:2789
 ret_from_fork+0x8/0x30 arch/x86/entry/entry_64.S:422
RIP: 0033:0x7fee2a8fdf46
RSP: 002b:00007ffddfd435b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: 0000000000000000 RBX: 00007ffddfd435b0 RCX: 00007fee2a8fdf46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffddfd435f0 R08: 0000000000000000 R09: 00000000000005fc
R10: 00007fee2adf59d0 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000415d62 R15: 0000000000000001

Allocated by task 1532:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3548
 dup_mm kernel/fork.c:1230 [inline]
 copy_mm+0x30a/0x1310 kernel/fork.c:1293
 copy_process.part.36+0x1f31/0x4d70 kernel/fork.c:1797
 copy_process kernel/fork.c:1610 [inline]
 _do_fork+0x1ef/0xff0 kernel/fork.c:2091
 SYSC_clone kernel/fork.c:2201 [inline]
 SyS_clone+0x37/0x50 kernel/fork.c:2195
 do_syscall_64+0x26c/0x920 arch/x86/entry/common.c:286
 return_from_SYSCALL_64+0x0/0x75

Freed by task 1535:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3492 [inline]
 kmem_cache_free+0x77/0x280 mm/slab.c:3750
 __mmdrop+0x242/0x3d0 kernel/fork.c:604
 mmdrop+0x28/0x30 kernel/fork.c:610
 finish_task_switch+0x204/0x7c0 kernel/sched/core.c:2711
 schedule_tail+0xe/0x100 kernel/sched/core.c:2789
 ret_from_fork+0x8/0x30 arch/x86/entry/entry_64.S:422

The buggy address belongs to the object at ffff880064fe4d00
 which belongs to the cache mm_struct of size 1368
The buggy address is located 1136 bytes inside of
 1368-byte region [ffff880064fe4d00, ffff880064fe5258)
The buggy address belongs to the page:
page:ffffea000193f900 count:1 mapcount:0 mapping:ffff880064fe4100
index:0x0 compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffff880064fe4100 0000000000000000 0000000100000005
raw: ffffea000193eba0 ffff88006c9f8f50 ffff88006c9f7b40 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff880064fe5000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff880064fe5080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff880064fe5100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff880064fe5180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff880064fe5200: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
==================================================================