[v5.15] KASAN: use-after-free Read in device_shutdown (3)
1 view
Skip to first unread message
syzbot
May 13, 2025, 11:32:29 AMMay 13
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3b8db0e4f263 Linux 5.15.182
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1109f670580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f93aaf95aed43225
dashboard link: https://syzkaller.appspot.com/bug?extid=a2b373e5461814574397
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/12d6dd6d67f0/disk-3b8db0e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/de4236a3bc2f/vmlinux-3b8db0e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5d76187e8d3/bzImage-3b8db0e4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a2b373...@syzkaller.appspotmail.com
kvm: exiting hardware virtualization
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common+0xc85/0x2390 kernel/locking/mutex.c:671
Read of size 8 at addr ffff8880635f5160 by task init/5849
CPU: 1 PID: 5849 Comm: init Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
print_address_description+0x60/0x2d0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xdf/0x130 mm/kasan/report.c:451
__mutex_waiter_is_first kernel/locking/mutex.c:191 [inline]
__mutex_lock_common+0xc85/0x2390 kernel/locking/mutex.c:671
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
device_lock include/linux/device.h:760 [inline]
device_shutdown+0x1fc/0x5e0 drivers/base/core.c:4549
kernel_shutdown_prepare kernel/reboot.c:266 [inline]
kernel_power_off+0x4f/0xb0 kernel/reboot.c:291
__do_sys_reboot kernel/reboot.c:366 [inline]
__se_sys_reboot+0x391/0x3b0 kernel/reboot.c:312
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1c9f6328d3
Code: ff 45 31 c9 6a 13 45 31 c0 31 c9 e8 67 8b f8 ff 48 83 c4 18 c3 66 90 89 fa be 69 19 12 28 bf ad de e1 fe b8 a9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 f1 24 0d 00 f7 d8
RSP: 002b:00007ffd8c485be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a9
RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f1c9f6328d3
RDX: 000000004321fedc RSI: 0000000028121969 RDI: 00000000fee1dead
RBP: 000000004321fedc R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffd8c485bc0 R11: 0000000000000246 R12: 00007f1c9f7d5490
R13: 00007ffd8c485c3c R14: 00007f1c9f80d000 R15: 00005639d48bfd98
</TASK>
Allocated by task 5334:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
nsim_bus_dev_new drivers/net/netdevsim/bus.c:408 [inline]
new_device_store+0x194/0x740 drivers/net/netdevsim/bus.c:302
kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_write+0x14d/0x250 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Freed by task 5619:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0xef/0x2a0 mm/slub.c:4559
nsim_bus_dev_del drivers/net/netdevsim/bus.c:457 [inline]
del_device_store+0x2d0/0x380 drivers/net/netdevsim/bus.c:354
kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_write+0x14d/0x250 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
The buggy address belongs to the object at ffff8880635f5000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 352 bytes inside of
2048-byte region [ffff8880635f5000, ffff8880635f5800)
The buggy address belongs to the page:
page:ffffea00018d7c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x635f0
head:ffffea00018d7c00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016842000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4169, ts 55543100754, free_ts 17066555170
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192
__alloc_pages+0x1e1/0x470 mm/page_alloc.c:5466
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xc0/0x4b0 mm/slub.c:1975
___slab_alloc+0x81e/0xdf0 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc_trace+0x1a5/0x2a0 mm/slub.c:3245
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
ip_fib_net_init net/ipv4/fib_frontend.c:1536 [inline]
fib_net_init+0x134/0x350 net/ipv4/fib_frontend.c:1595
ops_init+0x357/0x600 net/core/net_namespace.c:138
setup_net+0x38d/0x9f0 net/core/net_namespace.c:333
copy_net_ns+0x348/0x5b0 net/core/net_namespace.c:503
create_new_namespaces+0x3d3/0x6f0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x116/0x160 kernel/nsproxy.c:226
ksys_unshare+0x4bc/0x890 kernel/fork.c:3099
__do_sys_unshare kernel/fork.c:3173 [inline]
__se_sys_unshare kernel/fork.c:3171 [inline]
__x64_sys_unshare+0x34/0x40 kernel/fork.c:3171
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
free_unref_page+0x94/0x280 mm/page_alloc.c:3396
free_contig_range+0x96/0xf0 mm/page_alloc.c:9385
destroy_args+0xef/0x8b0 mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x318/0x370 mm/debug_vm_pgtable.c:1331
do_one_initcall+0x1ee/0x680 init/main.c:1302
do_initcall_level+0x137/0x1f0 init/main.c:1375
do_initcalls+0x4b/0x90 init/main.c:1391
kernel_init_freeable+0x3ce/0x560 init/main.c:1615
kernel_init+0x19/0x1b0 init/main.c:1506
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
Memory state around the buggy address:
ffff8880635f5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880635f5080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880635f5100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880635f5180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880635f5200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 3b8db0e4f263 Linux 5.15.182
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1109f670580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f93aaf95aed43225
dashboard link: https://syzkaller.appspot.com/bug?extid=a2b373e5461814574397
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/12d6dd6d67f0/disk-3b8db0e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/de4236a3bc2f/vmlinux-3b8db0e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5d76187e8d3/bzImage-3b8db0e4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a2b373...@syzkaller.appspotmail.com
kvm: exiting hardware virtualization
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common+0xc85/0x2390 kernel/locking/mutex.c:671
Read of size 8 at addr ffff8880635f5160 by task init/5849
CPU: 1 PID: 5849 Comm: init Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
print_address_description+0x60/0x2d0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xdf/0x130 mm/kasan/report.c:451
__mutex_waiter_is_first kernel/locking/mutex.c:191 [inline]
__mutex_lock_common+0xc85/0x2390 kernel/locking/mutex.c:671
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
device_lock include/linux/device.h:760 [inline]
device_shutdown+0x1fc/0x5e0 drivers/base/core.c:4549
kernel_shutdown_prepare kernel/reboot.c:266 [inline]
kernel_power_off+0x4f/0xb0 kernel/reboot.c:291
__do_sys_reboot kernel/reboot.c:366 [inline]
__se_sys_reboot+0x391/0x3b0 kernel/reboot.c:312
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1c9f6328d3
Code: ff 45 31 c9 6a 13 45 31 c0 31 c9 e8 67 8b f8 ff 48 83 c4 18 c3 66 90 89 fa be 69 19 12 28 bf ad de e1 fe b8 a9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 f1 24 0d 00 f7 d8
RSP: 002b:00007ffd8c485be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a9
RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f1c9f6328d3
RDX: 000000004321fedc RSI: 0000000028121969 RDI: 00000000fee1dead
RBP: 000000004321fedc R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffd8c485bc0 R11: 0000000000000246 R12: 00007f1c9f7d5490
R13: 00007ffd8c485c3c R14: 00007f1c9f80d000 R15: 00005639d48bfd98
</TASK>
Allocated by task 5334:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
nsim_bus_dev_new drivers/net/netdevsim/bus.c:408 [inline]
new_device_store+0x194/0x740 drivers/net/netdevsim/bus.c:302
kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_write+0x14d/0x250 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
Freed by task 5619:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0xef/0x2a0 mm/slub.c:4559
nsim_bus_dev_del drivers/net/netdevsim/bus.c:457 [inline]
del_device_store+0x2d0/0x380 drivers/net/netdevsim/bus.c:354
kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_write+0x14d/0x250 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
The buggy address belongs to the object at ffff8880635f5000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 352 bytes inside of
2048-byte region [ffff8880635f5000, ffff8880635f5800)
The buggy address belongs to the page:
page:ffffea00018d7c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x635f0
head:ffffea00018d7c00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016842000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4169, ts 55543100754, free_ts 17066555170
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192
__alloc_pages+0x1e1/0x470 mm/page_alloc.c:5466
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xc0/0x4b0 mm/slub.c:1975
___slab_alloc+0x81e/0xdf0 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc_trace+0x1a5/0x2a0 mm/slub.c:3245
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
ip_fib_net_init net/ipv4/fib_frontend.c:1536 [inline]
fib_net_init+0x134/0x350 net/ipv4/fib_frontend.c:1595
ops_init+0x357/0x600 net/core/net_namespace.c:138
setup_net+0x38d/0x9f0 net/core/net_namespace.c:333
copy_net_ns+0x348/0x5b0 net/core/net_namespace.c:503
create_new_namespaces+0x3d3/0x6f0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x116/0x160 kernel/nsproxy.c:226
ksys_unshare+0x4bc/0x890 kernel/fork.c:3099
__do_sys_unshare kernel/fork.c:3173 [inline]
__se_sys_unshare kernel/fork.c:3171 [inline]
__x64_sys_unshare+0x34/0x40 kernel/fork.c:3171
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
free_unref_page+0x94/0x280 mm/page_alloc.c:3396
free_contig_range+0x96/0xf0 mm/page_alloc.c:9385
destroy_args+0xef/0x8b0 mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x318/0x370 mm/debug_vm_pgtable.c:1331
do_one_initcall+0x1ee/0x680 init/main.c:1302
do_initcall_level+0x137/0x1f0 init/main.c:1375
do_initcalls+0x4b/0x90 init/main.c:1391
kernel_init_freeable+0x3ce/0x560 init/main.c:1615
kernel_init+0x19/0x1b0 init/main.c:1506
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
Memory state around the buggy address:
ffff8880635f5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880635f5080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880635f5100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880635f5180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880635f5200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Sep 3, 2025, 11:39:21 AM (4 days ago) Sep 3
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages