KASAN: use-after-free Read in iov_iter_revert

10 views
Skip to first unread message

syzbot

unread,
Nov 1, 2017, 2:04:12 PM11/1/17
to syzkaller-upst...@googlegroups.com
Hello,

syzkaller hit the following crash on
e8b684315214053f29f7f78643aefd19da342976
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.


CC: [ak...@linux-foundation.org han...@cmpxchg.org ja...@suse.cz
jla...@redhat.com linux-...@vger.kernel.org linu...@kvack.org
npi...@gmail.com rgol...@suse.com ross.z...@linux.intel.com
vi...@zeniv.linux.org.uk]

==================================================================
BUG: KASAN: use-after-free in iov_iter_revert+0x976/0x9d0 lib/iov_iter.c:890
Read of size 4 at addr ffff88006cf50488 by task loop6/15260

CPU: 0 PID: 15260 Comm: loop6 Not tainted 4.13.0-rc7-next-20170831+ #12
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
kvm_hv_get_msr: 384 callbacks suppressed
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008f
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008e
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008d
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008c
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008b
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008a
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000089
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000088
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000087
kvm [15652]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000086
kvm_hv_set_msr: 135 callbacks suppressed
kvm [15652]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000023
data 0x66c900003b9a1043
kvm [15652]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000022
data 0x66c90000cb211043
kvm [15652]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000023
data 0x66c900003b9a1043
kvm [15652]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000022
data 0x66c90000cb211043
kvm [15652]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000020
data 0x66c9000000091043
print_address_description+0x73/0x250 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x24e/0x340 mm/kasan/report.c:409
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
iov_iter_revert+0x976/0x9d0 lib/iov_iter.c:890
generic_file_read_iter+0x1883/0x26c0 mm/filemap.c:2197
blkdev_read_iter+0x105/0x170 fs/block_dev.c:1918
call_read_iter include/linux/fs.h:1738 [inline]
lo_rw_aio+0x9e9/0xc20 drivers/block/loop.c:501
do_req_filebacked drivers/block/loop.c:539 [inline]
loop_handle_cmd drivers/block/loop.c:1694 [inline]
loop_queue_work+0x1f91/0x3900 drivers/block/loop.c:1708
*** Guest State ***
CR0: actual=0x0000000000000031, shadow=0x0000000060000011,
gh_mask=fffffffffffffff7
CR4: actual=0x00000000002220d0, shadow=0x0000000000220080,
gh_mask=ffffffffffffe871
CR3 = 0x00000000fffbc000
RSP = 0x0000000000000f80 RIP = 0x0000000000000000
RFLAGS=0x00000002 DR7 = 0x0000000000000400
Sysenter RSP=0000000000000f80 CS:RIP=0030:0000000000002810
CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000
DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000
SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000
ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000
FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000
GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000
GDTR: limit=0x000007ff, base=0x0000000000001000
LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800
IDTR: limit=0x000001ff, base=0x0000000000003800
TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000
EFER = 0x0000000000000001 PAT = 0x0007040600070406
DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000
BndCfgS = 0x0000000000000000
Interruptibility = 00000000 ActivityState = 00000000
*** Host State ***
RIP = 0xffffffff811b8e2f RSP = 0xffff880038d3f4c8
CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
FSBase=00007f79fd118700 GSBase=ffff88006df00000 TRBase=ffff88006df23100
GDTBase=ffffffffff574000 IDTBase=ffffffffff57b000
CR0=0000000080050033 CR3=000000006bc5f000 CR4=00000000000026e0
Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff84d3fc80
EFER = 0x0000000000000d01 PAT = 0x0007040600070406
*** Control State ***
PinBased=0000003f CPUBased=b699edfa SecondaryExec=000000e2
EntryControls=0001d1ff ExitControls=00afefff
ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000
VMEntry: intr_info=00000b0d errcode=00000000 ilen=00000000
VMExit: intr_info=00000000 errcode=00000000 ilen=00000000
reason=80000021 qualification=0000000000000000
IDTVectoring: info=00000000 errcode=00000000
TSC Offset = 0xffffffc5a63df9d6
EPT pointer = 0x00000000698d701e
Virtual processor ID = 0x011c
kthread_worker_fn+0x340/0x9b0 kernel/kthread.c:635
loop_kthread_worker_fn+0x51/0x60 drivers/block/loop.c:850
kthread+0x39c/0x470 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

Allocated by task 15657:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
kmem_cache_alloc+0x12e/0x760 mm/slab.c:3561
mempool_alloc_slab+0x44/0x60 mm/mempool.c:449
mempool_alloc+0x16a/0x4b0 mm/mempool.c:329
bio_alloc_bioset+0x3c7/0x750 block/bio.c:486
bio_alloc include/linux/bio.h:417 [inline]
submit_bh_wbc+0x104/0x680 fs/buffer.c:3110
submit_bh fs/buffer.c:3142 [inline]
block_read_full_page+0x6cf/0x950 fs/buffer.c:2355
blkdev_readpage+0x1c/0x20 fs/block_dev.c:583
do_generic_file_read mm/filemap.c:2082 [inline]
generic_file_read_iter+0x1286/0x26c0 mm/filemap.c:2213
blkdev_read_iter+0x105/0x170 fs/block_dev.c:1918
call_read_iter include/linux/fs.h:1738 [inline]
new_sync_read fs/read_write.c:400 [inline]
__vfs_read+0x6ad/0xa00 fs/read_write.c:412
vfs_read+0x124/0x360 fs/read_write.c:433
SYSC_read fs/read_write.c:549 [inline]
SyS_read+0xef/0x220 fs/read_write.c:542
entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 0:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x77/0x280 mm/slab.c:3763
mempool_free_slab+0x1d/0x30 mm/mempool.c:456
mempool_free+0xd4/0x1d0 mm/mempool.c:438
bio_free+0x11c/0x190 block/bio.c:265
bio_put+0x14f/0x180 block/bio.c:558
end_bio_bh_io_sync+0xcd/0x110 fs/buffer.c:3038
bio_endio+0x2f8/0x8d0 block/bio.c:1843
req_bio_endio block/blk-core.c:204 [inline]
blk_update_request+0x2a6/0xe20 block/blk-core.c:2738
blk_mq_end_request+0x54/0x120 block/blk-mq.c:509
lo_complete_rq+0xbe/0x1f0 drivers/block/loop.c:460
__blk_mq_complete_request_remote+0x58/0x70 block/blk-mq.c:519
flush_smp_call_function_queue+0x2d6/0x450 kernel/smp.c:247
generic_smp_call_function_single_interrupt+0x13/0x30 kernel/smp.c:192
smp_call_function_single_interrupt+0x10f/0x650 arch/x86/kernel/smp.c:295

The buggy address belongs to the object at ffff88006cf50400
which belongs to the cache bio-0 of size 192
The buggy address is located 136 bytes inside of
192-byte region [ffff88006cf50400, ffff88006cf504c0)
The buggy address belongs to the page:
page:ffffea0001b3d400 count:1 mapcount:0 mapping:ffff88006cf50000 index:0x0
flags: 0x500000000000100(slab)
raw: 0500000000000100 ffff88006cf50000 0000000000000000 0000000100000010
raw: ffffea0001a855a0 ffff88006c2b3550 ffff88006c01b840 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88006cf50380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff88006cf50400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88006cf50480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88006cf50500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88006cf50580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.
Please credit me with: Reported-by: syzbot <syzk...@googlegroups.com>

syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line.
To upstream this report, please reply with:
#syz upstream
config.txt
raw.log

Dmitry Vyukov

unread,
Nov 5, 2017, 4:00:13 AM11/5/17
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
Stopped happening in Sep, probably was fixed

#syz invalid


On Wed, Nov 1, 2017 at 9:04 PM, syzbot
<bot+4aae4dea58c5b592b8...@syzkaller.appspotmail.com>
wrote:
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To post to this group, send email to
> syzkaller-upst...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/001a114498f6ae4dc0055cefb256%40google.com.
> For more options, visit https://groups.google.com/d/optout.
Reply all
Reply to author
Forward
0 new messages