KASAN: use-after-free Read in filp_close
25 views
Skip to first unread message
syzbot
Jan 11, 2021, 7:38:19 AM1/11/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c9951e5d Merge 5.4.88 into android12-5.4
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1715b020d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3cb352affb0dbcb
dashboard link: https://syzkaller.appspot.com/bug?extid=53897bcb31b82c7a08fe
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+53897b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in filp_close+0x31/0x140 fs/open.c:1164
Read of size 8 at addr ffff8881a8029df8 by task syz-executor.5/1624
CPU: 0 PID: 1624 Comm: syz-executor.5 Not tainted 5.4.88-syzkaller-00116-gc9951e5d80dd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
check_memory_region_inline mm/kasan/generic.c:181 [inline]
check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:191
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
filp_close+0x31/0x140 fs/open.c:1164
__do_sys_close fs/open.c:1189 [inline]
__se_sys_close fs/open.c:1187 [inline]
__x64_sys_close+0x62/0xb0 fs/open.c:1187
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x417b71
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffebb71b620 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000417b71
RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00000000011a04f8 R09: 0000000000000000
R10: 00007ffebb71b6f0 R11: 0000000000000293 R12: ffffffffffffffff
R13: 0000000000000000 R14: 0000000000000005 R15: 000000000119bf8c
Allocated by task 1629:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
__alloc_file+0x26/0x390 fs/file_table.c:101
alloc_empty_file+0xa9/0x1b0 fs/file_table.c:151
path_openat+0x11b/0x3c20 fs/namei.c:3601
do_filp_open+0x20a/0x440 fs/namei.c:3642
do_sys_open+0x380/0x7b0 fs/open.c:1093
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 1624:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12c/0x660 mm/slub.c:4017
put_fs_context+0x57c/0x690 fs/fs_context.c:509
fscontext_release+0x61/0x80 fs/fsopen.c:73
__fput+0x27d/0x6c0 fs/file_table.c:281
task_work_run+0x176/0x1a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop arch/x86/entry/common.c:163 [inline]
prepare_exit_to_usermode+0x2b0/0x310 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881a8029dc0
which belongs to the cache filp of size 256
The buggy address is located 56 bytes inside of
256-byte region [ffff8881a8029dc0, ffff8881a8029ec0)
The buggy address belongs to the page:
page:ffffea0006a00a40 refcount:1 mapcount:0 mapping:ffff8881f60fa500 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881f60fa500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881a8029c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881a8029d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881a8029d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8881a8029e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881a8029e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: c9951e5d Merge 5.4.88 into android12-5.4
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1715b020d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3cb352affb0dbcb
dashboard link: https://syzkaller.appspot.com/bug?extid=53897bcb31b82c7a08fe
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+53897b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in filp_close+0x31/0x140 fs/open.c:1164
Read of size 8 at addr ffff8881a8029df8 by task syz-executor.5/1624
CPU: 0 PID: 1624 Comm: syz-executor.5 Not tainted 5.4.88-syzkaller-00116-gc9951e5d80dd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
check_memory_region_inline mm/kasan/generic.c:181 [inline]
check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:191
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
filp_close+0x31/0x140 fs/open.c:1164
__do_sys_close fs/open.c:1189 [inline]
__se_sys_close fs/open.c:1187 [inline]
__x64_sys_close+0x62/0xb0 fs/open.c:1187
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x417b71
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffebb71b620 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000417b71
RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000004
RBP: 0000000000000000 R08: 00000000011a04f8 R09: 0000000000000000
R10: 00007ffebb71b6f0 R11: 0000000000000293 R12: ffffffffffffffff
R13: 0000000000000000 R14: 0000000000000005 R15: 000000000119bf8c
Allocated by task 1629:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
__alloc_file+0x26/0x390 fs/file_table.c:101
alloc_empty_file+0xa9/0x1b0 fs/file_table.c:151
path_openat+0x11b/0x3c20 fs/namei.c:3601
do_filp_open+0x20a/0x440 fs/namei.c:3642
do_sys_open+0x380/0x7b0 fs/open.c:1093
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 1624:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12c/0x660 mm/slub.c:4017
put_fs_context+0x57c/0x690 fs/fs_context.c:509
fscontext_release+0x61/0x80 fs/fsopen.c:73
__fput+0x27d/0x6c0 fs/file_table.c:281
task_work_run+0x176/0x1a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop arch/x86/entry/common.c:163 [inline]
prepare_exit_to_usermode+0x2b0/0x310 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881a8029dc0
which belongs to the cache filp of size 256
The buggy address is located 56 bytes inside of
256-byte region [ffff8881a8029dc0, ffff8881a8029ec0)
The buggy address belongs to the page:
page:ffffea0006a00a40 refcount:1 mapcount:0 mapping:ffff8881f60fa500 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881f60fa500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881a8029c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881a8029d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881a8029d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8881a8029e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881a8029e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Jan 11, 2021, 7:50:14 AM1/11/21
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: c9951e5d Merge 5.4.88 into android12-5.4
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1037c30b500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162460af500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+53897b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in filp_close+0x31/0x140 fs/open.c:1164
Read of size 8 at addr ffff8881e9dbbb78 by task syz-executor656/358
CPU: 1 PID: 358 Comm: syz-executor656 Not tainted 5.4.88-syzkaller-00116-gc9951e5d80dd #0
Code: 01 f0 ff ff 0f 83 20 0c 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 9d 17 2d 00 00 75 14 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 f4 0b 00 00 c3 48 83 ec 08 e8 5a 01 00 00
RSP: 002b:00007fff0b9dea78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000400f30
RDX: 0000000020000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fff0b9dea80 R08: 0000000000000004 R09: 0000000120080522
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004a22b0
R13: 0000000000402040 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 358:
flags: 0x8000000000000200(slab)
raw: 8000000000000200 0000000000000000 0000000100000001 ffff8881f60fa780
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
ffff8881e9dbba80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881e9dbbb00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8881e9dbbb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e9dbbc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
CPU: 1 PID: 358 Comm: syz-executor656 Tainted: G B 5.4.88-syzkaller-00116-gc9951e5d80dd #0
end_report mm/kasan/report.c:96 [inline]
__kasan_report+0x1e8/0x1f0 mm/kasan/report.c:513
kasan_report+0x30/0x60 mm/kasan/common.c:634
Code: 01 f0 ff ff 0f 83 20 0c 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 9d 17 2d 00 00 75 14 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 f4 0b 00 00 c3 48 83 ec 08 e8 5a 01 00 00
RSP: 002b:00007fff0b9dea78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000400f30
RDX: 0000000020000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fff0b9dea80 R08: 0000000000000004 R09: 0000000120080522
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004a22b0
R13: 0000000000402040 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
HEAD commit: c9951e5d Merge 5.4.88 into android12-5.4
git tree: android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=f3cb352affb0dbcb
dashboard link: https://syzkaller.appspot.com/bug?extid=53897bcb31b82c7a08fe
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=141068d7500000
dashboard link: https://syzkaller.appspot.com/bug?extid=53897bcb31b82c7a08fe
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162460af500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+53897b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
BUG: KASAN: use-after-free in filp_close+0x31/0x140 fs/open.c:1164
CPU: 1 PID: 358 Comm: syz-executor656 Not tainted 5.4.88-syzkaller-00116-gc9951e5d80dd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
check_memory_region_inline mm/kasan/generic.c:181 [inline]
check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:191
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
filp_close+0x31/0x140 fs/open.c:1164
__do_sys_close fs/open.c:1189 [inline]
__se_sys_close fs/open.c:1187 [inline]
__x64_sys_close+0x62/0xb0 fs/open.c:1187
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x400f30
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
__kasan_report+0x177/0x1f0 mm/kasan/report.c:506
kasan_report+0x30/0x60 mm/kasan/common.c:634
check_memory_region_inline mm/kasan/generic.c:181 [inline]
check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:191
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
filp_close+0x31/0x140 fs/open.c:1164
__do_sys_close fs/open.c:1189 [inline]
__se_sys_close fs/open.c:1187 [inline]
__x64_sys_close+0x62/0xb0 fs/open.c:1187
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: 01 f0 ff ff 0f 83 20 0c 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 9d 17 2d 00 00 75 14 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 f4 0b 00 00 c3 48 83 ec 08 e8 5a 01 00 00
RSP: 002b:00007fff0b9dea78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000400f30
RDX: 0000000020000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fff0b9dea80 R08: 0000000000000004 R09: 0000000120080522
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004a22b0
R13: 0000000000402040 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 358:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
__alloc_file+0x26/0x390 fs/file_table.c:101
alloc_empty_file+0xa9/0x1b0 fs/file_table.c:151
path_openat+0x11b/0x3c20 fs/namei.c:3601
do_filp_open+0x20a/0x440 fs/namei.c:3642
do_sys_open+0x380/0x7b0 fs/open.c:1093
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 358:
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
__alloc_file+0x26/0x390 fs/file_table.c:101
alloc_empty_file+0xa9/0x1b0 fs/file_table.c:151
path_openat+0x11b/0x3c20 fs/namei.c:3601
do_filp_open+0x20a/0x440 fs/namei.c:3642
do_sys_open+0x380/0x7b0 fs/open.c:1093
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12c/0x660 mm/slub.c:4017
put_fs_context+0x57c/0x690 fs/fs_context.c:509
fscontext_release+0x61/0x80 fs/fsopen.c:73
__fput+0x27d/0x6c0 fs/file_table.c:281
task_work_run+0x176/0x1a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop arch/x86/entry/common.c:163 [inline]
prepare_exit_to_usermode+0x2b0/0x310 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881e9dbbb40
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12c/0x660 mm/slub.c:4017
put_fs_context+0x57c/0x690 fs/fs_context.c:509
fscontext_release+0x61/0x80 fs/fsopen.c:73
__fput+0x27d/0x6c0 fs/file_table.c:281
task_work_run+0x176/0x1a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop arch/x86/entry/common.c:163 [inline]
prepare_exit_to_usermode+0x2b0/0x310 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x44/0xa9
which belongs to the cache filp of size 256
The buggy address is located 56 bytes inside of
256-byte region [ffff8881e9dbbb40, ffff8881e9dbbc40)
The buggy address is located 56 bytes inside of
The buggy address belongs to the page:
page:ffffea0007a76ec0 refcount:1 mapcount:0 mapping:ffff8881f60fa780 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 0000000000000000 0000000100000001 ffff8881f60fa780
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881e9dbba00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Memory state around the buggy address:
ffff8881e9dbba80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881e9dbbb00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8881e9dbbb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e9dbbc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
CPU: 1 PID: 358 Comm: syz-executor656 Tainted: G B 5.4.88-syzkaller-00116-gc9951e5d80dd #0
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
panic+0x285/0x750 kernel/panic.c:221
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
end_report mm/kasan/report.c:96 [inline]
__kasan_report+0x1e8/0x1f0 mm/kasan/report.c:513
kasan_report+0x30/0x60 mm/kasan/common.c:634
atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
filp_close+0x31/0x140 fs/open.c:1164
__do_sys_close fs/open.c:1189 [inline]
__se_sys_close fs/open.c:1187 [inline]
__x64_sys_close+0x62/0xb0 fs/open.c:1187
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x400f30
atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
filp_close+0x31/0x140 fs/open.c:1164
__do_sys_close fs/open.c:1189 [inline]
__se_sys_close fs/open.c:1187 [inline]
__x64_sys_close+0x62/0xb0 fs/open.c:1187
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: 01 f0 ff ff 0f 83 20 0c 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 9d 17 2d 00 00 75 14 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 f4 0b 00 00 c3 48 83 ec 08 e8 5a 01 00 00
RSP: 002b:00007fff0b9dea78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000400f30
RDX: 0000000020000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fff0b9dea80 R08: 0000000000000004 R09: 0000000120080522
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004a22b0
R13: 0000000000402040 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
syzbot
Apr 20, 2023, 10:05:35 PM4/20/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages