[moderation] [fs?] KASAN: out-of-bounds Read in proc_pid_stack (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 77ae27fd98f3 Merge tag 'printk-for-7.3' of git://git.kerne..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15f75549580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c2a52d7740f24c3c
dashboard link: https://syzkaller.appspot.com/bug?extid=8f7fb5704be2c5784ac5
compiler: riscv64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: riscv64
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/a741b348759c/non_bootable_disk-77ae27fd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/314bacb300ef/vmlinux-77ae27fd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/435453173fd8/Image-77ae27fd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f7fb5...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: out-of-bounds in walk_stackframe+0x512/0x56a arch/riscv/kernel/stacktrace.c:88
Read of size 8 at addr ffff8f800a077890 by task syz.0.5/3893

CPU: 1 UID: 0 PID: 3893 Comm: syz.0.5 Not tainted syzkaller #0 PREEMPT
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8007e614>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149
[<ffffffff80003112>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155
[<ffffffff800630cc>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff800630cc>] dump_stack_lvl+0x114/0x1aa lib/dump_stack.c:120
[<ffffffff8000e264>] print_address_description mm/kasan/report.c:378 [inline]
[<ffffffff8000e264>] print_report+0x27a/0x592 mm/kasan/report.c:482
[<ffffffff80bf8576>] kasan_report+0xf0/0x26c mm/kasan/report.c:595
[<ffffffff80bfa226>] __asan_report_load8_noabort+0x12/0x1a mm/kasan/report_generic.c:381
[<ffffffff8007e0d0>] walk_stackframe+0x512/0x56a arch/riscv/kernel/stacktrace.c:88
[<ffffffff86594bd4>] arch_stack_walk+0x1c/0x24 arch/riscv/kernel/stacktrace.c:182
[<ffffffff803f99b2>] stack_trace_save_tsk+0x164/0x1f2 kernel/stacktrace.c:150
[<ffffffff80f94ea6>] proc_pid_stack+0x16c/0x278 fs/proc/base.c:490
[<ffffffff80f970bc>] proc_single_show+0xea/0x1ca fs/proc/base.c:793
[<ffffffff80dd2ef4>] traverse.part.0.constprop.0+0x126/0x542 fs/seq_file.c:112
[<ffffffff80dd3b08>] traverse fs/seq_file.c:99 [inline]
[<ffffffff80dd3b08>] seq_read_iter+0x7f8/0x1090 fs/seq_file.c:196
[<ffffffff80dd4654>] seq_read+0x2b4/0x434 fs/seq_file.c:163
[<ffffffff80d0743e>] vfs_read+0x2a2/0xbc6 fs/read_write.c:572
[<ffffffff80d0a63a>] ksys_pread64 fs/read_write.c:764 [inline]
[<ffffffff80d0a63a>] __do_sys_pread64 fs/read_write.c:772 [inline]
[<ffffffff80d0a63a>] __se_sys_pread64 fs/read_write.c:769 [inline]
[<ffffffff80d0a63a>] __riscv_sys_pread64+0x1d6/0x230 fs/read_write.c:769
[<ffffffff8007af94>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff86594576>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff865c0d08>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237

The buggy address belongs to a 8-page vmalloc region starting at 0xffff8f800a070000 allocated at kernel_clone+0x198/0xf7c kernel/fork.c:2772
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb1497
memcg:ffffaf802022f902
flags: 0x0(node=0|zone=0)
raw: 0000000000000000 0000000000000000 ffff8d8002c525c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffffaf802022f902
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 3443, tgid 3443 (kworker/u8:5), ts 1028450241900, free_ts 993049465600
__set_page_owner+0x92/0x4b0 mm/page_owner.c:341
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xe4/0x1a0 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x914/0x3950 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x224/0x2e58 mm/page_alloc.c:5304
alloc_pages_mpol+0x1f0/0x59c mm/mempolicy.c:2490
alloc_frozen_pages_noprof+0x156/0x2ce mm/mempolicy.c:2561
alloc_pages_noprof+0x20/0x140 mm/mempolicy.c:2581
vm_area_alloc_pages mm/vmalloc.c:3689 [inline]
__vmalloc_area_node mm/vmalloc.c:3914 [inline]
__vmalloc_node_range_noprof+0x103e/0x1b34 mm/vmalloc.c:4104
__vmalloc_node_noprof+0xfc/0x132 mm/vmalloc.c:4165
alloc_thread_stack_node kernel/fork.c:359 [inline]
dup_task_struct kernel/fork.c:930 [inline]
copy_process+0x762/0x81b6 kernel/fork.c:2139
kernel_clone+0x198/0xf7c kernel/fork.c:2772
user_mode_thread+0xd8/0x114 kernel/fork.c:2849
call_usermodehelper_exec_sync kernel/umh.c:130 [inline]
call_usermodehelper_exec_work+0x6e/0x196 kernel/umh.c:161
process_one_work+0x9c6/0x22b2 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x532/0xcaa kernel/workqueue.c:3551
kthread+0x312/0x438 kernel/kthread.c:436
page last free pid 3254 tgid 3254 stack trace:
__reset_page_owner+0x76/0x1bc mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x6b2/0x136e mm/page_alloc.c:2950
free_frozen_pages+0xe/0x16 mm/page_alloc.c:2988
__free_slab+0xda/0x250 mm/slub.c:3441
free_slab+0x28/0x16c mm/slub.c:3475
discard_slab mm/slub.c:3481 [inline]
__slab_free+0x23c/0x2f8 mm/slub.c:5741
___cache_free+0x94/0xac mm/slub.c:6449
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x64/0x134 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x152/0x1b4 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x5c/0x82 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
__do_kmalloc_node mm/slub.c:5333 [inline]
__kmalloc_noprof+0x25e/0x8cc mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
fib6_info_alloc+0x46/0x142 net/ipv6/ip6_fib.c:155
ip6_route_info_create+0x128/0x8d4 net/ipv6/route.c:3833
ip6_route_add+0x4a/0x1ca net/ipv6/route.c:3962
addrconf_prefix_route+0x2b0/0x4d0 net/ipv6/addrconf.c:2504
inet6_addr_add+0x456/0x89e net/ipv6/addrconf.c:3077

Memory state around the buggy address:
ffff8f800a077780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8f800a077800: 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00 00 00
>ffff8f800a077880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8f800a077900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8f800a077980: f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup