[Android 5.4] KASAN: null-ptr-deref Read in tcf_idrinfo_destroy
7 views
Skip to first unread message
syzbot
May 10, 2023, 6:23:52 PM5/10/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 0fcb7cff9462 FROMLIST: binder: fix UAF caused by faulty bu..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=126f6a1a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=84089d0b2f342aac
dashboard link: https://syzkaller.appspot.com/bug?extid=cf9750784f3e766f0fee
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1330a946280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15422efa280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a4240b24dffa/disk-0fcb7cff.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/96c15aa5930e/vmlinux-0fcb7cff.xz
kernel image: https://storage.googleapis.com/syzbot-assets/91baaef27b83/bzImage-0fcb7cff.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cf9750...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: null-ptr-deref in __tcf_idr_release net/sched/act_api.c:162 [inline]
BUG: KASAN: null-ptr-deref in tcf_idrinfo_destroy+0xe2/0x280 net/sched/act_api.c:541
Read of size 4 at addr 0000000000000010 by task kworker/u4:2/179
CPU: 1 PID: 179 Comm: kworker/u4:2 Not tainted 5.4.233-syzkaller-00001-g0fcb7cff9462 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d8/0x241 lib/dump_stack.c:118
__kasan_report+0xe9/0x120 mm/kasan/report.c:520
kasan_report+0x30/0x60 mm/kasan/common.c:653
check_memory_region_inline mm/kasan/generic.c:141 [inline]
check_memory_region+0x272/0x280 mm/kasan/generic.c:191
atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
__tcf_idr_release net/sched/act_api.c:162 [inline]
tcf_idrinfo_destroy+0xe2/0x280 net/sched/act_api.c:541
tc_action_net_exit include/net/act_api.h:145 [inline]
police_exit_net+0xd7/0x140 net/sched/act_police.c:410
ops_exit_list net/core/net_namespace.c:184 [inline]
cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
process_one_work+0x765/0xd20 kernel/workqueue.c:2287
worker_thread+0xaef/0x1470 kernel/workqueue.c:2433
kthread+0x2da/0x360 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 179 Comm: kworker/u4:2 Tainted: G B 5.4.233-syzkaller-00001-g0fcb7cff9462 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline]
RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
RIP: 0010:__tcf_idr_release net/sched/act_api.c:162 [inline]
RIP: 0010:tcf_idrinfo_destroy+0xe9/0x280 net/sched/act_api.c:541
Code: ee e8 1b 3f b6 00 48 85 c0 0f 84 54 01 00 00 49 89 c6 48 8d 58 20 48 89 df be 04 00 00 00 e8 fe 5a 02 fe 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 f5 00 00 00 8b 1b 31 ff 89 de e8 6f d2
RSP: 0018:ffff8881e480fb60 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff8881e9953f00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff
RBP: ffff8881e480fc30 R08: ffffffff813adf25 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff1103c901f78
R13: ffff8881e480fbc0 R14: fffffffffffffff0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4a317938 CR3: 00000001edef1000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tc_action_net_exit include/net/act_api.h:145 [inline]
police_exit_net+0xd7/0x140 net/sched/act_police.c:410
ops_exit_list net/core/net_namespace.c:184 [inline]
cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
process_one_work+0x765/0xd20 kernel/workqueue.c:2287
worker_thread+0xaef/0x1470 kernel/workqueue.c:2433
kthread+0x2da/0x360 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
Modules linked in:
---[ end trace b7a5f0e1693cba5b ]---
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline]
RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
RIP: 0010:__tcf_idr_release net/sched/act_api.c:162 [inline]
RIP: 0010:tcf_idrinfo_destroy+0xe9/0x280 net/sched/act_api.c:541
Code: ee e8 1b 3f b6 00 48 85 c0 0f 84 54 01 00 00 49 89 c6 48 8d 58 20 48 89 df be 04 00 00 00 e8 fe 5a 02 fe 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 f5 00 00 00 8b 1b 31 ff 89 de e8 6f d2
RSP: 0018:ffff8881e480fb60 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff8881e9953f00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff
RBP: ffff8881e480fc30 R08: ffffffff813adf25 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff1103c901f78
R13: ffff8881e480fbc0 R14: fffffffffffffff0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4a317938 CR3: 00000001ed679000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: ee out %al,(%dx)
1: e8 1b 3f b6 00 callq 0xb63f21
6: 48 85 c0 test %rax,%rax
9: 0f 84 54 01 00 00 je 0x163
f: 49 89 c6 mov %rax,%r14
12: 48 8d 58 20 lea 0x20(%rax),%rbx
16: 48 89 df mov %rbx,%rdi
19: be 04 00 00 00 mov $0x4,%esi
1e: e8 fe 5a 02 fe callq 0xfe025b21
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 f5 00 00 00 jne 0x12c
37: 8b 1b mov (%rbx),%ebx
39: 31 ff xor %edi,%edi
3b: 89 de mov %ebx,%esi
3d: e8 .byte 0xe8
3e: 6f outsl %ds:(%rsi),(%dx)
3f: d2 .byte 0xd2
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 0fcb7cff9462 FROMLIST: binder: fix UAF caused by faulty bu..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=126f6a1a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=84089d0b2f342aac
dashboard link: https://syzkaller.appspot.com/bug?extid=cf9750784f3e766f0fee
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1330a946280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15422efa280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a4240b24dffa/disk-0fcb7cff.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/96c15aa5930e/vmlinux-0fcb7cff.xz
kernel image: https://storage.googleapis.com/syzbot-assets/91baaef27b83/bzImage-0fcb7cff.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cf9750...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: null-ptr-deref in __tcf_idr_release net/sched/act_api.c:162 [inline]
BUG: KASAN: null-ptr-deref in tcf_idrinfo_destroy+0xe2/0x280 net/sched/act_api.c:541
Read of size 4 at addr 0000000000000010 by task kworker/u4:2/179
CPU: 1 PID: 179 Comm: kworker/u4:2 Not tainted 5.4.233-syzkaller-00001-g0fcb7cff9462 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d8/0x241 lib/dump_stack.c:118
__kasan_report+0xe9/0x120 mm/kasan/report.c:520
kasan_report+0x30/0x60 mm/kasan/common.c:653
check_memory_region_inline mm/kasan/generic.c:141 [inline]
check_memory_region+0x272/0x280 mm/kasan/generic.c:191
atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
__tcf_idr_release net/sched/act_api.c:162 [inline]
tcf_idrinfo_destroy+0xe2/0x280 net/sched/act_api.c:541
tc_action_net_exit include/net/act_api.h:145 [inline]
police_exit_net+0xd7/0x140 net/sched/act_police.c:410
ops_exit_list net/core/net_namespace.c:184 [inline]
cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
process_one_work+0x765/0xd20 kernel/workqueue.c:2287
worker_thread+0xaef/0x1470 kernel/workqueue.c:2433
kthread+0x2da/0x360 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 179 Comm: kworker/u4:2 Tainted: G B 5.4.233-syzkaller-00001-g0fcb7cff9462 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline]
RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
RIP: 0010:__tcf_idr_release net/sched/act_api.c:162 [inline]
RIP: 0010:tcf_idrinfo_destroy+0xe9/0x280 net/sched/act_api.c:541
Code: ee e8 1b 3f b6 00 48 85 c0 0f 84 54 01 00 00 49 89 c6 48 8d 58 20 48 89 df be 04 00 00 00 e8 fe 5a 02 fe 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 f5 00 00 00 8b 1b 31 ff 89 de e8 6f d2
RSP: 0018:ffff8881e480fb60 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff8881e9953f00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff
RBP: ffff8881e480fc30 R08: ffffffff813adf25 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff1103c901f78
R13: ffff8881e480fbc0 R14: fffffffffffffff0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4a317938 CR3: 00000001edef1000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tc_action_net_exit include/net/act_api.h:145 [inline]
police_exit_net+0xd7/0x140 net/sched/act_police.c:410
ops_exit_list net/core/net_namespace.c:184 [inline]
cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:609
process_one_work+0x765/0xd20 kernel/workqueue.c:2287
worker_thread+0xaef/0x1470 kernel/workqueue.c:2433
kthread+0x2da/0x360 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
Modules linked in:
---[ end trace b7a5f0e1693cba5b ]---
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline]
RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
RIP: 0010:__tcf_idr_release net/sched/act_api.c:162 [inline]
RIP: 0010:tcf_idrinfo_destroy+0xe9/0x280 net/sched/act_api.c:541
Code: ee e8 1b 3f b6 00 48 85 c0 0f 84 54 01 00 00 49 89 c6 48 8d 58 20 48 89 df be 04 00 00 00 e8 fe 5a 02 fe 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 f5 00 00 00 8b 1b 31 ff 89 de e8 6f d2
RSP: 0018:ffff8881e480fb60 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff8881e9953f00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff
RBP: ffff8881e480fc30 R08: ffffffff813adf25 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff1103c901f78
R13: ffff8881e480fbc0 R14: fffffffffffffff0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4a317938 CR3: 00000001ed679000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: ee out %al,(%dx)
1: e8 1b 3f b6 00 callq 0xb63f21
6: 48 85 c0 test %rax,%rax
9: 0f 84 54 01 00 00 je 0x163
f: 49 89 c6 mov %rax,%r14
12: 48 8d 58 20 lea 0x20(%rax),%rbx
16: 48 89 df mov %rbx,%rdi
19: be 04 00 00 00 mov $0x4,%esi
1e: e8 fe 5a 02 fe callq 0xfe025b21
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 f5 00 00 00 jne 0x12c
37: 8b 1b mov (%rbx),%ebx
39: 31 ff xor %edi,%edi
3b: 89 de mov %ebx,%esi
3d: e8 .byte 0xe8
3e: 6f outsl %ds:(%rsi),(%dx)
3f: d2 .byte 0xd2
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages