Message-ID: <001a1140e830a2fa7505649ffde9@google.com>
Date:   Wed, 07 Feb 2018 06:20:01 -0800
From:   syzbot <syzbot+19c09769f14b48810113@...kaller.appspotmail.com>
To:     davem@...emloft.net, jchapman@...alix.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: WARNING in debug_print_object

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: use-after-free Read in pppol2tp_put_sk

IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KASAN: use-after-free in pppol2tp_put_sk+0xa8/0xb0  
net/l2tp/l2tp_ppp.c:457
Read of size 8 at addr ffff8801ccf9a708 by task syz-executor/4399

CPU: 0 PID: 4399 Comm: syz-executor Not tainted 4.15.0+ #30
IPVS: ftp: loaded support on port[0] = 21
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  print_address_description+0x73/0x250 mm/kasan/report.c:252
  kasan_report_error mm/kasan/report.c:351 [inline]
  kasan_report+0x25b/0x340 mm/kasan/report.c:409
  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
  pppol2tp_put_sk+0xa8/0xb0 net/l2tp/l2tp_ppp.c:457
  __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
  rcu_do_batch kernel/rcu/tree.c:2674 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
  __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
  rcu_process_callbacks+0xd6c/0x17f0 kernel/rcu/tree.c:2917
IPVS: ftp: loaded support on port[0] = 21
  __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
IPVS: ftp: loaded support on port[0] = 21
  invoke_softirq kernel/softirq.c:365 [inline]
  irq_exit+0x1cc/0x200 kernel/softirq.c:405
  exiting_irq arch/x86/include/asm/apic.h:541 [inline]
  smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
  apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:938
  </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777  
[inline]
RIP: 0010:kmem_cache_free+0x17c/0x2a0 mm/slab.c:3744
RSP: 0018:ffff8801ad8ef218 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff11
RAX: 0000000000000007 RBX: ffff8801cf52a630 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000282
RBP: ffff8801ad8ef238 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801da9c1840
R13: 0000000000000282 R14: ffffffff819e1652 R15: 000000000000104a
IPVS: ftp: loaded support on port[0] = 21
  remove_vma+0x162/0x1b0 mm/mmap.c:176
  exit_mmap+0x311/0x500 mm/mmap.c:3049
  __mmput kernel/fork.c:966 [inline]
  mmput+0x223/0x6c0 kernel/fork.c:987
IPVS: ftp: loaded support on port[0] = 21
  exit_mm kernel/exit.c:544 [inline]
  do_exit+0x90a/0x1ad0 kernel/exit.c:852
IPVS: ftp: loaded support on port[0] = 21
  do_group_exit+0x149/0x400 kernel/exit.c:968
  get_signal+0x73a/0x16d0 kernel/signal.c:2469
  do_signal+0x90/0x1eb0 arch/x86/kernel/signal.c:809
  exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:161
  prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
  syscall_return_slowpath+0x490/0x550 arch/x86/entry/common.c:264
  entry_SYSCALL_64_fastpath+0x9e/0xa0
RIP: 0033:0x453299
RSP: 002b:00007fc49a74ece8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000071bf80 RCX: 0000000000453299
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000071bf80
RBP: 000000000071bf80 R08: 0000000000000000 R09: 000000000071bf58
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff45cc9fdf R14: 00007fc49a74f9c0 R15: 0000000000000002

Allocated by task 4389:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
  __do_kmalloc mm/slab.c:3705 [inline]
  __kmalloc+0x162/0x760 mm/slab.c:3714
  kmalloc include/linux/slab.h:517 [inline]
  kzalloc include/linux/slab.h:701 [inline]
  l2tp_session_create+0x100/0xe50 net/l2tp/l2tp_core.c:1738
  pppol2tp_session_prep+0x2fc/0xa40 net/l2tp/l2tp_ppp.c:711
  pppol2tp_connect+0x74a/0x1550 net/l2tp/l2tp_ppp.c:856
  SYSC_connect+0x213/0x4a0 net/socket.c:1639
  SyS_connect+0x24/0x30 net/socket.c:1620
  entry_SYSCALL_64_fastpath+0x29/0xa0

Freed by task 4399:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
  __cache_free mm/slab.c:3485 [inline]
  kfree+0xd6/0x260 mm/slab.c:3800
  pppol2tp_put_sk+0x4c/0xb0 net/l2tp/l2tp_ppp.c:456
  __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
  rcu_do_batch kernel/rcu/tree.c:2674 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
  __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
  rcu_process_callbacks+0xd6c/0x17f0 kernel/rcu/tree.c:2917
  __do_softirq+0x2d7/0xb85 kernel/softirq.c:285

The buggy address belongs to the object at ffff8801ccf9a480
  which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 648 bytes inside of
  1024-byte region [ffff8801ccf9a480, ffff8801ccf9a880)
The buggy address belongs to the page:
page:ffffea000733e680 count:1 mapcount:0 mapping:ffff8801ccf9a000 index:0x0  
compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffff8801ccf9a000 0000000000000000 0000000100000007
raw: ffffea00073221a0 ffffea0007321b20 ffff8801db000ac0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801ccf9a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801ccf9a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801ccf9a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff8801ccf9a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801ccf9a800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on  
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master  
commit
617aebe6a97efa539cc4b8a52adccd89596e6be0 (Sun Feb 4 00:25:42 2018 +0000)
Merge tag 'usercopy-v4.16-rc1' of  
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.
Kernel config is attached.
Raw console output is attached.


View attachment "patch.diff" of type "text/plain" (38601 bytes)

View attachment "raw.log.txt" of type "text/plain" (17651 bytes)

View attachment "config.txt" of type "text/plain" (136942 bytes)

Powered by blists - more mailing lists