[v5.15] KASAN: use-after-free Read in unix_stream_read_actor
6 views
Skip to first unread message
syzbot
Nov 10, 2023, 11:32:23 PM11/10/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 80529b4968a8 Linux 5.15.138
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=110a58fb680000
kernel config: https://syzkaller.appspot.com/x/.config?x=c431dbb457f792c5
dashboard link: https://syzkaller.appspot.com/bug?extid=5064f17718d4ca803813
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13652870e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=146714b7680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8c87dd6ae2e4/disk-80529b49.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a47ef8335f7/vmlinux-80529b49.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e8d50f725356/bzImage-80529b49.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5064f1...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in unix_stream_read_actor+0x9e/0xa0 net/unix/af_unix.c:2809
Read of size 4 at addr ffff88801a231684 by task syz-executor758/3526
CPU: 1 PID: 3526 Comm: syz-executor758 Not tainted 5.15.138-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description+0x63/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
unix_stream_read_actor+0x9e/0xa0 net/unix/af_unix.c:2809
unix_stream_recv_urg+0x1bb/0x300 net/unix/af_unix.c:2535
unix_stream_read_generic+0x21ab/0x22a0 net/unix/af_unix.c:2615
unix_stream_recvmsg+0x22d/0x2c0 net/unix/af_unix.c:2847
____sys_recvmsg+0x286/0x530
___sys_recvmsg+0x1ec/0x690 net/socket.c:2690
__sys_recvmsg net/socket.c:2720 [inline]
__do_sys_recvmsg net/socket.c:2730 [inline]
__se_sys_recvmsg net/socket.c:2727 [inline]
__x64_sys_recvmsg+0x1dc/0x2b0 net/socket.c:2727
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f522e1634e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f522e0e2228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f522e1634e9
RDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004
RBP: 00007f522e1ed348 R08: 00007f522e0e26c0 R09: 00007f522e0e26c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f522e1ed340
R13: 00007f522e1ed34c R14: 00007fff5b9c08c0 R15: 00007fff5b9c09a8
</TASK>
Allocated by task 3525:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8e/0xc0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
kmem_cache_alloc_node+0x121/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]
alloc_skb_with_frags+0xa3/0x780 net/core/skbuff.c:6132
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2512
queue_oob+0xfd/0x8d0 net/unix/af_unix.c:1980
unix_stream_sendmsg+0xe0a/0x1070 net/unix/af_unix.c:2117
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2429
___sys_sendmsg+0x252/0x2e0 net/socket.c:2483
__sys_sendmsg net/socket.c:2512 [inline]
__do_sys_sendmsg net/socket.c:2521 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2519
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Freed by task 3525:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0x91/0x1f0 mm/slub.c:3515
queue_oob+0x524/0x8d0 net/unix/af_unix.c:2011
unix_stream_sendmsg+0xe0a/0x1070 net/unix/af_unix.c:2117
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2429
___sys_sendmsg+0x252/0x2e0 net/socket.c:2483
__sys_sendmsg net/socket.c:2512 [inline]
__do_sys_sendmsg net/socket.c:2521 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2519
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
The buggy address belongs to the object at ffff88801a231640
which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 68 bytes inside of
232-byte region [ffff88801a231640, ffff88801a231728)
The buggy address belongs to the page:
page:ffffea0000688c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a231
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff8880165e8500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3525, ts 52575496142, free_ts 45832208612
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
__alloc_pages+0x272/0x700 mm/page_alloc.c:5421
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
kmem_cache_alloc_node+0x1ba/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]
alloc_skb_with_frags+0xa3/0x780 net/core/skbuff.c:6132
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2512
queue_oob+0xfd/0x8d0 net/unix/af_unix.c:1980
unix_stream_sendmsg+0xe0a/0x1070 net/unix/af_unix.c:2117
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2429
___sys_sendmsg+0x252/0x2e0 net/socket.c:2483
__sys_sendmsg net/socket.c:2512 [inline]
__do_sys_sendmsg net/socket.c:2521 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2519
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
pipe_buf_release include/linux/pipe_fs_i.h:203 [inline]
pipe_read+0x6e4/0x12b0 fs/pipe.c:323
call_read_iter include/linux/fs.h:2097 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0xa9f/0xe10 fs/read_write.c:485
ksys_read+0x1a2/0x2c0 fs/read_write.c:623
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Memory state around the buggy address:
ffff88801a231580: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff88801a231600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88801a231680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801a231700: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff88801a231780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 80529b4968a8 Linux 5.15.138
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=110a58fb680000
kernel config: https://syzkaller.appspot.com/x/.config?x=c431dbb457f792c5
dashboard link: https://syzkaller.appspot.com/bug?extid=5064f17718d4ca803813
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13652870e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=146714b7680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8c87dd6ae2e4/disk-80529b49.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a47ef8335f7/vmlinux-80529b49.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e8d50f725356/bzImage-80529b49.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5064f1...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in unix_stream_read_actor+0x9e/0xa0 net/unix/af_unix.c:2809
Read of size 4 at addr ffff88801a231684 by task syz-executor758/3526
CPU: 1 PID: 3526 Comm: syz-executor758 Not tainted 5.15.138-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description+0x63/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
unix_stream_read_actor+0x9e/0xa0 net/unix/af_unix.c:2809
unix_stream_recv_urg+0x1bb/0x300 net/unix/af_unix.c:2535
unix_stream_read_generic+0x21ab/0x22a0 net/unix/af_unix.c:2615
unix_stream_recvmsg+0x22d/0x2c0 net/unix/af_unix.c:2847
____sys_recvmsg+0x286/0x530
___sys_recvmsg+0x1ec/0x690 net/socket.c:2690
__sys_recvmsg net/socket.c:2720 [inline]
__do_sys_recvmsg net/socket.c:2730 [inline]
__se_sys_recvmsg net/socket.c:2727 [inline]
__x64_sys_recvmsg+0x1dc/0x2b0 net/socket.c:2727
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f522e1634e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f522e0e2228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f522e1634e9
RDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004
RBP: 00007f522e1ed348 R08: 00007f522e0e26c0 R09: 00007f522e0e26c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f522e1ed340
R13: 00007f522e1ed34c R14: 00007fff5b9c08c0 R15: 00007fff5b9c09a8
</TASK>
Allocated by task 3525:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8e/0xc0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
kmem_cache_alloc_node+0x121/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]
alloc_skb_with_frags+0xa3/0x780 net/core/skbuff.c:6132
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2512
queue_oob+0xfd/0x8d0 net/unix/af_unix.c:1980
unix_stream_sendmsg+0xe0a/0x1070 net/unix/af_unix.c:2117
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2429
___sys_sendmsg+0x252/0x2e0 net/socket.c:2483
__sys_sendmsg net/socket.c:2512 [inline]
__do_sys_sendmsg net/socket.c:2521 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2519
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Freed by task 3525:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0x91/0x1f0 mm/slub.c:3515
queue_oob+0x524/0x8d0 net/unix/af_unix.c:2011
unix_stream_sendmsg+0xe0a/0x1070 net/unix/af_unix.c:2117
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2429
___sys_sendmsg+0x252/0x2e0 net/socket.c:2483
__sys_sendmsg net/socket.c:2512 [inline]
__do_sys_sendmsg net/socket.c:2521 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2519
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
The buggy address belongs to the object at ffff88801a231640
which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 68 bytes inside of
232-byte region [ffff88801a231640, ffff88801a231728)
The buggy address belongs to the page:
page:ffffea0000688c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a231
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff8880165e8500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3525, ts 52575496142, free_ts 45832208612
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
__alloc_pages+0x272/0x700 mm/page_alloc.c:5421
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
kmem_cache_alloc_node+0x1ba/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]
alloc_skb_with_frags+0xa3/0x780 net/core/skbuff.c:6132
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2512
queue_oob+0xfd/0x8d0 net/unix/af_unix.c:1980
unix_stream_sendmsg+0xe0a/0x1070 net/unix/af_unix.c:2117
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2429
___sys_sendmsg+0x252/0x2e0 net/socket.c:2483
__sys_sendmsg net/socket.c:2512 [inline]
__do_sys_sendmsg net/socket.c:2521 [inline]
__se_sys_sendmsg+0x19a/0x260 net/socket.c:2519
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
pipe_buf_release include/linux/pipe_fs_i.h:203 [inline]
pipe_read+0x6e4/0x12b0 fs/pipe.c:323
call_read_iter include/linux/fs.h:2097 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0xa9f/0xe10 fs/read_write.c:485
ksys_read+0x1a2/0x2c0 fs/read_write.c:623
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Memory state around the buggy address:
ffff88801a231580: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff88801a231600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88801a231680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801a231700: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff88801a231780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Nov 11, 2023, 2:39:23 AM11/11/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: fb2635ac69ab Linux 6.1.62
syzbot found the following issue on:
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=144693e0e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1540e3da5e5623f
dashboard link: https://syzkaller.appspot.com/bug?extid=a4f9427caf72d1b98445
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=129c7338e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14804f17680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c564654b9f0a/disk-fb2635ac.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7967ffa53eb1/vmlinux-fb2635ac.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2ddd941684d4/bzImage-fb2635ac.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
==================================================================
BUG: KASAN: use-after-free in unix_stream_read_actor+0x9e/0xa0 net/unix/af_unix.c:2920
Read of size 4 at addr ffff888078cd9184 by task syz-executor293/4250
CPU: 0 PID: 4250 Comm: syz-executor293 Not tainted 6.1.62-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_report+0x15f/0x4f0 mm/kasan/report.c:395
kasan_report+0x136/0x160 mm/kasan/report.c:495
unix_stream_read_actor+0x9e/0xa0 net/unix/af_unix.c:2920
unix_stream_recv_urg+0x1bb/0x300 net/unix/af_unix.c:2647
unix_stream_read_generic+0x2104/0x21e0 net/unix/af_unix.c:2726
unix_stream_recvmsg+0x222/0x2b0 net/unix/af_unix.c:2957
____sys_recvmsg+0x285/0x530
___sys_recvmsg net/socket.c:2760 [inline]
__sys_recvmsg+0x2e9/0x3d0 net/socket.c:2790
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
RIP: 0033:0x7f4e215024e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4e21481228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 0000000000000024 RCX: 00007f4e215024e9
RDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004
RBP: 00007f4e2158c348 R08: 00007f4e214816c0 R09: 00007f4e214816c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4e2158c340
R13: 00007f4e2158c34c R14: 00007fff157e2d70 R15: 00007fff157e2e58
</TASK>
Allocated by task 4249:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
kmem_cache_alloc_node+0x136/0x310 mm/slub.c:3443
__alloc_skb+0xde/0x670 net/core/skbuff.c:505
alloc_skb include/linux/skbuff.h:1276 [inline]
alloc_skb_with_frags+0xa4/0x740 net/core/skbuff.c:6153
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2738
sock_alloc_send_skb include/net/sock.h:1907 [inline]
queue_oob+0x102/0x8e0 net/unix/af_unix.c:2114
unix_stream_sendmsg+0xe10/0x1070 net/unix/af_unix.c:2251
sock_sendmsg_nosec net/socket.c:716 [inline]
__sock_sendmsg net/socket.c:728 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2499
___sys_sendmsg net/socket.c:2553 [inline]
__sys_sendmsg+0x2a9/0x390 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
Freed by task 4249:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
kmem_cache_free+0x292/0x510 mm/slub.c:3683
queue_oob+0x52c/0x8e0 net/unix/af_unix.c:2145
unix_stream_sendmsg+0xe10/0x1070 net/unix/af_unix.c:2251
sock_sendmsg_nosec net/socket.c:716 [inline]
__sock_sendmsg net/socket.c:728 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2499
___sys_sendmsg net/socket.c:2553 [inline]
__sys_sendmsg+0x2a9/0x390 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
The buggy address belongs to the object at ffff888078cd9140
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 68 bytes inside of
240-byte region [ffff888078cd9140, ffff888078cd9230)
The buggy address belongs to the physical page:
page:ffffea0001e33640 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78cd9
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888141e54500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 4249, tgid 4247 (syz-executor293), ts 70820582570, free_ts 70763899994
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2513
prep_new_page mm/page_alloc.c:2520 [inline]
get_page_from_freelist+0x31a1/0x3320 mm/page_alloc.c:4279
__alloc_pages+0x28d/0x770 mm/page_alloc.c:5545
alloc_slab_page+0x6a/0x150 mm/slub.c:1794
allocate_slab mm/slub.c:1939 [inline]
new_slab+0x84/0x2d0 mm/slub.c:1992
___slab_alloc+0xc20/0x1270 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
kmem_cache_alloc_node+0x1cf/0x310 mm/slub.c:3443
__alloc_skb+0xde/0x670 net/core/skbuff.c:505
alloc_skb include/linux/skbuff.h:1276 [inline]
alloc_skb_with_frags+0xa4/0x740 net/core/skbuff.c:6153
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2738
sock_alloc_send_skb include/net/sock.h:1907 [inline]
queue_oob+0x102/0x8e0 net/unix/af_unix.c:2114
unix_stream_sendmsg+0xe10/0x1070 net/unix/af_unix.c:2251
sock_sendmsg_nosec net/socket.c:716 [inline]
__sock_sendmsg net/socket.c:728 [inline]
____sys_sendmsg+0x59e/0x8f0 net/socket.c:2499
___sys_sendmsg net/socket.c:2553 [inline]
__sys_sendmsg+0x2a9/0x390 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1440 [inline]
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pcp_prepare mm/page_alloc.c:1490 [inline]
free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3358
free_unref_page_list+0x663/0x900 mm/page_alloc.c:3499
release_pages+0x2836/0x2b40 mm/swap.c:1055
tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
tlb_flush_mmu+0xfc/0x210 mm/mmu_gather.c:261
tlb_finish_mmu+0xce/0x1f0 mm/mmu_gather.c:361
exit_mmap+0x3c3/0x9f0 mm/mmap.c:3239
__mmput+0x115/0x3c0 kernel/fork.c:1199
exit_mm+0x226/0x300 kernel/exit.c:563
do_exit+0x9f6/0x26a0 kernel/exit.c:856
do_group_exit+0x202/0x2b0 kernel/exit.c:1019
get_signal+0x16f7/0x17d0 kernel/signal.c:2862
arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:168
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:297
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
Memory state around the buggy address:
ffff888078cd9100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888078cd9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888078cd9200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
ffff888078cd9280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
syzbot
Dec 12, 2023, 9:55:10 PM12/12/23
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 75bcfc188abf4fae9c1d5f5dc0a03540be602eef
Author: Eric Dumazet <edum...@google.com>
Date: Mon Nov 13 13:49:38 2023 +0000
af_unix: fix use-after-free in unix_stream_read_actor()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=153fd3fee80000
start commit: 80529b4968a8 Linux 5.15.138
git tree: linux-5.15.y
#syz fix: af_unix: fix use-after-free in unix_stream_read_actor()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 75bcfc188abf4fae9c1d5f5dc0a03540be602eef
Author: Eric Dumazet <edum...@google.com>
Date: Mon Nov 13 13:49:38 2023 +0000
af_unix: fix use-after-free in unix_stream_read_actor()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=153fd3fee80000
start commit: 80529b4968a8 Linux 5.15.138
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=c431dbb457f792c5
dashboard link: https://syzkaller.appspot.com/bug?extid=5064f17718d4ca803813
dashboard link: https://syzkaller.appspot.com/bug?extid=5064f17718d4ca803813
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13652870e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=146714b7680000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=146714b7680000
#syz fix: af_unix: fix use-after-free in unix_stream_read_actor()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Dec 15, 2023, 6:39:06 AM12/15/23
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit d179189eec426fe4801e4b91efa1889faed12700
Author: Eric Dumazet <edum...@google.com>
Date: Mon Nov 13 13:49:38 2023 +0000
af_unix: fix use-after-free in unix_stream_read_actor()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1081ce7ce80000
Date: Mon Nov 13 13:49:38 2023 +0000
af_unix: fix use-after-free in unix_stream_read_actor()
start commit: fb2635ac69ab Linux 6.1.62
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=d1540e3da5e5623f
dashboard link: https://syzkaller.appspot.com/bug?extid=a4f9427caf72d1b98445
dashboard link: https://syzkaller.appspot.com/bug?extid=a4f9427caf72d1b98445
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=129c7338e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14804f17680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14804f17680000
Reply all
Reply to author
Forward
0 new messages