KASAN: use-after-free Read in link_path_walk

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: e12a9c44 ANDROID: sdcardfs: Move default_normal to superbl..
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=14e34e79800000
kernel config: https://syzkaller.appspot.com/x/.config?x=12d05663835d3b08
dashboard link: https://syzkaller.appspot.com/bug?extid=4d1dc90e012e64f401ef
compiler: gcc (GCC) 7.1.1 20170620
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1205d469800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=138e8179800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4d1dc9...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in link_path_walk+0x104f/0x1220 fs/namei.c:2085
Read of size 4 at addr ffff8801cde66dc0 by task syzkaller724721/5985

CPU: 1 PID: 5985 Comm: syzkaller724721 Not tainted 4.9.77-ge12a9c4 #27
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
ffff8801cf6f7900 ffffffff81d941c9 ffffea0007379980 ffff8801cde66dc0
0000000000000000 ffff8801cde66dc0 ffff8801cf6f7cc0 ffff8801cf6f7938
ffffffff8153db93 ffff8801cde66dc0 0000000000000004 0000000000000000
Call Trace:
[<ffffffff81d941c9>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d941c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff8153db93>] print_address_description+0x73/0x280
mm/kasan/report.c:252
[<ffffffff8153e0b5>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff8153e0b5>] kasan_report+0x275/0x360 mm/kasan/report.c:408
[<ffffffff8153e1f4>] __asan_report_load4_noabort+0x14/0x20
mm/kasan/report.c:428
[<ffffffff815a006f>] link_path_walk+0x104f/0x1220 fs/namei.c:2085
[<ffffffff815a03fa>] path_lookupat+0x6a/0x3f0 fs/namei.c:2280
[<ffffffff815a2140>] do_o_path fs/namei.c:3491 [inline]
[<ffffffff815a2140>] path_openat+0x19c0/0x2910 fs/namei.c:3520
[<ffffffff815a6887>] do_filp_open+0x197/0x290 fs/namei.c:3566
[<ffffffff8156b082>] do_sys_open+0x352/0x4c0 fs/open.c:1072
[<ffffffff8167b2ad>] C_SYSC_openat fs/compat.c:1090 [inline]
[<ffffffff8167b2ad>] compat_SyS_openat+0x2d/0x40 fs/compat.c:1088
[<ffffffff81006fc7>] do_syscall_32_irqs_on arch/x86/entry/common.c:322
[inline]
[<ffffffff81006fc7>] do_fast_syscall_32+0x2f7/0x890
arch/x86/entry/common.c:384
[<ffffffff838b44b4>] entry_SYSENTER_compat+0x74/0x83
arch/x86/entry/entry_64_compat.S:127

Allocated by task 5983:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:505
set_track mm/kasan/kasan.c:517 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:609
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
slab_post_alloc_hook mm/slab.h:417 [inline]
slab_alloc_node mm/slub.c:2715 [inline]
slab_alloc mm/slub.c:2723 [inline]
kmem_cache_alloc+0xba/0x290 mm/slub.c:2728
__d_alloc+0x2e/0x8f0 fs/dcache.c:1593
d_make_root+0x3f/0x80 fs/dcache.c:1882
ramfs_fill_super+0x35f/0x4a0 fs/ramfs/inode.c:233
mount_nodev+0x59/0x100 fs/super.c:1142
ramfs_mount+0x2c/0x40 fs/ramfs/inode.c:243
mount_fs+0x27f/0x350 fs/super.c:1202
vfs_kern_mount.part.21+0xd0/0x3e0 fs/namespace.c:991
vfs_kern_mount fs/namespace.c:2509 [inline]
do_new_mount fs/namespace.c:2512 [inline]
do_mount+0x3e1/0x28b0 fs/namespace.c:2834
C_SYSC_mount fs/compat.c:810 [inline]
compat_SyS_mount+0xd0/0x1070 fs/compat.c:775
do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
entry_SYSENTER_compat+0x74/0x83 arch/x86/entry/entry_64_compat.S:127

Freed by task 5983:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:505
set_track mm/kasan/kasan.c:517 [inline]
kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2958 [inline]
kmem_cache_free+0xc7/0x300 mm/slub.c:2980
__d_free fs/dcache.c:265 [inline]
dentry_free+0xd5/0x150 fs/dcache.c:341
__dentry_kill+0x343/0x480 fs/dcache.c:579
dentry_kill fs/dcache.c:606 [inline]
dput.part.23+0x680/0x7b0 fs/dcache.c:818
dput fs/dcache.c:780 [inline]
do_one_tree+0x43/0x50 fs/dcache.c:1476
shrink_dcache_for_umount+0x67/0x160 fs/dcache.c:1490
generic_shutdown_super+0x6d/0x340 fs/super.c:422
kill_anon_super fs/super.c:964 [inline]
kill_litter_super+0x72/0x90 fs/super.c:974
ramfs_kill_sb+0x3f/0x50 fs/ramfs/inode.c:249
deactivate_locked_super+0x88/0xd0 fs/super.c:310
deactivate_super+0x91/0xd0 fs/super.c:341
cleanup_mnt+0xb2/0x160 fs/namespace.c:1133
__cleanup_mnt+0x16/0x20 fs/namespace.c:1140
task_work_run+0x115/0x190 kernel/task_work.c:116
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0xfc/0x120 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:190 [inline]
syscall_return_slowpath arch/x86/entry/common.c:259 [inline]
do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline]
do_fast_syscall_32+0x5de/0x890 arch/x86/entry/common.c:384
entry_SYSENTER_compat+0x74/0x83 arch/x86/entry/entry_64_compat.S:127

The buggy address belongs to the object at ffff8801cde66dc0
which belongs to the cache dentry of size 288
The buggy address is located 0 bytes inside of
288-byte region [ffff8801cde66dc0, ffff8801cde66ee0)
The buggy address belongs to the page:
page:ffffea0007379980 count:1 mapcount:0 mapping: (null) index:0x0
compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801cde66c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801cde66d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8801cde66d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8801cde66e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801cde66e80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 7961b130 ANDROID: revert all remaining hisi_thermal.c chan..
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=14fbeedb400000
kernel config: https://syzkaller.appspot.com/x/.config?x=8635b07ba72cc81f
dashboard link: https://syzkaller.appspot.com/bug?extid=06525691b89d90ab1f75
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15c9c28b400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+065256...@syzkaller.appspotmail.com

audit: type=1400 audit(1544659794.182:10): avc: denied { associate } for
pid=4223 comm="syz-executor3" name="file0"
scontext=unconfined_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
==================================================================
BUG: KASAN: use-after-free in link_path_walk+0xd2c/0xf90 fs/namei.c:2118
Read of size 1 at addr ffff8881c8ef446a by task syz-executor0/5614

CPU: 1 PID: 5614 Comm: syz-executor0 Not tainted 4.14.87+ #22
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x11b lib/dump_stack.c:53
print_address_description+0x60/0x22b mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report.cold.6+0x11b/0x2dd mm/kasan/report.c:409
link_path_walk+0xd2c/0xf90 fs/namei.c:2118
path_lookupat.isra.11+0x1f0/0x890 fs/namei.c:2356
filename_lookup.part.19+0x177/0x370 fs/namei.c:2391
filename_lookup fs/namei.c:2384 [inline]
user_path_at_empty+0x4b/0x80 fs/namei.c:2652
user_path include/linux/namei.h:62 [inline]
do_mount+0x12c/0x26e0 fs/namespace.c:2843
SYSC_mount fs/namespace.c:3119 [inline]
SyS_mount+0xe5/0x100 fs/namespace.c:3096
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457679
RSP: 002b:00007f53c1024c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457679
RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000200000 R11: 0000000000000246 R12: 00007f53c10256d4
R13: 00000000004c2e25 R14: 00000000004d5200 R15: 00000000ffffffff

Allocated by task 5620:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc.part.1+0x4f/0xd0 mm/kasan/kasan.c:551
slab_post_alloc_hook mm/slab.h:442 [inline]
slab_alloc_node mm/slub.c:2723 [inline]
slab_alloc mm/slub.c:2731 [inline]
__kmalloc_track_caller+0x104/0x300 mm/slub.c:4288
kstrdup+0x35/0x70 mm/util.c:56
bpf_symlink+0x21/0x120 kernel/bpf/inode.c:200
vfs_symlink2+0x321/0x550 fs/namei.c:4208
SYSC_symlinkat fs/namei.c:4241 [inline]
SyS_symlinkat+0x110/0x1e0 fs/namei.c:4221
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 5624:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:524
slab_free_hook mm/slub.c:1389 [inline]
slab_free_freelist_hook mm/slub.c:1410 [inline]
slab_free mm/slub.c:2966 [inline]
kfree+0xf5/0x310 mm/slub.c:3897
bpf_evict_inode+0x102/0x130 kernel/bpf/inode.c:381
evict+0x2cb/0x5f0 fs/inode.c:554
iput_final fs/inode.c:1516 [inline]
iput+0x373/0x8e0 fs/inode.c:1543
do_unlinkat+0x4bf/0x650 fs/namei.c:4150
do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff8881c8ef4468
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes inside of
8-byte region [ffff8881c8ef4468, ffff8881c8ef4470)

The buggy address belongs to the page:

page:ffffea000723bd00 count:1 mapcount:0 mapping: (null) index:0x0
flags: 0x4000000000000100(slab)
raw: 4000000000000100 0000000000000000 0000000000000000 0000000100aa00aa
raw: 0000000000000000 0000000100000001 ffff8881da803c00 0000000000000000

page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff8881c8ef4300: fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb
ffff8881c8ef4380: fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc
> ffff8881c8ef4400: fc fb fc fc fb fc fc fb fc fc 00 fc fc fb fc fc
^
ffff8881c8ef4480: fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb
ffff8881c8ef4500: fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc