Date:   Sat, 3 Jun 2023 05:03:17 -0700
From:   Palash Oswal <oswalpalash@...il.com>
To:     Waiman Long <longman@...hat.com>,
        Guenter Roeck <linux@...ck-us.net>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andrew Morton <akpm@...ux-foundation.org>,
        wuchi <wuchi.zero@...il.com>, Stephen Boyd <swboyd@...omium.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: KASAN: slab-use-after-free Read in debug_check_no_obj_freed

Hello,
I found the following issue using syzkaller with enriched corpus[1] on:
HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
git tree: linux
C Reproducer : I do not have a C reproducer yet. I will update this
thread when I get one.
Kernel .config :
https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f

Link:
1. https://github.com/cmu-pasta/linux-kernel-enriched-corpus

Console log :
==================================================================
BUG: KASAN: slab-use-after-free in debug_check_no_obj_freed+0x1ef/0x420
Read of size 8 at addr ffff88802b99d498 by task systemd-journal/4432

CPU: 1 PID: 4432 Comm: systemd-journal Not tainted
6.3.0-rc6-pasta-00035-g0bcc40255504 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xd9/0x150
 print_address_description.constprop.0+0x2c/0x3c0
 kasan_report+0x11c/0x130
 debug_check_no_obj_freed+0x1ef/0x420
 __kmem_cache_free+0x194/0x2c0
 do_coredump+0x15f3/0x3cc0
 get_signal+0x1bff/0x25b0
 arch_do_signal_or_restart+0x79/0x5c0
 exit_to_user_mode_prepare+0x11f/0x240
 irqentry_exit_to_user_mode+0x9/0x40
 exc_page_fault+0xc0/0x170
 asm_exc_page_fault+0x26/0x30
RIP: 0033:0x7effa68f9be0
Code: 47 08 c3 0f 1f 80 00 00 00 00 31 c0 c3 0f 1f 00 66 2e 0f 1f 84
00 00 00 00 00 48 85 ff 74 1b 8b 47 08 85 c0 74 14 48 8b 47 10 <48> 8b
00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 31 c0 c3 0f 1f 00
RSP: 002b:00007ffc44762a18 EFLAGS: 00010206

RAX: 00000000a68541c0 RBX: 000055f2474fd200 RCX: 0000000000000000
RDX: 000055f2474fd270 RSI: 0000000032bd0c3f RDI: 000055f2474fe840
RBP: 000055f2474fd270 R08: 0000000000000353 R09: 00007ffc4477e080
R10: 00007ffc4477e0f0 R11: 00000000000298d6 R12: 0000000032bd0c3f
R13: 0000000000000001 R14: 00007ffc44762a4c R15: 00007ffc44762a4c
 </TASK>

Allocated by task 7970:
 kasan_save_stack+0x22/0x40
 kasan_set_track+0x25/0x30
 __kasan_slab_alloc+0x7f/0x90
 kmem_cache_alloc_lru+0x251/0x640
 __d_alloc+0x32/0x980
 d_alloc+0x4e/0x240
 d_alloc_parallel+0xe8/0x1530
 lookup_open.isra.0+0xb03/0x1400
 path_openat+0x953/0x26c0
 do_filp_open+0x1ba/0x410
 do_sys_openat2+0x16d/0x4c0
 __x64_sys_open+0x11d/0x1c0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 0:
 kasan_save_stack+0x22/0x40
 kasan_set_track+0x25/0x30
 kasan_save_free_info+0x2b/0x40
 ____kasan_slab_free+0x13b/0x1a0
 kmem_cache_free+0x105/0x370
 rcu_core+0x814/0x1960
 __do_softirq+0x1d4/0x905

Last potentially related work creation:
 kasan_save_stack+0x22/0x40
 __kasan_record_aux_stack+0x7b/0x90
 __call_rcu_common.constprop.0+0x99/0x7e0
 dentry_free+0xc3/0x160
 __dentry_kill+0x4cb/0x640
 shrink_dentry_list+0x12c/0x4f0
 shrink_dcache_parent+0x202/0x400
 d_invalidate+0x143/0x280
 proc_invalidate_siblings_dcache+0x3db/0x680
 release_task+0xcb0/0x1870
 wait_consider_task+0x306d/0x3ce0
 do_wait+0x799/0xc30
 kernel_wait4+0x150/0x260
 __do_sys_wait4+0x13f/0x150
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Second to last potentially related work creation:
 kasan_save_stack+0x22/0x40
 __kasan_record_aux_stack+0x7b/0x90
 __call_rcu_common.constprop.0+0x99/0x7e0
 dentry_free+0xc3/0x160
 __dentry_kill+0x4cb/0x640
 shrink_dentry_list+0x12c/0x4f0
 shrink_dcache_parent+0x202/0x400
 vfs_rmdir.part.0+0x272/0x5a0
 do_rmdir+0x3a8/0x420
 __x64_sys_unlinkat+0xef/0x130
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff88802b99d370
 which belongs to the cache dentry of size 312
The buggy address is located 296 bytes inside of
 freed 312-byte region [ffff88802b99d370, ffff88802b99d4a8)

The buggy address belongs to the physical page:
page:ffffea0000ae6740 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x2b99d
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff888014fdf900 ffffea0000ad2050 ffffea0001102fd0
raw: 0000000000000000 ffff88802b99d080 000000010000000a 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Reclaimable, gfp_mask
0x2420d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE|__GFP_RECLAIMABLE),
pid 8036, tgid 8036 (syz-executor.0), ts 565348161366, free_ts
561755114619
 get_page_from_freelist+0x1190/0x2e20
 __alloc_pages+0x1cb/0x4a0
 cache_grow_begin+0x9b/0x3b0
 cache_alloc_refill+0x27f/0x380
 kmem_cache_alloc_lru+0x540/0x640
 __d_alloc+0x32/0x980
 d_alloc+0x4e/0x240
 __lookup_hash+0xc8/0x180
 filename_create+0x1d6/0x4a0
 do_mkdirat+0x9d/0x310
 __x64_sys_mkdirat+0x119/0x170
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 free_pcp_prepare+0x5d5/0xa50
 free_unref_page+0x1d/0x490
 drain_freelist.isra.0+0xdd/0x130
 cache_reap+0x1bd/0x2e0
 process_one_work+0x991/0x15c0
 worker_thread+0x669/0x1090
 kthread+0x2e8/0x3a0
 ret_from_fork+0x1f/0x30

Memory state around the buggy address:
 ffff88802b99d380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802b99d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802b99d480: fb fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00
                            ^
ffff88802b99d500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88802b99d580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Powered by blists - more mailing lists