KASAN: use-after-free Read in tipc_mcast_xmit
10 views
Skip to first unread message
syzbot
Sep 29, 2020, 2:19:20 PM9/29/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 6fa60aa0 ANDROID: GKI: cputime: Export for thread_group_cp..
git tree: https://android.googlesource.com/kernel/common android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1269b237900000
kernel config: https://syzkaller.appspot.com/x/.config?x=280f7b0add2e0c6e
dashboard link: https://syzkaller.appspot.com/bug?extid=c429c30420ea837547cf
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c429c3...@syzkaller.appspotmail.com
R10: 0000000000200fc0 R11: 0000000000000246 R12: 0000000000000027
R13: 00007fffbe61159f R14: 00007f8f575079c0 R15: 000000000118bf2c
tipc: Failed do clone local mcast rcv buffer
==================================================================
BUG: KASAN: use-after-free in __skb_unlink include/linux/skbuff.h:2031 [inline]
BUG: KASAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2050 [inline]
BUG: KASAN: use-after-free in __skb_queue_purge include/linux/skbuff.h:2761 [inline]
BUG: KASAN: use-after-free in tipc_mcast_xmit+0x101f/0x1690 net/tipc/bcast.c:421
Read of size 8 at addr ffff8881d7012780 by task syz-executor.4/15963
CPU: 1 PID: 15963 Comm: syz-executor.4 Not tainted 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
__kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
kasan_report+0x27/0x50 mm/kasan/common.c:634
__skb_unlink include/linux/skbuff.h:2031 [inline]
__skb_dequeue include/linux/skbuff.h:2050 [inline]
__skb_queue_purge include/linux/skbuff.h:2761 [inline]
tipc_mcast_xmit+0x101f/0x1690 net/tipc/bcast.c:421
tipc_sendmcast+0xc00/0xeb0 net/tipc/socket.c:819
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45dd99
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8f57506c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045dd99
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 00007f8f57506ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000200fc0 R11: 0000000000000246 R12: 0000000000000027
R13: 00007fffbe61159f R14: 00007f8f575079c0 R15: 000000000118bf2c
Allocated by task 15963:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2793 [inline]
slab_alloc mm/slub.c:2801 [inline]
kmem_cache_alloc+0x1d5/0x250 mm/slub.c:2806
kmem_cache_alloc_node include/linux/slab.h:427 [inline]
__alloc_skb+0x88/0x4d0 net/core/skbuff.c:198
alloc_skb_fclone include/linux/skbuff.h:1107 [inline]
tipc_buf_acquire net/tipc/msg.c:66 [inline]
tipc_msg_build+0x727/0x1a60 net/tipc/msg.c:368
tipc_sendmcast+0x92a/0xeb0 net/tipc/socket.c:813
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 15963:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x168/0x220 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1443 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1476
slab_free mm/slub.c:3041 [inline]
kmem_cache_free+0xac/0x5c0 mm/slub.c:3057
tipc_buf_append+0x2d1/0xad0 net/tipc/msg.c:188
tipc_msg_reassemble+0x331/0x590 net/tipc/msg.c:726
tipc_mcast_xmit+0x223/0x1690 net/tipc/bcast.c:385
tipc_sendmcast+0xc00/0xeb0 net/tipc/socket.c:819
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881d7012780
which belongs to the cache skbuff_fclone_cache of size 488
The buggy address is located 0 bytes inside of
488-byte region [ffff8881d7012780, ffff8881d7012968)
The buggy address belongs to the page:
page:ffffea00075c0480 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea000592f500 0000000d0000000d ffff8881daa92a00
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d7012680: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff8881d7012700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881d7012780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d7012800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d7012880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle page fault for address: ffff88817d64c400
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0011) - permissions violation
PGD 6001067 P4D 6001067 PUD 17f07a063 PMD 800000017d6001e3
Oops: 0011 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15963 Comm: syz-executor.4 Tainted: G B 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffff88817d64c400
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> e1 0e c7 81 88 ff ff a3 a9 a4 fc 9f 55 00 00 00 00 00 00 00 00
RSP: 0018:ffff8881d47bee98 EFLAGS: 00010296
RAX: c935378c686f9e00 RBX: 1ffff1103b273b1c RCX: ffffffff83214a84
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881d939d880
RBP: 0000000000000000 R08: ffffffff83214a64 R09: 0000000000000007
R10: ffffed103b273b2d R11: 00000000000000fb R12: dffffc0000000000
R13: 1ffff1103b273b1b R14: ffff8881d939d880 R15: ffff8881d939d8e0
FS: 00007f8f57507700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88817d64c400 CR3: 00000001a0d34005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
CR2: ffff88817d64c400
---[ end trace fdddc2b7398a34de ]---
RIP: 0010:0xffff88817d64c400
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> e1 0e c7 81 88 ff ff a3 a9 a4 fc 9f 55 00 00 00 00 00 00 00 00
RSP: 0018:ffff8881d47bee98 EFLAGS: 00010296
RAX: c935378c686f9e00 RBX: 1ffff1103b273b1c RCX: ffffffff83214a84
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881d939d880
RBP: 0000000000000000 R08: ffffffff83214a64 R09: 0000000000000007
R10: ffffed103b273b2d R11: 00000000000000fb R12: dffffc0000000000
R13: 1ffff1103b273b1b R14: ffff8881d939d880 R15: ffff8881d939d8e0
FS: 00007f8f57507700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88817d64c400 CR3: 00000001a0d34005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 6fa60aa0 ANDROID: GKI: cputime: Export for thread_group_cp..
git tree: https://android.googlesource.com/kernel/common android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1269b237900000
kernel config: https://syzkaller.appspot.com/x/.config?x=280f7b0add2e0c6e
dashboard link: https://syzkaller.appspot.com/bug?extid=c429c30420ea837547cf
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c429c3...@syzkaller.appspotmail.com
R10: 0000000000200fc0 R11: 0000000000000246 R12: 0000000000000027
R13: 00007fffbe61159f R14: 00007f8f575079c0 R15: 000000000118bf2c
tipc: Failed do clone local mcast rcv buffer
==================================================================
BUG: KASAN: use-after-free in __skb_unlink include/linux/skbuff.h:2031 [inline]
BUG: KASAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2050 [inline]
BUG: KASAN: use-after-free in __skb_queue_purge include/linux/skbuff.h:2761 [inline]
BUG: KASAN: use-after-free in tipc_mcast_xmit+0x101f/0x1690 net/tipc/bcast.c:421
Read of size 8 at addr ffff8881d7012780 by task syz-executor.4/15963
CPU: 1 PID: 15963 Comm: syz-executor.4 Not tainted 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
__kasan_report+0x14b/0x1c0 mm/kasan/report.c:506
kasan_report+0x27/0x50 mm/kasan/common.c:634
__skb_unlink include/linux/skbuff.h:2031 [inline]
__skb_dequeue include/linux/skbuff.h:2050 [inline]
__skb_queue_purge include/linux/skbuff.h:2761 [inline]
tipc_mcast_xmit+0x101f/0x1690 net/tipc/bcast.c:421
tipc_sendmcast+0xc00/0xeb0 net/tipc/socket.c:819
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45dd99
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8f57506c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000027ec0 RCX: 000000000045dd99
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 00007f8f57506ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000200fc0 R11: 0000000000000246 R12: 0000000000000027
R13: 00007fffbe61159f R14: 00007f8f575079c0 R15: 000000000118bf2c
Allocated by task 15963:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2793 [inline]
slab_alloc mm/slub.c:2801 [inline]
kmem_cache_alloc+0x1d5/0x250 mm/slub.c:2806
kmem_cache_alloc_node include/linux/slab.h:427 [inline]
__alloc_skb+0x88/0x4d0 net/core/skbuff.c:198
alloc_skb_fclone include/linux/skbuff.h:1107 [inline]
tipc_buf_acquire net/tipc/msg.c:66 [inline]
tipc_msg_build+0x727/0x1a60 net/tipc/msg.c:368
tipc_sendmcast+0x92a/0xeb0 net/tipc/socket.c:813
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 15963:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x168/0x220 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1443 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1476
slab_free mm/slub.c:3041 [inline]
kmem_cache_free+0xac/0x5c0 mm/slub.c:3057
tipc_buf_append+0x2d1/0xad0 net/tipc/msg.c:188
tipc_msg_reassemble+0x331/0x590 net/tipc/msg.c:726
tipc_mcast_xmit+0x223/0x1690 net/tipc/bcast.c:385
tipc_sendmcast+0xc00/0xeb0 net/tipc/socket.c:819
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881d7012780
which belongs to the cache skbuff_fclone_cache of size 488
The buggy address is located 0 bytes inside of
488-byte region [ffff8881d7012780, ffff8881d7012968)
The buggy address belongs to the page:
page:ffffea00075c0480 refcount:1 mapcount:0 mapping:ffff8881daa92a00 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea000592f500 0000000d0000000d ffff8881daa92a00
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d7012680: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff8881d7012700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881d7012780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d7012800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881d7012880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle page fault for address: ffff88817d64c400
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0011) - permissions violation
PGD 6001067 P4D 6001067 PUD 17f07a063 PMD 800000017d6001e3
Oops: 0011 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15963 Comm: syz-executor.4 Tainted: G B 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffff88817d64c400
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> e1 0e c7 81 88 ff ff a3 a9 a4 fc 9f 55 00 00 00 00 00 00 00 00
RSP: 0018:ffff8881d47bee98 EFLAGS: 00010296
RAX: c935378c686f9e00 RBX: 1ffff1103b273b1c RCX: ffffffff83214a84
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881d939d880
RBP: 0000000000000000 R08: ffffffff83214a64 R09: 0000000000000007
R10: ffffed103b273b2d R11: 00000000000000fb R12: dffffc0000000000
R13: 1ffff1103b273b1b R14: ffff8881d939d880 R15: ffff8881d939d8e0
FS: 00007f8f57507700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88817d64c400 CR3: 00000001a0d34005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
CR2: ffff88817d64c400
---[ end trace fdddc2b7398a34de ]---
RIP: 0010:0xffff88817d64c400
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> e1 0e c7 81 88 ff ff a3 a9 a4 fc 9f 55 00 00 00 00 00 00 00 00
RSP: 0018:ffff8881d47bee98 EFLAGS: 00010296
RAX: c935378c686f9e00 RBX: 1ffff1103b273b1c RCX: ffffffff83214a84
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881d939d880
RBP: 0000000000000000 R08: ffffffff83214a64 R09: 0000000000000007
R10: ffffed103b273b2d R11: 00000000000000fb R12: dffffc0000000000
R13: 1ffff1103b273b1b R14: ffff8881d939d880 R15: ffff8881d939d8e0
FS: 00007f8f57507700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88817d64c400 CR3: 00000001a0d34005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Sep 29, 2020, 2:40:22 PM9/29/20
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 6fa60aa0 ANDROID: GKI: cputime: Export for thread_group_cp..
git tree: https://android.googlesource.com/kernel/common android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=16a07b3d900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1670458d900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c429c3...@syzkaller.appspotmail.com
RBP: 00007fffd8f835f0 R08: 0000000000000002 R09: 0000000600003034
R10: 0000000000200fc0 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
CPU: 0 PID: 344 Comm: syz-executor863 Not tainted 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
RIP: 0033:0x4443b9
Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8f83588 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004443b9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fffd8f835f0 R08: 0000000000000002 R09: 0000000600003034
R10: 0000000000200fc0 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 344:
Freed by task 344:
The buggy address belongs to the object at ffff8881c3085b80
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881daa93680
ffff8881c3085b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881c3085b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881c3085c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881c3085c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
CPU: 0 PID: 344 Comm: syz-executor863 Tainted: G B 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
RIP: 0010:__skb_unlink include/linux/skbuff.h:2034 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2050 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2761 [inline]
RIP: 0010:tipc_mcast_xmit+0x1061/0x1690 net/tipc/bcast.c:421
Code: af fd 4d 8b 67 08 4d 8d 6e 08 ba 10 00 00 00 4c 89 ff 31 f6 e8 f0 e6 ae fd 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 a1 11 af fd 4d 89 66 08 4c 89 e0 48
RSP: 0018:ffff8881cddfef00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8881cddff180 RCX: dffffc0000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881caeac210
RBP: ffff8881cddff0d0 R08: dffffc0000000000 R09: ffff8881caeac200
R10: ffffed10395d5842 R11: 00000000000000fb R12: ffff8881cddff180
R13: 0000000000000008 R14: 0000000000000000 R15: ffff8881caeac200
FS: 000000000199b940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8f83588 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004443b9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fffd8f835f0 R08: 0000000000000002 R09: 0000000600003034
R10: 0000000000200fc0 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
RSP: 0018:ffff8881cddfef00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8881cddff180 RCX: dffffc0000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881caeac210
RBP: ffff8881cddff0d0 R08: dffffc0000000000 R09: ffff8881caeac200
R10: ffffed10395d5842 R11: 00000000000000fb R12: ffff8881cddff180
R13: 0000000000000008 R14: 0000000000000000 R15: ffff8881caeac200
FS: 000000000199b940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
HEAD commit: 6fa60aa0 ANDROID: GKI: cputime: Export for thread_group_cp..
git tree: https://android.googlesource.com/kernel/common android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=280f7b0add2e0c6e
dashboard link: https://syzkaller.appspot.com/bug?extid=c429c30420ea837547cf
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16958c0f900000
dashboard link: https://syzkaller.appspot.com/bug?extid=c429c30420ea837547cf
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1670458d900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c429c3...@syzkaller.appspotmail.com
R10: 0000000000200fc0 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
tipc: Failed do clone local mcast rcv buffer
BUG: KASAN: use-after-free in __skb_unlink include/linux/skbuff.h:2031 [inline]
BUG: KASAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2050 [inline]
BUG: KASAN: use-after-free in __skb_queue_purge include/linux/skbuff.h:2761 [inline]
BUG: KASAN: use-after-free in tipc_mcast_xmit+0x101f/0x1690 net/tipc/bcast.c:421
Read of size 8 at addr ffff8881c3085b80 by task syz-executor863/344
BUG: KASAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2050 [inline]
BUG: KASAN: use-after-free in __skb_queue_purge include/linux/skbuff.h:2761 [inline]
BUG: KASAN: use-after-free in tipc_mcast_xmit+0x101f/0x1690 net/tipc/bcast.c:421
CPU: 0 PID: 344 Comm: syz-executor863 Not tainted 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8f83588 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004443b9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fffd8f835f0 R08: 0000000000000002 R09: 0000000600003034
R10: 0000000000200fc0 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 344:
which belongs to the cache skbuff_fclone_cache of size 488
The buggy address is located 0 bytes inside of
488-byte region [ffff8881c3085b80, ffff8881c3085d68)
The buggy address is located 0 bytes inside of
The buggy address belongs to the page:
page:ffffea00070c2100 refcount:1 mapcount:0 mapping:ffff8881daa93680 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881daa93680
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881c3085a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881c3085b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881c3085b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881c3085c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881c3085c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
CPU: 0 PID: 344 Comm: syz-executor863 Tainted: G B 5.4.68-syzkaller-00471-g6fa60aa03b21 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__write_once_size include/linux/compiler.h:226 [inline]
RIP: 0010:__skb_unlink include/linux/skbuff.h:2034 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2050 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2761 [inline]
RIP: 0010:tipc_mcast_xmit+0x1061/0x1690 net/tipc/bcast.c:421
Code: af fd 4d 8b 67 08 4d 8d 6e 08 ba 10 00 00 00 4c 89 ff 31 f6 e8 f0 e6 ae fd 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 a1 11 af fd 4d 89 66 08 4c 89 e0 48
RSP: 0018:ffff8881cddfef00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8881cddff180 RCX: dffffc0000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881caeac210
RBP: ffff8881cddff0d0 R08: dffffc0000000000 R09: ffff8881caeac200
R10: ffffed10395d5842 R11: 00000000000000fb R12: ffff8881cddff180
R13: 0000000000000008 R14: 0000000000000000 R15: ffff8881caeac200
FS: 000000000199b940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f20e8039028 CR3: 00000001d1404002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tipc_sendmcast+0xc00/0xeb0 net/tipc/socket.c:819
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4443b9
__tipc_sendmsg+0x120d/0x2ce0 net/tipc/socket.c:1357
tipc_sendmsg+0x51/0x70 net/tipc/socket.c:1290
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
kernel_sendmsg+0xe2/0x120 net/socket.c:678
sock_no_sendpage+0x13f/0x1b0 net/core/sock.c:2768
kernel_sendpage net/socket.c:3764 [inline]
sock_sendpage+0xd0/0x120 net/socket.c:936
pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
splice_from_pipe_feed fs/splice.c:500 [inline]
__splice_from_pipe+0x2d3/0x870 fs/splice.c:624
splice_from_pipe fs/splice.c:659 [inline]
generic_splice_sendpage+0x172/0x200 fs/splice.c:829
splice_direct_to_actor+0x496/0xb00 fs/splice.c:976
do_splice_direct+0x279/0x3d0 fs/splice.c:1064
do_sendfile+0x89d/0x1110 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ae/0x220 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8f83588 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004443b9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fffd8f835f0 R08: 0000000000000002 R09: 0000000600003034
R10: 0000000000200fc0 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
RSP: 0018:ffff8881cddfef00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8881cddff180 RCX: dffffc0000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881caeac210
RBP: ffff8881cddff0d0 R08: dffffc0000000000 R09: ffff8881caeac200
R10: ffffed10395d5842 R11: 00000000000000fb R12: ffff8881cddff180
R13: 0000000000000008 R14: 0000000000000000 R15: ffff8881caeac200
FS: 000000000199b940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f20e8039028 CR3: 00000001d1404002 CR4: 00000000001606f0
syzbot
Apr 17, 2023, 5:09:26 AM4/17/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages