[Android 6.1] KASAN: use-after-free Write in virtio_transport_recv_pkt

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: af361f9a1066 UPSTREAM: usb: typec: Return size of buffer i..
git tree: android14-6.1
console output: https://syzkaller.appspot.com/x/log.txt?x=1191b6d3180000
kernel config: https://syzkaller.appspot.com/x/.config?x=7bd1a415c6de5d9d
dashboard link: https://syzkaller.appspot.com/bug?extid=9d13849d0e9e0ec75d47
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c11489180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a6968d180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/db7f428f19ce/disk-af361f9a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f1e9b109bbcc/vmlinux-af361f9a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c386b5dd8141/bzImage-af361f9a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9d1384...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline]
BUG: KASAN: use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x97/0x1b0 kernel/locking/spinlock.c:178
Write of size 4 at addr ffff88812648c708 by task kworker/0:0/6

CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted 6.1.75-syzkaller-00112-gaf361f9a1066 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: vsock-loopback vsock_loopback_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x158/0x4e0 mm/kasan/report.c:427
kasan_report+0x13c/0x170 mm/kasan/report.c:531
kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189
__kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
do_raw_spin_lock include/linux/spinlock.h:186 [inline]
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
_raw_spin_lock_bh+0x97/0x1b0 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
virtio_transport_space_update net/vmw_vsock/virtio_transport_common.c:1171 [inline]
virtio_transport_recv_pkt+0x6d3/0x4130 net/vmw_vsock/virtio_transport_common.c:1307
vsock_loopback_work+0x37d/0x3f0 net/vmw_vsock/vsock_loopback.c:137
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299
worker_thread+0xa60/0x1260 kernel/workqueue.c:2446
kthread+0x26d/0x300 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>

Allocated by task 5525:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:379 [inline]
__kasan_kmalloc+0x9c/0xb0 mm/kasan/common.c:388
kasan_kmalloc include/linux/kasan.h:212 [inline]
kmalloc_trace+0x44/0xa0 mm/slab_common.c:1052
kmalloc include/linux/slab.h:553 [inline]
kzalloc include/linux/slab.h:689 [inline]
virtio_transport_do_socket_init+0x56/0x2d0 net/vmw_vsock/virtio_transport_common.c:604
vsock_assign_transport+0x473/0x5b0 net/vmw_vsock/af_vsock.c:506
vsock_connect+0x5cf/0xd30 net/vmw_vsock/af_vsock.c:1361
__sys_connect_file net/socket.c:1996 [inline]
__sys_connect+0x2c9/0x300 net/socket.c:2013
__do_sys_connect net/socket.c:2023 [inline]
__se_sys_connect net/socket.c:2020 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:2020
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 5525:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
kasan_slab_free include/linux/kasan.h:178 [inline]
slab_free_hook mm/slub.c:1745 [inline]
slab_free_freelist_hook mm/slub.c:1771 [inline]
slab_free mm/slub.c:3684 [inline]
__kmem_cache_free+0x218/0x3b0 mm/slub.c:3697
kfree+0x7a/0xf0 mm/slab_common.c:1009
virtio_transport_destruct+0x3b/0x40 net/vmw_vsock/virtio_transport_common.c:815
vsock_deassign_transport net/vmw_vsock/af_vsock.c:421 [inline]
vsock_assign_transport+0x32b/0x5b0 net/vmw_vsock/af_vsock.c:489
vsock_connect+0x5cf/0xd30 net/vmw_vsock/af_vsock.c:1361
__sys_connect_file net/socket.c:1996 [inline]
__sys_connect+0x2c9/0x300 net/socket.c:2013
__do_sys_connect net/socket.c:2023 [inline]
__se_sys_connect net/socket.c:2020 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:2020
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff88812648c700
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 8 bytes inside of
96-byte region [ffff88812648c700, ffff88812648c760)

The buggy address belongs to the physical page:
page:ffffea0004992300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12648c
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042900
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5505, tgid 5502 (syz-executor910), ts 37651836797, free_ts 37651758845
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x213/0x220 mm/page_alloc.c:2566
prep_new_page+0x1b/0x110 mm/page_alloc.c:2573
get_page_from_freelist+0x27ea/0x2870 mm/page_alloc.c:4397
__alloc_pages+0x3a1/0x780 mm/page_alloc.c:5684
alloc_slab_page+0x6c/0xf0
allocate_slab mm/slub.c:1962 [inline]
new_slab+0x90/0x3e0 mm/slub.c:2015
___slab_alloc+0x6f9/0xb80 mm/slub.c:3203
__slab_alloc+0x5d/0xa0 mm/slub.c:3302
slab_alloc_node mm/slub.c:3387 [inline]
__kmem_cache_alloc_node+0x1af/0x250 mm/slub.c:3460
kmalloc_trace+0x2a/0xa0 mm/slab_common.c:1047
kmalloc include/linux/slab.h:553 [inline]
kzalloc include/linux/slab.h:689 [inline]
virtio_transport_alloc_pkt+0x6a/0xa10 net/vmw_vsock/virtio_transport_common.c:55
virtio_transport_send_pkt_info+0x2c8/0x630 net/vmw_vsock/virtio_transport_common.c:231
virtio_transport_shutdown net/vmw_vsock/virtio_transport_common.c:781 [inline]
virtio_transport_close net/vmw_vsock/virtio_transport_common.c:961 [inline]
virtio_transport_release+0x2df/0xc30 net/vmw_vsock/virtio_transport_common.c:984
__vsock_release+0x86/0x4b0 net/vmw_vsock/af_vsock.c:814
vsock_release+0x42/0xa0 net/vmw_vsock/af_vsock.c:901
__sock_release net/socket.c:652 [inline]
sock_close+0xdf/0x270 net/socket.c:1390
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1474 [inline]
free_pcp_prepare mm/page_alloc.c:1548 [inline]
free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3470
free_unref_page+0xb2/0x5c0 mm/page_alloc.c:3566
free_the_page mm/page_alloc.c:774 [inline]
__free_pages+0x61/0xf0 mm/page_alloc.c:5773
free_pages+0x7c/0x90 mm/page_alloc.c:5784
_pgd_free arch/x86/mm/pgtable.c:420 [inline]
pgd_free+0x17d/0x190 arch/x86/mm/pgtable.c:476
mm_free_pgd kernel/fork.c:833 [inline]
__mmdrop+0xb0/0x3e0 kernel/fork.c:884
mmdrop include/linux/sched/mm.h:50 [inline]
__mmput+0x304/0x310 kernel/fork.c:1309
mmput+0x56/0x170 kernel/fork.c:1321
exit_mm kernel/exit.c:566 [inline]
do_exit+0xb29/0x2b80 kernel/exit.c:862
do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
get_signal+0x169d/0x1820 kernel/signal.c:2879
arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:168
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87

Memory state around the buggy address:
ffff88812648c600: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88812648c680: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff88812648c700: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff88812648c780: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88812648c800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e7daca75b4c3 ANDROID: GKI: db845c: Update symbols list and..
git tree: android13-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=1116968d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=1a6e39f6bdc97aed
dashboard link: https://syzkaller.appspot.com/bug?extid=17bca7383bb232a9c969

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16de0de3180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f83ed3180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cec0e413e034/disk-e7daca75.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e97d4453b5ff/vmlinux-e7daca75.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3d97ddfb5394/bzImage-e7daca75.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+17bca7...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:705 [inline]
BUG: KASAN: use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:183 [inline]
BUG: KASAN: use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x97/0x1b0 kernel/locking/spinlock.c:175
Write of size 4 at addr ffff88811505e788 by task kworker/1:2/325

CPU: 1 PID: 325 Comm: kworker/1:2 Not tainted 5.10.209-syzkaller-00001-ge7daca75b4c3 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: vsock-loopback vsock_loopback_work
Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x81/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:435 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:452
kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189
__kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:705 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
do_raw_spin_lock include/linux/spinlock.h:183 [inline]
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
_raw_spin_lock_bh+0x97/0x1b0 kernel/locking/spinlock.c:175
spin_lock_bh include/linux/spinlock.h:359 [inline]
virtio_transport_space_update net/vmw_vsock/virtio_transport_common.c:1040 [inline]
virtio_transport_recv_pkt+0x665/0x4130 net/vmw_vsock/virtio_transport_common.c:1164
vsock_loopback_work+0x37d/0x3f0 net/vmw_vsock/vsock_loopback.c:125
process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301
worker_thread+0xaea/0x1510 kernel/workqueue.c:2447
kthread+0x34b/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299

Allocated by task 3447:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:430 [inline]
____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:509
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:518
kasan_kmalloc include/linux/kasan.h:254 [inline]
kmem_cache_alloc_trace+0x18a/0x2e0 mm/slub.c:2974
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
virtio_transport_do_socket_init+0x56/0x2d0 net/vmw_vsock/virtio_transport_common.c:475
vsock_assign_transport+0x324/0x3f0 net/vmw_vsock/af_vsock.c:470
vsock_stream_connect+0x5cf/0xd30 net/vmw_vsock/af_vsock.c:1297
__sys_connect_file net/socket.c:1866 [inline]
__sys_connect+0x388/0x410 net/socket.c:1883
__do_sys_connect net/socket.c:1893 [inline]
__se_sys_connect net/socket.c:1890 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:1890
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xc6

Freed by task 3447:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
kasan_slab_free include/linux/kasan.h:220 [inline]
slab_free_hook mm/slub.c:1595 [inline]
slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621
slab_free mm/slub.c:3203 [inline]
kfree+0xc3/0x270 mm/slub.c:4191
virtio_transport_destruct+0x3b/0x40 net/vmw_vsock/virtio_transport_common.c:693
vsock_deassign_transport net/vmw_vsock/af_vsock.c:411 [inline]
vsock_assign_transport+0x266/0x3f0 net/vmw_vsock/af_vsock.c:461
vsock_stream_connect+0x5cf/0xd30 net/vmw_vsock/af_vsock.c:1297
__sys_connect_file net/socket.c:1866 [inline]
__sys_connect+0x388/0x410 net/socket.c:1883
__do_sys_connect net/socket.c:1893 [inline]
__se_sys_connect net/socket.c:1890 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:1890
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xc6

The buggy address belongs to the object at ffff88811505e780
which belongs to the cache kmalloc-64 of size 64

The buggy address is located 8 bytes inside of

64-byte region [ffff88811505e780, ffff88811505e7c0)
The buggy address belongs to the page:
page:ffffea0004541780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11505e
flags: 0x4000000000000200(slab)
raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100043800
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 280, ts 22356318178, free_ts 22340792038
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook mm/page_alloc.c:2456 [inline]
prep_new_page+0x166/0x180 mm/page_alloc.c:2462
get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4254
__alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5346
allocate_slab mm/slub.c:1808 [inline]
new_slab+0x80/0x400 mm/slub.c:1869
new_slab_objects mm/slub.c:2627 [inline]
___slab_alloc+0x302/0x4b0 mm/slub.c:2791
__slab_alloc+0x63/0xa0 mm/slub.c:2831
slab_alloc_node mm/slub.c:2913 [inline]
slab_alloc mm/slub.c:2955 [inline]
__kmalloc+0x204/0x330 mm/slub.c:4029
kmalloc include/linux/slab.h:557 [inline]
kzalloc include/linux/slab.h:664 [inline]
ext4_htree_store_dirent+0x7f/0x590 fs/ext4/dir.c:475
htree_dirblock_to_tree+0x8f7/0x1080 fs/ext4/namei.c:1115
ext4_htree_fill_tree+0x73d/0x13e0 fs/ext4/namei.c:1194
ext4_dx_readdir fs/ext4/dir.c:598 [inline]
ext4_readdir+0x2dde/0x37c0 fs/ext4/dir.c:142
iterate_dir+0x265/0x580
__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64+0x1c1/0x460 fs/readdir.c:354
__x64_sys_getdents64+0x7b/0x90 fs/readdir.c:354
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xc6

page last free stack trace:

reset_page_owner include/linux/page_owner.h:28 [inline]
free_pages_prepare mm/page_alloc.c:1349 [inline]
__free_pages_ok+0x82c/0x850 mm/page_alloc.c:1629
free_the_page+0x76/0x370 mm/page_alloc.c:5407
__free_pages+0x67/0xc0 mm/page_alloc.c:5416
__free_slab+0xcf/0x190 mm/slub.c:1894
free_slab mm/slub.c:1909 [inline]
discard_slab mm/slub.c:1915 [inline]
unfreeze_partials+0x15e/0x190 mm/slub.c:2410
put_cpu_partial+0xbf/0x180 mm/slub.c:2446
__slab_free+0x2c8/0x3a0 mm/slub.c:3095
do_slab_free mm/slub.c:3191 [inline]
___cache_free+0x111/0x130 mm/slub.c:3210
qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
qlist_free_all+0x47/0xb0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x15a/0x170 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
kasan_slab_alloc include/linux/kasan.h:244 [inline]
slab_post_alloc_hook+0x61/0x2f0 mm/slab.h:583
slab_alloc_node mm/slub.c:2947 [inline]
slab_alloc mm/slub.c:2955 [inline]
kmem_cache_alloc+0x168/0x2e0 mm/slub.c:2960
ext4_alloc_inode+0x21/0x640 fs/ext4/super.c:1279
alloc_inode fs/inode.c:233 [inline]
new_inode_pseudo+0x64/0x220 fs/inode.c:929

Memory state around the buggy address:

ffff88811505e680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88811505e700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88811505e780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88811505e800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88811505e880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 993bed180178 Merge "Merge branch 'android13-5.15' into bra..
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=13ae333d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=49ce29477ba81e8f
dashboard link: https://syzkaller.appspot.com/bug?extid=32815254c2c59b9b3d88

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145a4c89180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12bab0de180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4098d24d4c8b/disk-993bed18.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94fbc07ac02d/vmlinux-993bed18.xz
kernel image: https://storage.googleapis.com/syzbot-assets/eed14de06c19/bzImage-993bed18.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+328152...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]

BUG: KASAN: use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:511 [inline]

BUG: KASAN: use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]

BUG: KASAN: use-after-free in do_raw_spin_lock include/linux/spinlock.h:187 [inline]

BUG: KASAN: use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]

BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x97/0x1b0 kernel/locking/spinlock.c:178
Write of size 4 at addr ffff888122444308 by task kworker/1:1/39

CPU: 1 PID: 39 Comm: kworker/1:1 Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: vsock-loopback vsock_loopback_work
Call Trace:

<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106

print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444

kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189
__kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]

atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:511 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
do_raw_spin_lock include/linux/spinlock.h:187 [inline]
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
_raw_spin_lock_bh+0x97/0x1b0 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:368 [inline]
virtio_transport_space_update net/vmw_vsock/virtio_transport_common.c:1174 [inline]
virtio_transport_recv_pkt+0x6d0/0x4160 net/vmw_vsock/virtio_transport_common.c:1310
vsock_loopback_work+0x37d/0x3f0 net/vmw_vsock/vsock_loopback.c:137
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
kthread+0x421/0x510 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>

Allocated by task 18371:

kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]

set_alloc_info mm/kasan/common.c:433 [inline]
____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
kasan_kmalloc include/linux/kasan.h:227 [inline]
kmem_cache_alloc_trace+0x115/0x210 mm/slub.c:3267
kmalloc include/linux/slab.h:603 [inline]
kzalloc include/linux/slab.h:733 [inline]
virtio_transport_do_socket_init+0x56/0x2d0 net/vmw_vsock/virtio_transport_common.c:604
vsock_assign_transport+0x473/0x5b0 net/vmw_vsock/af_vsock.c:496
vsock_connect+0x5cf/0xd30 net/vmw_vsock/af_vsock.c:1340
__sys_connect_file net/socket.c:1918 [inline]
__sys_connect+0x38b/0x410 net/socket.c:1935
__do_sys_connect net/socket.c:1945 [inline]
__se_sys_connect net/socket.c:1942 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:1942
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 18371:

kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370

____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
kasan_slab_free include/linux/kasan.h:193 [inline]
slab_free_hook mm/slub.c:1723 [inline]
slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749
slab_free mm/slub.c:3519 [inline]
kfree+0xc8/0x220 mm/slub.c:4579
virtio_transport_destruct+0x3b/0x40 net/vmw_vsock/virtio_transport_common.c:818
vsock_deassign_transport net/vmw_vsock/af_vsock.c:411 [inline]
vsock_assign_transport+0x32b/0x5b0 net/vmw_vsock/af_vsock.c:479
vsock_connect+0x5cf/0xd30 net/vmw_vsock/af_vsock.c:1340
__sys_connect_file net/socket.c:1918 [inline]
__sys_connect+0x38b/0x410 net/socket.c:1935
__do_sys_connect net/socket.c:1945 [inline]
__se_sys_connect net/socket.c:1942 [inline]
__x64_sys_connect+0x7a/0x90 net/socket.c:1942
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888122444300
which belongs to the cache kmalloc-96 of size 96

The buggy address is located 8 bytes inside of

96-byte region [ffff888122444300, ffff888122444360)

The buggy address belongs to the page:

page:ffffea0004891100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122444
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 0000001f00000001 ffff888100042900
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 290, ts 29441834490, free_ts 29441365925
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2604
prep_new_page+0x1b/0x110 mm/page_alloc.c:2610
get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4484
__alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5776
allocate_slab mm/slub.c:1932 [inline]
new_slab+0x9a/0x4e0 mm/slub.c:1995
___slab_alloc+0x39e/0x830 mm/slub.c:3028
__slab_alloc+0x4a/0x90 mm/slub.c:3115
slab_alloc_node mm/slub.c:3206 [inline]
slab_alloc mm/slub.c:3248 [inline]
kmem_cache_alloc_trace+0x142/0x210 mm/slub.c:3265
kmalloc include/linux/slab.h:603 [inline]
kzalloc include/linux/slab.h:733 [inline]
mmu_notifier_subscriptions_init include/linux/mmu_notifier.h:516 [inline]
mm_init+0x39a/0x970 kernel/fork.c:1122
dup_mm kernel/fork.c:1518 [inline]
copy_mm+0x1e3/0x13e0 kernel/fork.c:1573
copy_process+0x1149/0x3290 kernel/fork.c:2264
kernel_clone+0x21e/0x9e0 kernel/fork.c:2662
__do_sys_clone kernel/fork.c:2788 [inline]
__se_sys_clone kernel/fork.c:2772 [inline]
__x64_sys_clone+0x23f/0x290 kernel/fork.c:2772
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

page last free stack trace:

reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1471 [inline]
free_pcp_prepare mm/page_alloc.c:1543 [inline]
free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3533
free_unref_page+0xe8/0x750 mm/page_alloc.c:3615
free_the_page mm/page_alloc.c:804 [inline]
__free_pages+0x61/0xf0 mm/page_alloc.c:5852
__vunmap+0x7bc/0x8f0 mm/vmalloc.c:2652
free_work+0x5b/0x80 mm/vmalloc.c:96
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
kthread+0x421/0x510 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Memory state around the buggy address:

ffff888122444200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888122444280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff888122444300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888122444380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888122444400: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc