linux-kernel - KASAN: use-after-free Read in dtSearch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAGyP=7czgoq8V+v09uAJWLXM4sRYsMGQ6YGF2eFARXxmcg8xTw@mail.gmail.com>
Date:   Sat, 3 Jun 2023 02:12:24 -0700
From:   Palash Oswal <oswalpalash@...il.com>
To:     Dave Kleikamp <shaggy@...nel.org>,
        jfs-discussion@...ts.sourceforge.net,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: KASAN: use-after-free Read in dtSearch

Hello,
I found the following issue using syzkaller with enriched corpus[1] on:
HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
git tree: linux
C Reproducer : I do not have a C reproducer yet. I will update this
thread when I get one.
Kernel .config :
https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f

Link:
1. https://github.com/cmu-pasta/linux-kernel-enriched-corpus

Console log :
==================================================================
BUG: KASAN: use-after-free in dtSearch+0x1c87/0x20b0
Read of size 1 at addr ffff8881272d16f4 by task syz-executor.0/21592

CPU: 1 PID: 21592 Comm: syz-executor.0 Not tainted
6.3.0-rc6-pasta-00035-g0bcc40255504 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xd9/0x150
 print_address_description.constprop.0+0x2c/0x3c0
 kasan_report+0x11c/0x130
 dtSearch+0x1c87/0x20b0
 jfs_lookup+0x180/0x340
 __lookup_slow+0x24c/0x460
 walk_component+0x33f/0x5a0
 path_lookupat+0x185/0x760
 filename_lookup+0x1d2/0x590
 user_path_at_empty+0x46/0x60
 __x64_sys_mount+0x1ee/0x300
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f4547e8eacd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4548b8abf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f4547fbbf80 RCX: 00007f4547e8eacd
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00007f4547efcb05 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffdef4763f R14: 00007fffdef477e0 R15: 00007f4548b8ad80
 </TASK>

The buggy address belongs to the physical page:
page:ffffea00049cb440 refcount:0 mapcount:0 mapping:0000000000000000
index:0x2 pfn:0x1272d1
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 ffffea00049c8fc8 ffffea0004cca408 0000000000000000
raw: 0000000000000002 ffff8881272d1000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Reclaimable, gfp_mask
0x242050(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE|__GFP_RECLAIMABLE),
pid 17911, tgid 17910 (syz-executor.0), ts 959645805638, free_ts
962549035260
 get_page_from_freelist+0x1190/0x2e20
 __alloc_pages+0x1cb/0x4a0
 cache_grow_begin+0x9b/0x3b0
 cache_alloc_refill+0x27f/0x380
 kmem_cache_alloc+0x397/0x3f0
 jbd2__journal_start+0x190/0x850
 __ext4_journal_start_sb+0x411/0x5d0
 ext4_dirty_inode+0xa5/0x130
 __mark_inode_dirty+0x1e0/0xd60
 generic_write_end+0x354/0x440
 ext4_da_write_end+0x172/0x8e0
 generic_perform_write+0x316/0x570
 ext4_buffered_write_iter+0x15b/0x460
 ext4_file_write_iter+0xbd8/0x1720
 __kernel_write_iter+0x262/0x7a0
 dump_user_range+0x234/0x700
page last free stack trace:
 free_pcp_prepare+0x5d5/0xa50
 free_unref_page+0x1d/0x490
 slabs_destroy+0x85/0xc0
 ___cache_free+0x2ae/0x3d0
 qlist_free_all+0x4f/0x1a0
 kasan_quarantine_reduce+0x192/0x220
 __kasan_slab_alloc+0x63/0x90
 kmem_cache_alloc+0x1bd/0x3f0
 getname_flags.part.0+0x50/0x4f0
 getname_flags+0x9e/0xe0
 user_path_at_empty+0x2f/0x60
 do_readlinkat+0xcd/0x2f0
 __x64_sys_readlinkat+0x97/0x100
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:
 ffff8881272d1580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881272d1600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881272d1680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                             ^
 ffff8881272d1700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881272d1780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================