KASAN: use-after-free Read in io_queue_link_head
20 views
Skip to first unread message
syzbot
Jan 22, 2021, 11:20:25 AM1/22/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 15cec007 UPSTREAM: selftests/seccomp: Update kernel config
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=10eb5bd0d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e50b6c748323589e
dashboard link: https://syzkaller.appspot.com/bug?extid=a4ce41cc542d66d69c89
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4ce41...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in io_queue_sqe fs/io_uring.c:2513 [inline]
BUG: KASAN: use-after-free in io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
Read of size 8 at addr ffff8881ec04add0 by task syz-executor.5/6582
CPU: 1 PID: 6582 Comm: syz-executor.5 Not tainted 5.4.91-syzkaller-00438-g15cec007c4a8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
io_queue_sqe fs/io_uring.c:2513 [inline]
io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff6d0876c68 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 00007ff6d0876ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fff74ce8c7f R14: 00007ff6d08779c0 R15: 000000000119bf8c
Allocated by task 6582:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
io_get_req+0x11b/0x5c0 fs/io_uring.c:644
io_submit_sqe+0x83/0xe90 fs/io_uring.c:2578
io_ring_submit fs/io_uring.c:2966 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0x8b6/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 6582:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
io_queue_sqe fs/io_uring.c:2512 [inline]
io_queue_link_head+0x364/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881ec04ad80
which belongs to the cache io_kiocb of size 264
The buggy address is located 80 bytes inside of
264-byte region [ffff8881ec04ad80, ffff8881ec04ae88)
The buggy address belongs to the page:
page:ffffea0007b01280 refcount:1 mapcount:0 mapping:ffff8881f4133b80 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f4133b80
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ec04ac80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881ec04ad00: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881ec04ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ec04ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ec04ae80: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 15cec007 UPSTREAM: selftests/seccomp: Update kernel config
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=10eb5bd0d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e50b6c748323589e
dashboard link: https://syzkaller.appspot.com/bug?extid=a4ce41cc542d66d69c89
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4ce41...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in io_queue_sqe fs/io_uring.c:2513 [inline]
BUG: KASAN: use-after-free in io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
Read of size 8 at addr ffff8881ec04add0 by task syz-executor.5/6582
CPU: 1 PID: 6582 Comm: syz-executor.5 Not tainted 5.4.91-syzkaller-00438-g15cec007c4a8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
io_queue_sqe fs/io_uring.c:2513 [inline]
io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff6d0876c68 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 00007ff6d0876ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fff74ce8c7f R14: 00007ff6d08779c0 R15: 000000000119bf8c
Allocated by task 6582:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
io_get_req+0x11b/0x5c0 fs/io_uring.c:644
io_submit_sqe+0x83/0xe90 fs/io_uring.c:2578
io_ring_submit fs/io_uring.c:2966 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0x8b6/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 6582:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
io_queue_sqe fs/io_uring.c:2512 [inline]
io_queue_link_head+0x364/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881ec04ad80
which belongs to the cache io_kiocb of size 264
The buggy address is located 80 bytes inside of
264-byte region [ffff8881ec04ad80, ffff8881ec04ae88)
The buggy address belongs to the page:
page:ffffea0007b01280 refcount:1 mapcount:0 mapping:ffff8881f4133b80 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f4133b80
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ec04ac80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881ec04ad00: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881ec04ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ec04ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ec04ae80: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Jan 22, 2021, 11:34:28 AM1/22/21
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 15cec007 UPSTREAM: selftests/seccomp: Update kernel config
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=110309a4d00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d9fb20d00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4ce41...@syzkaller.appspotmail.com
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441629
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
CPU: 0 PID: 360 Comm: syz-executor579 Not tainted 5.4.91-syzkaller-00438-g15cec007c4a8 #0
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd815bb618 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441629
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 360:
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f418c280
ffff8881e8c6ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881e8c70000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e8c70080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e8c70100: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
CPU: 0 PID: 360 Comm: syz-executor579 Tainted: G B 5.4.91-syzkaller-00438-g15cec007c4a8 #0
end_report mm/kasan/report.c:96 [inline]
__kasan_report+0x1e8/0x1f0 mm/kasan/report.c:513
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd815bb618 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441629
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
HEAD commit: 15cec007 UPSTREAM: selftests/seccomp: Update kernel config
git tree: android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=e50b6c748323589e
dashboard link: https://syzkaller.appspot.com/bug?extid=a4ce41cc542d66d69c89
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=104eafe7500000
dashboard link: https://syzkaller.appspot.com/bug?extid=a4ce41cc542d66d69c89
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d9fb20d00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4ce41...@syzkaller.appspotmail.com
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 00007ffd815bb640 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
BUG: KASAN: use-after-free in io_queue_sqe fs/io_uring.c:2513 [inline]
BUG: KASAN: use-after-free in io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
Read of size 8 at addr ffff8881e8c70050 by task syz-executor579/360
BUG: KASAN: use-after-free in io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
CPU: 0 PID: 360 Comm: syz-executor579 Not tainted 5.4.91-syzkaller-00438-g15cec007c4a8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
io_queue_sqe fs/io_uring.c:2513 [inline]
io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441629
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
io_queue_sqe fs/io_uring.c:2513 [inline]
io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd815bb618 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441629
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 00007ffd815bb640 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 360:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
io_get_req+0x11b/0x5c0 fs/io_uring.c:644
io_submit_sqe+0x83/0xe90 fs/io_uring.c:2578
io_ring_submit fs/io_uring.c:2966 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0x8b6/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 360:
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
io_get_req+0x11b/0x5c0 fs/io_uring.c:644
io_submit_sqe+0x83/0xe90 fs/io_uring.c:2578
io_ring_submit fs/io_uring.c:2966 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0x8b6/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
io_queue_sqe fs/io_uring.c:2512 [inline]
io_queue_link_head+0x364/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881e8c70000
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
io_queue_sqe fs/io_uring.c:2512 [inline]
io_queue_link_head+0x364/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
which belongs to the cache io_kiocb of size 264
The buggy address is located 80 bytes inside of
264-byte region [ffff8881e8c70000, ffff8881e8c70108)
The buggy address is located 80 bytes inside of
The buggy address belongs to the page:
page:ffffea0007a31c00 refcount:1 mapcount:0 mapping:ffff8881f418c280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f418c280
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881e8c6ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881e8c6ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881e8c70000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e8c70080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e8c70100: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
CPU: 0 PID: 360 Comm: syz-executor579 Tainted: G B 5.4.91-syzkaller-00438-g15cec007c4a8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
panic+0x285/0x750 kernel/panic.c:221
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
end_report mm/kasan/report.c:96 [inline]
__kasan_report+0x1e8/0x1f0 mm/kasan/report.c:513
kasan_report+0x30/0x60 mm/kasan/common.c:634
io_queue_sqe fs/io_uring.c:2513 [inline]
io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441629
io_queue_sqe fs/io_uring.c:2513 [inline]
io_queue_link_head+0x37a/0x5c0 fs/io_uring.c:2528
io_ring_submit fs/io_uring.c:2970 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3852 [inline]
__se_sys_io_uring_enter+0xbd1/0x1df0 fs/io_uring.c:3813
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd815bb618 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441629
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000003
RBP: 00007ffd815bb640 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
Reply all
Reply to author
Forward
0 new messages