linux-kernel - BUG: KASAN: use-after-free in prepare_ftrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 2 Sep 2020 12:42:01 +0530
From:   Naresh Kamboju <naresh.kamboju@...aro.org>
To:     open list <linux-kernel@...r.kernel.org>,
        linux- stable <stable@...r.kernel.org>,
        lkft-triage@...ts.linaro.org, linux-mm <linux-mm@...ck.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Leo Yan <leo.yan@...aro.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Sasha Levin <sashal@...nel.org>
Subject: BUG: KASAN: use-after-free in prepare_ftrace_return+0x88/0x140

While running LTP tracing on arm64 juno with kasan config enabled
this kernel BUG triggered.

metadata:
  git branch: linux-4.14.y
  git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
  kernel-config:
https://builds.tuxbuild.com/oTHtWrmNsVQa9iuCfXJTQA/kernel.config

steps to reproduce:
# Boot arm64 juno with trace configs enabled ^.
# cd /opt/ltp
# ./runltp -f tracing

ftrace_buffer_size_kb.sh: line 33: echo: write error: Cannot allocate memory
ftrace_buffer_size_kb.sh: line 33: echo: write error: Cannot allocate memory
[  137.218462] ==================================================================
[  137.225924] BUG: KASAN: use-after-free in prepare_ftrace_return+0x88/0x140
[  137.232999] Read of size 8 at addr ffff80090202e0c8 by task sh/3123
[  137.239460]
[  137.241144] CPU: 2 PID: 3123 Comm: sh Not tainted 4.14.194 #1
[  137.247086] Hardware name: ARM Juno development board (r2) (DT)
[  137.253202] Call trace:
[  137.255850]  dump_backtrace+0x0/0x230
[  137.259703]
[  137.261381] Allocated by task 297879680:
[  137.265510] Unable to handle kernel paging request at virtual
address ffff20000bf29bc0
[  137.273626] Mem abort info:
[  137.276609]   Exception class = DABT (current EL), IL = 32 bits
[  137.282721]   SET = 0, FnV = 0
[  137.285963]   EA = 0, S1PTW = 0
[  137.289289] Data abort info:
[  137.292357]   ISV = 0, ISS = 0x00000007
[  137.296380]   CM = 0, WnR = 0
[  137.299537] swapper pgtable: 4k pages, 48-bit VAs, pgd = ffff20000afb8000
[  137.306520] [ffff20000bf29bc0] *pgd=00000009ffffe003,
*pud=00000009ffffd003, *pmd=0000000994f00003, *pte=0000000000000000
[  137.318072] Internal error: Oops: 96000007 [#1] PREEMPT SMP
[  137.323849] Modules linked in: crc32_ce crct10dif_ce fuse
[  137.329831] Process sh (pid: 3123, stack limit = 0xffff800902050000)
[  137.336389] CPU: 2 PID: 3123 Comm: sh Not tainted 4.14.194 #1
[  137.342328] Hardware name: ARM Juno development board (r2) (DT)
[  137.348444] task: ffff800911c14880 task.stack: ffff800902050000
[  137.354572] pc : depot_fetch_stack+0x14/0x38
[  137.359045] lr : print_track.isra.0+0x48/0x74
[  137.363593] sp : ffff80090202df20 pstate : 200001c5
[  137.368661] x29: ffff80090202df20 x28: ffff200009e0e090
[  137.374356] x27: ffff8009096ec200 x26: ffff200009e0e1c4
[  137.380052] x25: ffff80090202e0ec x24: ffff80090202e0e0
[  137.385746] x23: ffff8009365b6e00 x22: ffff200009adc7d0
[  137.391441] x21: 0000000011c14880 x20: ffff200009ac76b0
[  137.397136] x19: ffff80090202e0e4 x18: 0000000000000000
[  137.402830] x17: 0000000000000000 x16: 0000000000000000
[  137.408523] x15: 0000000000000000 x14: 3d3d3d3d3d3d3d3d
[  137.414218] x13: 3d3d3d3d3d3d3d3d x12: 1ffff00120405b89
[  137.419912] x11: ffff100120405b89 x10: dfff200000000000
[  137.425606] x9 : ffff100120405b8a x8 : 0000000000000004
[  137.431301] x7 : 0000000000000001 x6 : 0000000000000003
[  137.436994] x5 : ffff100120405b89 x4 : 0000000000000000
[  137.442688] x3 : 00000000001f8009 x2 : ffff20000af69b78
[  137.448382] x1 : ffff80090202df58 x0 : 0000000000003ff0
[  137.454079] Call trace:
[  137.456722] Code: f0014322 912de042 d3557800 d37c2400 (f8637842)
[  137.463087] ---[ end trace 81665fb4c270025f ]---
[  137.467908] note: sh[3123] exited with preempt_count 2

full test log,
https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.195-92-g54fa008d06cd/testrun/3149565/suite/linux-log-parser/test/check-kernel-bug-1727638/log

-- 
Linaro LKFT
https://lkft.linaro.org