KASAN: slab-out-of-bounds Read in hci_event_packet
15 views
Skip to first unread message
syzbot
Jan 14, 2020, 10:52:12 AM1/14/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: dcd88898 Linux 4.19.95
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1201b821e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=1f7fa7375205a3ab
dashboard link: https://syzkaller.appspot.com/bug?extid=f7d833bcd3363d2bbb0d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7d833...@syzkaller.appspotmail.com
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0xa/0x1b lib/fault-inject.c:149
==================================================================
should_fail_alloc_page mm/page_alloc.c:3086 [inline]
prepare_alloc_pages mm/page_alloc.c:4344 [inline]
__alloc_pages_nodemask+0x1ee/0x750 mm/page_alloc.c:4391
BUG: KASAN: slab-out-of-bounds in hci_inquiry_result_evt
net/bluetooth/hci_event.c:2376 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0xa5b2/0xaa40
net/bluetooth/hci_event.c:5746
Read of size 3 at addr ffff88809b102f3f by task kworker/u5:1/8458
__alloc_pages include/linux/gfp.h:496 [inline]
__alloc_pages_node include/linux/gfp.h:509 [inline]
kmem_getpages mm/slab.c:1412 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2682
cache_alloc_refill mm/slab.c:3049 [inline]
____cache_alloc mm/slab.c:3132 [inline]
____cache_alloc mm/slab.c:3115 [inline]
__do_cache_alloc mm/slab.c:3354 [inline]
slab_alloc mm/slab.c:3389 [inline]
__do_kmalloc mm/slab.c:3725 [inline]
__kmalloc+0x68b/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
match_number.isra.0+0xa1/0x230 lib/parser.c:136
match_int+0x41/0x50 lib/parser.c:195
parse_options+0xe9a/0x1b00 fs/fat/inode.c:1239
fat_fill_super+0x287/0x3900 fs/fat/inode.c:1633
msdos_fill_super+0x2f/0x40 fs/fat/namei_msdos.c:651
mount_bdev+0x304/0x3c0 fs/super.c:1158
msdos_mount+0x35/0x40 fs/fat/namei_msdos.c:658
mount_fs+0xa8/0x31f fs/super.c:1261
vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x53e/0x2bc0 fs/namespace.c:2799
ksys_mount+0xdb/0x150 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d99a
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 4d 8c fb ff c3 66 2e 0f
1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 2a 8c fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f8a9b118a68 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f8a9b118c90 RCX: 000000000045d99a
RDX: 00007f8a9b118ae0 RSI: 00000000200000c0 RDI: 00007f8a9b118b00
RBP: 000000000075bf20 R08: 00007f8a9b118b40 R09: 00007f8a9b118ae0
R10: 0000000000000000 R11: 0000000000000202 R12: 00007f8a9b1196d4
R13: 00000000004cbf18 R14: 00000000004e6db0 R15: 0000000000000003
CPU: 0 PID: 8458 Comm: kworker/u5:1 Not tainted 4.19.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
hci_inquiry_result_evt net/bluetooth/hci_event.c:2376 [inline]
hci_event_packet+0xa5b2/0xaa40 net/bluetooth/hci_event.c:5746
hci_rx_work+0x478/0xae0 net/bluetooth/hci_core.c:4359
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Allocated by task 16239:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc_node mm/slab.c:3689 [inline]
__kmalloc_node_track_caller+0x51/0x80 mm/slab.c:3703
__kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:137
__alloc_skb+0x10b/0x5f0 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:995 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline]
vhci_write+0xc4/0x470 drivers/bluetooth/hci_vhci.c:299
call_write_iter include/linux/fs.h:1820 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x587/0x810 fs/read_write.c:487
vfs_write+0x20c/0x560 fs/read_write.c:549
ksys_write+0x14f/0x2d0 fs/read_write.c:599
__do_sys_write fs/read_write.c:611 [inline]
__se_sys_write fs/read_write.c:608 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:608
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3777:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
skb_free_head+0x99/0xc0 net/core/skbuff.c:554
skb_release_data+0x619/0x8d0 net/core/skbuff.c:574
skb_release_all+0x4d/0x60 net/core/skbuff.c:631
__kfree_skb net/core/skbuff.c:645 [inline]
consume_skb net/core/skbuff.c:705 [inline]
consume_skb+0xe2/0x390 net/core/skbuff.c:699
uevent_net_broadcast_untagged lib/kobject_uevent.c:335 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:406 [inline]
kobject_uevent_env+0xa2c/0x1170 lib/kobject_uevent.c:590
kobject_synth_uevent+0x77b/0x89c lib/kobject_uevent.c:208
uevent_store+0x26/0x80 drivers/base/core.c:1073
dev_attr_store+0x59/0x80 drivers/base/core.c:782
sysfs_kf_write+0x116/0x170 fs/sysfs/file.c:139
kernfs_fop_write+0x2b8/0x480 fs/kernfs/file.c:316
__vfs_write+0x114/0x810 fs/read_write.c:485
vfs_write+0x20c/0x560 fs/read_write.c:549
ksys_write+0x14f/0x2d0 fs/read_write.c:599
__do_sys_write fs/read_write.c:611 [inline]
__se_sys_write fs/read_write.c:608 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:608
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809b102d40
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 511 bytes inside of
512-byte region [ffff88809b102d40, ffff88809b102f40)
The buggy address belongs to the page:
page:ffffea00026c4080 count:1 mapcount:0 mapping:ffff88812c31c940
index:0xffff88809b1020c0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea000155ebc8 ffffea000251df88 ffff88812c31c940
raw: ffff88809b1020c0 ffff88809b1020c0 0000000100000004 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809b102e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809b102e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff88809b102f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
^
ffff88809b102f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88809b103000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: dcd88898 Linux 4.19.95
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1201b821e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=1f7fa7375205a3ab
dashboard link: https://syzkaller.appspot.com/bug?extid=f7d833bcd3363d2bbb0d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7d833...@syzkaller.appspotmail.com
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0xa/0x1b lib/fault-inject.c:149
==================================================================
should_fail_alloc_page mm/page_alloc.c:3086 [inline]
prepare_alloc_pages mm/page_alloc.c:4344 [inline]
__alloc_pages_nodemask+0x1ee/0x750 mm/page_alloc.c:4391
BUG: KASAN: slab-out-of-bounds in hci_inquiry_result_evt
net/bluetooth/hci_event.c:2376 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0xa5b2/0xaa40
net/bluetooth/hci_event.c:5746
Read of size 3 at addr ffff88809b102f3f by task kworker/u5:1/8458
__alloc_pages include/linux/gfp.h:496 [inline]
__alloc_pages_node include/linux/gfp.h:509 [inline]
kmem_getpages mm/slab.c:1412 [inline]
cache_grow_begin+0x91/0x8c0 mm/slab.c:2682
cache_alloc_refill mm/slab.c:3049 [inline]
____cache_alloc mm/slab.c:3132 [inline]
____cache_alloc mm/slab.c:3115 [inline]
__do_cache_alloc mm/slab.c:3354 [inline]
slab_alloc mm/slab.c:3389 [inline]
__do_kmalloc mm/slab.c:3725 [inline]
__kmalloc+0x68b/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
match_number.isra.0+0xa1/0x230 lib/parser.c:136
match_int+0x41/0x50 lib/parser.c:195
parse_options+0xe9a/0x1b00 fs/fat/inode.c:1239
fat_fill_super+0x287/0x3900 fs/fat/inode.c:1633
msdos_fill_super+0x2f/0x40 fs/fat/namei_msdos.c:651
mount_bdev+0x304/0x3c0 fs/super.c:1158
msdos_mount+0x35/0x40 fs/fat/namei_msdos.c:658
mount_fs+0xa8/0x31f fs/super.c:1261
vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x53e/0x2bc0 fs/namespace.c:2799
ksys_mount+0xdb/0x150 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3026
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d99a
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 4d 8c fb ff c3 66 2e 0f
1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 2a 8c fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f8a9b118a68 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f8a9b118c90 RCX: 000000000045d99a
RDX: 00007f8a9b118ae0 RSI: 00000000200000c0 RDI: 00007f8a9b118b00
RBP: 000000000075bf20 R08: 00007f8a9b118b40 R09: 00007f8a9b118ae0
R10: 0000000000000000 R11: 0000000000000202 R12: 00007f8a9b1196d4
R13: 00000000004cbf18 R14: 00000000004e6db0 R15: 0000000000000003
CPU: 0 PID: 8458 Comm: kworker/u5:1 Not tainted 4.19.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
hci_inquiry_result_evt net/bluetooth/hci_event.c:2376 [inline]
hci_event_packet+0xa5b2/0xaa40 net/bluetooth/hci_event.c:5746
hci_rx_work+0x478/0xae0 net/bluetooth/hci_core.c:4359
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Allocated by task 16239:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc_node mm/slab.c:3689 [inline]
__kmalloc_node_track_caller+0x51/0x80 mm/slab.c:3703
__kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:137
__alloc_skb+0x10b/0x5f0 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:995 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline]
vhci_write+0xc4/0x470 drivers/bluetooth/hci_vhci.c:299
call_write_iter include/linux/fs.h:1820 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x587/0x810 fs/read_write.c:487
vfs_write+0x20c/0x560 fs/read_write.c:549
ksys_write+0x14f/0x2d0 fs/read_write.c:599
__do_sys_write fs/read_write.c:611 [inline]
__se_sys_write fs/read_write.c:608 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:608
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3777:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
skb_free_head+0x99/0xc0 net/core/skbuff.c:554
skb_release_data+0x619/0x8d0 net/core/skbuff.c:574
skb_release_all+0x4d/0x60 net/core/skbuff.c:631
__kfree_skb net/core/skbuff.c:645 [inline]
consume_skb net/core/skbuff.c:705 [inline]
consume_skb+0xe2/0x390 net/core/skbuff.c:699
uevent_net_broadcast_untagged lib/kobject_uevent.c:335 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:406 [inline]
kobject_uevent_env+0xa2c/0x1170 lib/kobject_uevent.c:590
kobject_synth_uevent+0x77b/0x89c lib/kobject_uevent.c:208
uevent_store+0x26/0x80 drivers/base/core.c:1073
dev_attr_store+0x59/0x80 drivers/base/core.c:782
sysfs_kf_write+0x116/0x170 fs/sysfs/file.c:139
kernfs_fop_write+0x2b8/0x480 fs/kernfs/file.c:316
__vfs_write+0x114/0x810 fs/read_write.c:485
vfs_write+0x20c/0x560 fs/read_write.c:549
ksys_write+0x14f/0x2d0 fs/read_write.c:599
__do_sys_write fs/read_write.c:611 [inline]
__se_sys_write fs/read_write.c:608 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:608
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809b102d40
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 511 bytes inside of
512-byte region [ffff88809b102d40, ffff88809b102f40)
The buggy address belongs to the page:
page:ffffea00026c4080 count:1 mapcount:0 mapping:ffff88812c31c940
index:0xffff88809b1020c0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea000155ebc8 ffffea000251df88 ffff88812c31c940
raw: ffff88809b1020c0 ffff88809b1020c0 0000000100000004 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809b102e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809b102e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff88809b102f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
^
ffff88809b102f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88809b103000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Mar 15, 2020, 4:45:17 AM3/15/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 56920971 Linux 4.19.109
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=114bf955e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c73648903e665531
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107fa1f9e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7d833...@syzkaller.appspotmail.com
audit: type=1400 audit(1584261723.992:36): avc: denied { map } for pid=8171 comm="syz-executor226" path="/root/syz-executor226309558" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: slab-out-of-bounds in hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:4162 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x48f5/0xa9d9 net/bluetooth/hci_event.c:5844
Read of size 6 at addr ffff88809fbad788 by task kworker/u5:0/1216
CPU: 1 PID: 1216 Comm: kworker/u5:0 Not tainted 4.19.109-syzkaller #0
print_address_description.cold+0x7c/0x212 mm/kasan/report.c:256
memcpy+0x20/0x50 mm/kasan/kasan.c:302
hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:4162 [inline]
hci_event_packet+0x48f5/0xa9d9 net/bluetooth/hci_event.c:5844
hci_rx_work+0x47b/0xab0 net/bluetooth/hci_core.c:4359
process_one_work+0x91f/0x1640 kernel/workqueue.c:2153
worker_thread+0x96/0xe20 kernel/workqueue.c:2296
kthread+0x34a/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Allocated by task 8179:
__do_kmalloc_node mm/slab.c:3689 [inline]
__kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3703
__kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:137
__alloc_skb+0xef/0x5b0 net/core/skbuff.c:205
vfs_write+0x206/0x550 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 6110:
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0xf7/0x140 mm/kasan/kasan.c:521
__cache_free mm/slab.c:3503 [inline]
kfree+0xce/0x220 mm/slab.c:3822
kernfs_fop_release+0x124/0x190 fs/kernfs/file.c:783
__fput+0x2cd/0x890 fs/file_table.c:278
task_work_run+0x13f/0x1b0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x25a/0x2b0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809fbad580
512-byte region [ffff88809fbad580, ffff88809fbad780)
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0002a202c8 ffffea0002397088 ffff88812c3dc940
raw: 0000000000000000 ffff88809fbad080 0000000100000006 0000000000000000
ffff88809fbad700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88809fbad780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88809fbad800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809fbad880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: 56920971 Linux 4.19.109
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=114bf955e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c73648903e665531
dashboard link: https://syzkaller.appspot.com/bug?extid=f7d833bcd3363d2bbb0d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11952919e00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107fa1f9e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7d833...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:4162 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x48f5/0xa9d9 net/bluetooth/hci_event.c:5844
Read of size 6 at addr ffff88809fbad788 by task kworker/u5:0/1216
CPU: 1 PID: 1216 Comm: kworker/u5:0 Not tainted 4.19.109-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
print_address_description.cold+0x7c/0x212 mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x88/0x2b9 mm/kasan/report.c:396
kasan_report mm/kasan/report.c:412 [inline]
memcpy+0x20/0x50 mm/kasan/kasan.c:302
hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:4162 [inline]
hci_event_packet+0x48f5/0xa9d9 net/bluetooth/hci_event.c:5844
hci_rx_work+0x47b/0xab0 net/bluetooth/hci_core.c:4359
process_one_work+0x91f/0x1640 kernel/workqueue.c:2153
worker_thread+0x96/0xe20 kernel/workqueue.c:2296
kthread+0x34a/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Allocated by task 8179:
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:531
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
__do_kmalloc_node mm/slab.c:3689 [inline]
__kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3703
__kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:137
__alloc_skb+0xef/0x5b0 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:995 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline]
vhci_write+0xbd/0x460 drivers/bluetooth/hci_vhci.c:299
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline]
call_write_iter include/linux/fs.h:1820 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x512/0x760 fs/read_write.c:487
new_sync_write fs/read_write.c:474 [inline]
vfs_write+0x206/0x550 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 6110:
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0xf7/0x140 mm/kasan/kasan.c:521
__cache_free mm/slab.c:3503 [inline]
kfree+0xce/0x220 mm/slab.c:3822
kernfs_fop_release+0x124/0x190 fs/kernfs/file.c:783
__fput+0x2cd/0x890 fs/file_table.c:278
task_work_run+0x13f/0x1b0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x25a/0x2b0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809fbad580
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 8 bytes to the right of
512-byte region [ffff88809fbad580, ffff88809fbad780)
The buggy address belongs to the page:
page:ffffea00027eeb40 count:1 mapcount:0 mapping:ffff88812c3dc940 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0002a202c8 ffffea0002397088 ffff88812c3dc940
raw: 0000000000000000 ffff88809fbad080 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809fbad680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Memory state around the buggy address:
ffff88809fbad700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88809fbad780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88809fbad800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809fbad880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Sep 10, 2020, 1:21:08 PM9/10/20
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 8c4a649c20fec015ebb326f36b47d4e39d9ff5b7
Author: Peilin Ye <yepei...@gmail.com>
Date: Fri Jul 10 16:09:15 2020 +0000
Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17b47cf1900000
start commit: 56920971 Linux 4.19.109
git tree: linux-4.19.y
#syz fix: Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 8c4a649c20fec015ebb326f36b47d4e39d9ff5b7
Author: Peilin Ye <yepei...@gmail.com>
Date: Fri Jul 10 16:09:15 2020 +0000
Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17b47cf1900000
start commit: 56920971 Linux 4.19.109
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=c73648903e665531
dashboard link: https://syzkaller.appspot.com/bug?extid=f7d833bcd3363d2bbb0d
dashboard link: https://syzkaller.appspot.com/bug?extid=f7d833bcd3363d2bbb0d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11952919e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107fa1f9e00000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107fa1f9e00000
#syz fix: Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages