[v6.1] KASAN: use-after-free Read in gsm_cleanup_mux
4 views
Skip to first unread message
syzbot
Apr 23, 2023, 3:40:39 AM4/23/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: f17b0ab65d17 Linux 6.1.25
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1027b8f0280000
kernel config: https://syzkaller.appspot.com/x/.config?x=73f7ee8e484b74b7
dashboard link: https://syzkaller.appspot.com/bug?extid=947ecd0ac8b5b531dcc9
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/553994c02131/disk-f17b0ab6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c88e4d2795a5/vmlinux-f17b0ab6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d788d429a3a9/Image-f17b0ab6.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+947ecd...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
Read of size 4 at addr ffff00012d04800c by task syz-executor.5/5133
CPU: 0 PID: 5133 Comm: syz-executor.5 Not tainted 6.1.25-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:395
kasan_report+0xd4/0x130 mm/kasan/report.c:495
__asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Allocated by task 5130:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x7c/0x94 mm/slab_common.c:1050
kmalloc include/linux/slab.h:553 [inline]
kzalloc include/linux/slab.h:689 [inline]
gsm_dlci_alloc+0x60/0x340 drivers/tty/n_gsm.c:2064
gsm_activate_mux+0x30/0x268 drivers/tty/n_gsm.c:2538
gsm_config drivers/tty/n_gsm.c:2778 [inline]
gsmld_ioctl+0xbc0/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Freed by task 5130:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0x2c0/0x4b4 mm/slub.c:3674
kfree+0xcc/0x1b8 mm/slab_common.c:1007
gsm_dlci_free+0x11c/0x168 drivers/tty/n_gsm.c:2110
tty_port_destructor drivers/tty/tty_port.c:296 [inline]
kref_put include/linux/kref.h:65 [inline]
tty_port_put+0xfc/0x190 drivers/tty/tty_port.c:311
dlci_put drivers/tty/n_gsm.c:2120 [inline]
gsm_dlci_release drivers/tty/n_gsm.c:2153 [inline]
gsm_cleanup_mux+0x48c/0x7d8 drivers/tty/n_gsm.c:2512
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
The buggy address belongs to the object at ffff00012d048000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 12 bytes inside of
2048-byte region [ffff00012d048000, ffff00012d048800)
The buggy address belongs to the physical page:
page:00000000c173ecb2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16d048
head:00000000c173ecb2 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc0004b38000 dead000000000002 ffff0000c0002900
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff00012d047f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff00012d047f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff00012d048000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff00012d048080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff00012d048100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address ee8d2e6ce5ef2e8e
KASAN: maybe wild-memory-access in range [0x746d73672f797470-0x746d73672f797477]
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[ee8d2e6ce5ef2e8e] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5133 Comm: syz-executor.5 Tainted: G B 6.1.25-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_add_valid+0x5c/0x110 lib/list_debug.c:30
lr : __list_add include/linux/list.h:69 [inline]
lr : list_add_tail include/linux/list.h:102 [inline]
lr : gsm_send+0x350/0x604 drivers/tty/n_gsm.c:726
sp : ffff80001f5078a0
x29: ffff80001f5078a0 x28: ffff0000c18cd114 x27: ffff00012ad10c18
x26: ffff00012ad10c10 x25: dfff800000000000 x24: 746d73672f797474
x23: dfff800000000000 x22: ffff00012ad10c18 x21: ffff0000c18cd100
x20: 746d73672f797474 x19: ffff00012ad10c10 x18: 1fffe000368b6b76
x17: ffff80000b5a9498 x16: ffff80000831b750 x15: ffff80000b5dbbf8
x14: ffff80000b5dc46c x13: ffff800008021d48 x12: ffff700003ea0f00
x11: 1ffff00003ea0f00 x10: 0000000000000004 x9 : 25a889068cc13c00
x8 : 0e8dae6ce5ef2e8e x7 : ffff800008967f44 x6 : ffff80000b5dc714
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831b8ec
x2 : 746d73672f797474 x1 : 746d73672f797474 x0 : ffff0000c18cd100
Call trace:
__list_add_valid+0x5c/0x110 lib/list_debug.c:30
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
gsm_send+0x350/0x604 drivers/tty/n_gsm.c:726
gsm_command drivers/tty/n_gsm.c:789 [inline]
gsm_dlci_begin_close drivers/tty/n_gsm.c:1933 [inline]
gsm_cleanup_mux+0x1a0/0x7d8 drivers/tty/n_gsm.c:2492
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: f94002c2 eb14005f 54000461 d343fe88 (38776908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f94002c2 ldr x2, [x22]
4: eb14005f cmp x2, x20
8: 54000461 b.ne 0x94 // b.any
c: d343fe88 lsr x8, x20, #3
* 10: 38776908 ldrb w8, [x8, x23] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: f17b0ab65d17 Linux 6.1.25
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1027b8f0280000
kernel config: https://syzkaller.appspot.com/x/.config?x=73f7ee8e484b74b7
dashboard link: https://syzkaller.appspot.com/bug?extid=947ecd0ac8b5b531dcc9
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/553994c02131/disk-f17b0ab6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c88e4d2795a5/vmlinux-f17b0ab6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d788d429a3a9/Image-f17b0ab6.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+947ecd...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
Read of size 4 at addr ffff00012d04800c by task syz-executor.5/5133
CPU: 0 PID: 5133 Comm: syz-executor.5 Not tainted 6.1.25-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:395
kasan_report+0xd4/0x130 mm/kasan/report.c:495
__asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Allocated by task 5130:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x7c/0x94 mm/slab_common.c:1050
kmalloc include/linux/slab.h:553 [inline]
kzalloc include/linux/slab.h:689 [inline]
gsm_dlci_alloc+0x60/0x340 drivers/tty/n_gsm.c:2064
gsm_activate_mux+0x30/0x268 drivers/tty/n_gsm.c:2538
gsm_config drivers/tty/n_gsm.c:2778 [inline]
gsmld_ioctl+0xbc0/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Freed by task 5130:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0x2c0/0x4b4 mm/slub.c:3674
kfree+0xcc/0x1b8 mm/slab_common.c:1007
gsm_dlci_free+0x11c/0x168 drivers/tty/n_gsm.c:2110
tty_port_destructor drivers/tty/tty_port.c:296 [inline]
kref_put include/linux/kref.h:65 [inline]
tty_port_put+0xfc/0x190 drivers/tty/tty_port.c:311
dlci_put drivers/tty/n_gsm.c:2120 [inline]
gsm_dlci_release drivers/tty/n_gsm.c:2153 [inline]
gsm_cleanup_mux+0x48c/0x7d8 drivers/tty/n_gsm.c:2512
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
The buggy address belongs to the object at ffff00012d048000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 12 bytes inside of
2048-byte region [ffff00012d048000, ffff00012d048800)
The buggy address belongs to the physical page:
page:00000000c173ecb2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16d048
head:00000000c173ecb2 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc0004b38000 dead000000000002 ffff0000c0002900
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff00012d047f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff00012d047f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff00012d048000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff00012d048080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff00012d048100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address ee8d2e6ce5ef2e8e
KASAN: maybe wild-memory-access in range [0x746d73672f797470-0x746d73672f797477]
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[ee8d2e6ce5ef2e8e] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5133 Comm: syz-executor.5 Tainted: G B 6.1.25-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_add_valid+0x5c/0x110 lib/list_debug.c:30
lr : __list_add include/linux/list.h:69 [inline]
lr : list_add_tail include/linux/list.h:102 [inline]
lr : gsm_send+0x350/0x604 drivers/tty/n_gsm.c:726
sp : ffff80001f5078a0
x29: ffff80001f5078a0 x28: ffff0000c18cd114 x27: ffff00012ad10c18
x26: ffff00012ad10c10 x25: dfff800000000000 x24: 746d73672f797474
x23: dfff800000000000 x22: ffff00012ad10c18 x21: ffff0000c18cd100
x20: 746d73672f797474 x19: ffff00012ad10c10 x18: 1fffe000368b6b76
x17: ffff80000b5a9498 x16: ffff80000831b750 x15: ffff80000b5dbbf8
x14: ffff80000b5dc46c x13: ffff800008021d48 x12: ffff700003ea0f00
x11: 1ffff00003ea0f00 x10: 0000000000000004 x9 : 25a889068cc13c00
x8 : 0e8dae6ce5ef2e8e x7 : ffff800008967f44 x6 : ffff80000b5dc714
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831b8ec
x2 : 746d73672f797474 x1 : 746d73672f797474 x0 : ffff0000c18cd100
Call trace:
__list_add_valid+0x5c/0x110 lib/list_debug.c:30
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
gsm_send+0x350/0x604 drivers/tty/n_gsm.c:726
gsm_command drivers/tty/n_gsm.c:789 [inline]
gsm_dlci_begin_close drivers/tty/n_gsm.c:1933 [inline]
gsm_cleanup_mux+0x1a0/0x7d8 drivers/tty/n_gsm.c:2492
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: f94002c2 eb14005f 54000461 d343fe88 (38776908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f94002c2 ldr x2, [x22]
4: eb14005f cmp x2, x20
8: 54000461 b.ne 0x94 // b.any
c: d343fe88 lsr x8, x20, #3
* 10: 38776908 ldrb w8, [x8, x23] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
May 27, 2023, 7:38:03 PM5/27/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: a343b0dd87b4 Linux 6.1.30
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1340c3e5280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8ec86bd749598dca
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f43789280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/aebc00d6f042/disk-a343b0dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7ff0321ebb5a/vmlinux-a343b0dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c928974a56d6/Image-a343b0dd.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+947ecd...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
Read of size 4 at addr ffff0000c464a00c by task syz-executor413/4221
CPU: 0 PID: 4221 Comm: syz-executor413 Not tainted 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Freed by task 4216:
The buggy address belongs to the object at ffff0000c464a000
The buggy address belongs to the physical page:
page:00000000e54018b5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104648
head:00000000e54018b5 order:3 compound_mapcount:0 compound_pincount:0
ffff0000c4649f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000c464a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c464a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000c464a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 1163 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 4221 Comm: syz-executor413 Tainted: G B 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_out_of_bounds+0xfc/0x148 lib/ubsan.c:282
decode_tail kernel/locking/qspinlock.c:131 [inline]
queued_spin_lock_slowpath+0x9fc/0xe48 kernel/locking/qspinlock.c:471
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb4 kernel/locking/spinlock.c:162
gsm_send+0x31c/0x604 drivers/tty/n_gsm.c:725
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: a343b0dd87b4 Linux 6.1.30
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1340c3e5280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8ec86bd749598dca
dashboard link: https://syzkaller.appspot.com/bug?extid=947ecd0ac8b5b531dcc9
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1172ccf5280000
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f43789280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/aebc00d6f042/disk-a343b0dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7ff0321ebb5a/vmlinux-a343b0dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c928974a56d6/Image-a343b0dd.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+947ecd...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
CPU: 0 PID: 4221 Comm: syz-executor413 Not tainted 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:395
kasan_report+0xd4/0x130 mm/kasan/report.c:495
__asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Allocated by task 4216:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:395
kasan_report+0xd4/0x130 mm/kasan/report.c:495
__asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
gsm_cleanup_mux+0x700/0x7d8 drivers/tty/n_gsm.c:2491
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 12 bytes inside of
2048-byte region [ffff0000c464a000, ffff0000c464a800)
The buggy address is located 12 bytes inside of
The buggy address belongs to the physical page:
head:00000000e54018b5 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002900
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c4649f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c4649f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000c464a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c464a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000c464a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 1163 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 4221 Comm: syz-executor413 Tainted: G B 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_out_of_bounds+0xfc/0x148 lib/ubsan.c:282
decode_tail kernel/locking/qspinlock.c:131 [inline]
queued_spin_lock_slowpath+0x9fc/0xe48 kernel/locking/qspinlock.c:471
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb4 kernel/locking/spinlock.c:162
gsm_send+0x31c/0x604 drivers/tty/n_gsm.c:725
gsm_command drivers/tty/n_gsm.c:789 [inline]
gsm_dlci_begin_close drivers/tty/n_gsm.c:1933 [inline]
gsm_cleanup_mux+0x1a0/0x7d8 drivers/tty/n_gsm.c:2492
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
================================================================================
gsm_dlci_begin_close drivers/tty/n_gsm.c:1933 [inline]
gsm_cleanup_mux+0x1a0/0x7d8 drivers/tty/n_gsm.c:2492
gsm_config drivers/tty/n_gsm.c:2754 [inline]
gsmld_ioctl+0x9d4/0x1384 drivers/tty/n_gsm.c:3117
tty_ioctl+0x924/0xd8c drivers/tty/tty_io.c:2782
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
May 27, 2023, 10:44:44 PM5/27/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 1fe619a7d252 Linux 5.15.113
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1437a7fe280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8f10ee30ae29b021
dashboard link: https://syzkaller.appspot.com/bug?extid=899730ffdd53c2725cfa
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1202583e280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1b707a1e1816/disk-1fe619a7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19cc598a8bbe/vmlinux-1fe619a7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a6cf7269bae5/Image-1fe619a7.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+899730...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in gsm_cleanup_mux+0x660/0x738 drivers/tty/n_gsm.c:2397
Read of size 4 at addr ffff0000c8b4a00c by task syz-executor242/3967
CPU: 0 PID: 3967 Comm: syz-executor242 Not tainted 5.15.113-syzkaller #0
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308
gsm_cleanup_mux+0x660/0x738 drivers/tty/n_gsm.c:2397
gsm_config drivers/tty/n_gsm.c:2653 [inline]
gsmld_ioctl+0xa48/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 3962:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x27c/0x47c mm/slub.c:3247
kmalloc include/linux/slab.h:591 [inline]
kzalloc include/linux/slab.h:721 [inline]
gsm_dlci_alloc+0x60/0x340 drivers/tty/n_gsm.c:1932
gsm_activate_mux+0x30/0x300 drivers/tty/n_gsm.c:2438
gsm_config drivers/tty/n_gsm.c:2677 [inline]
gsmld_ioctl+0xc1c/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 3962:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0x178/0x410 mm/slub.c:4559
gsm_dlci_free+0x11c/0x168 drivers/tty/n_gsm.c:1978
tty_port_destructor drivers/tty/tty_port.c:265 [inline]
kref_put include/linux/kref.h:65 [inline]
tty_port_put+0x140/0x1bc drivers/tty/tty_port.c:273
dlci_put drivers/tty/n_gsm.c:1988 [inline]
gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline]
gsm_cleanup_mux+0x488/0x738 drivers/tty/n_gsm.c:2415
gsm_config drivers/tty/n_gsm.c:2653 [inline]
gsmld_ioctl+0xa48/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000c8b4a000
The buggy address belongs to the page:
page:0000000003bf807d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108b48
head:0000000003bf807d order:3 compound_mapcount:0 compound_pincount:0
ffff0000c8b49f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000c8b4a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c8b4a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000c8b4a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address dfff80000000000a
Mem abort info:
ESR = 0x0000000096000006
Data abort info:
ISV = 0, ISS = 0x00000006
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3967 Comm: syz-executor242 Tainted: G B 5.15.113-syzkaller #0
pc : tty_write_room+0x48/0x8c drivers/tty/tty_ioctl.c:78
lr : tty_write_room+0x3c/0x8c drivers/tty/tty_ioctl.c:78
sp : ffff80001cdc7810
x29: ffff80001cdc7810 x28: 0000000000000001 x27: dfff800000000000
x26: 1ffff000039b8f14 x25: 0000000000000000 x24: 1fffe00019984cc0
x23: dfff800000000000 x22: 0000000000000f7a x21: dfff800000000000
x20: 0000000000000050 x19: ffff0000c7838a00 x18: 0000000000000000
x17: ff8080000b3ef030 x16: 0000000000000000 x15: ffff80000b3ef030
x14: 0000000000000002 x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000b3d191c x10: 0000000000000000 x9 : ffff80001842e390
x8 : 000000000000000a x7 : 0000000000000000 x6 : ffff800008268c6c
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000b3d1934
x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
tty_write_room+0x48/0x8c drivers/tty/tty_ioctl.c:78
gsmld_output+0x4c/0x1d0 drivers/tty/n_gsm.c:2698
gsm_send+0x4dc/0x798 drivers/tty/n_gsm.c:707
gsm_command drivers/tty/n_gsm.c:736 [inline]
gsm_dlci_begin_close drivers/tty/n_gsm.c:1801 [inline]
gsm_cleanup_mux+0x1a0/0x738 drivers/tty/n_gsm.c:2398
gsm_config drivers/tty/n_gsm.c:2653 [inline]
gsmld_ioctl+0xa48/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 9753d81a f9400288 91014114 d343fe88 (38756908)
---[ end trace abbff69097bf988f ]---
4: f9400288 ldr x8, [x20]
8: 91014114 add x20, x8, #0x50
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1fe619a7d252 Linux 5.15.113
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1437a7fe280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8f10ee30ae29b021
dashboard link: https://syzkaller.appspot.com/bug?extid=899730ffdd53c2725cfa
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121293d5280000
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1202583e280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1b707a1e1816/disk-1fe619a7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/19cc598a8bbe/vmlinux-1fe619a7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a6cf7269bae5/Image-1fe619a7.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
==================================================================
BUG: KASAN: use-after-free in gsm_cleanup_mux+0x660/0x738 drivers/tty/n_gsm.c:2397
Read of size 4 at addr ffff0000c8b4a00c by task syz-executor242/3967
CPU: 0 PID: 3967 Comm: syz-executor242 Not tainted 5.15.113-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308
gsm_cleanup_mux+0x660/0x738 drivers/tty/n_gsm.c:2397
gsm_config drivers/tty/n_gsm.c:2653 [inline]
gsmld_ioctl+0xa48/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 3962:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x27c/0x47c mm/slub.c:3247
kmalloc include/linux/slab.h:591 [inline]
kzalloc include/linux/slab.h:721 [inline]
gsm_dlci_alloc+0x60/0x340 drivers/tty/n_gsm.c:1932
gsm_activate_mux+0x30/0x300 drivers/tty/n_gsm.c:2438
gsm_config drivers/tty/n_gsm.c:2677 [inline]
gsmld_ioctl+0xc1c/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 3962:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0x178/0x410 mm/slub.c:4559
gsm_dlci_free+0x11c/0x168 drivers/tty/n_gsm.c:1978
tty_port_destructor drivers/tty/tty_port.c:265 [inline]
kref_put include/linux/kref.h:65 [inline]
tty_port_put+0x140/0x1bc drivers/tty/tty_port.c:273
dlci_put drivers/tty/n_gsm.c:1988 [inline]
gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline]
gsm_cleanup_mux+0x488/0x738 drivers/tty/n_gsm.c:2415
gsm_config drivers/tty/n_gsm.c:2653 [inline]
gsmld_ioctl+0xa48/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000c8b4a000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 12 bytes inside of
2048-byte region [ffff0000c8b4a000, ffff0000c8b4a800)
The buggy address is located 12 bytes inside of
The buggy address belongs to the page:
page:0000000003bf807d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108b48
head:0000000003bf807d order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002900
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c8b49f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c8b49f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000c8b4a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c8b4a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000c8b4a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address dfff80000000000a
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff80000000000a] address between user and kernel address ranges
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3967 Comm: syz-executor242 Tainted: G B 5.15.113-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : tty_write_room+0x48/0x8c drivers/tty/tty_ioctl.c:78
lr : tty_write_room+0x3c/0x8c drivers/tty/tty_ioctl.c:78
sp : ffff80001cdc7810
x29: ffff80001cdc7810 x28: 0000000000000001 x27: dfff800000000000
x26: 1ffff000039b8f14 x25: 0000000000000000 x24: 1fffe00019984cc0
x23: dfff800000000000 x22: 0000000000000f7a x21: dfff800000000000
x20: 0000000000000050 x19: ffff0000c7838a00 x18: 0000000000000000
x17: ff8080000b3ef030 x16: 0000000000000000 x15: ffff80000b3ef030
x14: 0000000000000002 x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000b3d191c x10: 0000000000000000 x9 : ffff80001842e390
x8 : 000000000000000a x7 : 0000000000000000 x6 : ffff800008268c6c
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000b3d1934
x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
tty_write_room+0x48/0x8c drivers/tty/tty_ioctl.c:78
gsmld_output+0x4c/0x1d0 drivers/tty/n_gsm.c:2698
gsm_send+0x4dc/0x798 drivers/tty/n_gsm.c:707
gsm_command drivers/tty/n_gsm.c:736 [inline]
gsm_dlci_begin_close drivers/tty/n_gsm.c:1801 [inline]
gsm_cleanup_mux+0x1a0/0x738 drivers/tty/n_gsm.c:2398
gsm_config drivers/tty/n_gsm.c:2653 [inline]
gsmld_ioctl+0xa48/0x13d8 drivers/tty/n_gsm.c:2986
tty_ioctl+0x954/0xdf4 drivers/tty/tty_io.c:2816
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 9753d81a f9400288 91014114 d343fe88 (38756908)
---[ end trace abbff69097bf988f ]---
----------------
Code disassembly (best guess):
0: 9753d81a bl 0xfffffffffd4f6068
Code disassembly (best guess):
4: f9400288 ldr x8, [x20]
8: 91014114 add x20, x8, #0x50
c: d343fe88 lsr x8, x20, #3
* 10: 38756908 ldrb w8, [x8, x21] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Sep 11, 2023, 3:30:48 AM9/11/23
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 31311a9a4baae0ad47c85e448af21b2120344ff0
Author: Yi Yang <yiya...@huawei.com>
Date: Fri Aug 11 03:11:21 2023 +0000
tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17bb13a4680000
start commit: e84a4e368abe Linux 6.1.35
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=a69b5c9de715622a
dashboard link: https://syzkaller.appspot.com/bug?extid=947ecd0ac8b5b531dcc9
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127091bf280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d6df50a80000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 31311a9a4baae0ad47c85e448af21b2120344ff0
Author: Yi Yang <yiya...@huawei.com>
Date: Fri Aug 11 03:11:21 2023 +0000
tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17bb13a4680000
start commit: e84a4e368abe Linux 6.1.35
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=a69b5c9de715622a
dashboard link: https://syzkaller.appspot.com/bug?extid=947ecd0ac8b5b531dcc9
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127091bf280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d6df50a80000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Sep 30, 2023, 7:33:42 PM9/30/23
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages