netdev - Re: KASAN: use-after-free Write in kernfs_path_from_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJHvVcgshQpsHc7LbT9rj4VPCc0bL7Y3c_tGE0c5mUP5Q+8JjA@mail.gmail.com>
Date:   Mon, 30 Nov 2020 10:02:16 -0800
From:   Axel Rasmussen <axelrasmussen@...gle.com>
To:     syzbot <syzbot+19e6dd9943972fa1c58a@...kaller.appspotmail.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        "David S. Miller" <davem@...emloft.net>, dsahern@...nel.org,
        gregkh@...uxfoundation.org, kuba@...nel.org,
        LKML <linux-kernel@...r.kernel.org>, liuhangbin@...il.com,
        netdev@...r.kernel.org, sfr@...b.auug.org.au,
        syzkaller-bugs@...glegroups.com, tj@...nel.org,
        Vlastimil Babka <vbabka@...e.cz>
Subject: Re: KASAN: use-after-free Write in kernfs_path_from_node_locked

I spent some time looking into this:

I think there are actually two bugs here. The write-after-free in
kernfs_path_from_node_locked has an entirely different call trace
(towards the end of this log:
https://syzkaller.appspot.com/text?tag=CrashLog&x=16b1e0e9500000)
compared to the NULL pointer dereference in neigh_periodic_work crash.

For the neigh_periodic_work crash, I struggle to see how this is
related to 0f818c4bc1. It looks like what happens is at some point (I
haven't spotted where) we free struct neighbour->lock, and then later
when the workqueue calls into us we try to acquire it. I don't see any
connection between this code and 0f818c4bc1. The lock in question
isn't mmap_lock, but rather a separate lock owned by the struct
neighbour.

For the kernfs_path_from_node_locked crash, that one *does* look
related to 0f818c4bc1. I'll continue debugging and send a patch.

On Mon, Nov 30, 2020 at 5:08 AM syzbot
<syzbot+19e6dd9943972fa1c58a@...kaller.appspotmail.com> wrote:
>
> syzbot has bisected this issue to:
>
> commit 0f818c4bc1f3dc0d6d0ea916e0ab30cf5e75f4c0
> Author: Axel Rasmussen <axelrasmussen@...gle.com>
> Date:   Tue Nov 24 05:37:42 2020 +0000
>
>     mm: mmap_lock: add tracepoints around lock acquisition
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1626291d500000
> start commit:   6174f052 Add linux-next specific files for 20201127
> git tree:       linux-next
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=1526291d500000
> console output: https://syzkaller.appspot.com/x/log.txt?x=1126291d500000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=79c69cf2521bef9c
> dashboard link: https://syzkaller.appspot.com/bug?extid=19e6dd9943972fa1c58a
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12c3351d500000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14c28809500000
>
> Reported-by: syzbot+19e6dd9943972fa1c58a@...kaller.appspotmail.com
> Fixes: 0f818c4bc1f3 ("mm: mmap_lock: add tracepoints around lock acquisition")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection