linux-kernel - Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in kill_orphaned

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 12 May 2024 21:36:56 +0800
From: lee bruce <xrivendell7@...il.com>
To: Hillf Danton <hdanton@...a.com>
Cc: syzbot+68619f9e9e69accd8e0a@...kaller.appspotmail.com, 
	linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com, 
	Edward Adam Davis <eadavis@...com>, clf700383@...il.com, michael.christie@...cle.com, 
	mst@...hat.com, luto@...nel.org, peterz@...radead.org, 
	Thomas Gleixner <tglx@...utronix.de>, ebiederm@...ssion.com
Subject: Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in
 kill_orphaned_pgrp (2)

Hi.

2024年5月12日 09:40，lee bruce <xrivendell7@...il.com> 写道：

Hi.

Hillf Danton <hdanton@...a.com> 于2024年5月12日周日 07:34写道：

On Sat, 11 May 2024 22:45:06 +0800 lee bruce <xrivendell7@...il.com>

Hello, I found a reproducer for this bug.

Thanks for your report.

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrivendell7@...il.com>
Reported-by: lingfei cheng <clf700383@...il.com>

I use the same kernel as syzbot instance
Kernel Commit: upstream dccb07f2914cdab2ac3a5b6c98406f765acab803
Kernel Config: https://syzkaller.appspot.com/text?tag=3DKernelConfig&x=3D6d14c12b661fb43
with KASAN enabled

Since the same title bug is triggered in
https://syzkaller.appspot.com/bug?id=3D70492b96ff47ff70cfc433be100586119310670b.
I make a simple RCA.
In the old-syzbot instance the bug still trigger the title "KASAN:
slab-use-after-free Read in kill_orphaned_pgrp=E2=80=9D and in the lastest
syzbot the bug report as

TITLE: WARNING in signal_wake_up_state
------------[ cut here ]------------
WARNING: CPU: 3 PID: 8591 at kernel/signal.c:762
signal_wake_up_state+0xf8/0x130 kernel/signal.c:762
Modules linked in:
CPU: 3 PID: 8591 Comm: file0 Not tainted 6.9.0-rc7-00012-gdccb07f2914c #6

Could you reproduce it in the next tree, because of d558664602d3 ("vhost_task:
Handle SIGKILL by flushing work and exiting") adding reaction to signal?

I test the kernel linux-next: d558664602d3906866e604a618dcf67f66d79967
and comfired reproducer and didn’t trigger any crashes.
I notice maybe this bug is duplicated with
https://syzkaller.appspot.com/bug?extid=98edc2df894917b3431f and
https://syzkaller.appspot.com/bug?extid=c6d438f2d77f96cae7c2.
Should we need to close or tag duplicated or fix to them?

Ok, I'll try.

Best Regards,
xingwei lee