KASAN: use-after-free Read in rb_first_postorder

2 messages, 2 authors, 2018-01-10 · open the first message on its own page

KASAN: use-after-free Read in rb_first_postorder

From: syzbot <hidden>
Date: 2018-01-09 22:58:12 

Hello,

syzkaller hit the following crash on  
61ad64080e039dce99a7f8d89b729bbea995e2f7
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e3eeae78ea88b8d6d858@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for  
details.
If you forward the report, please keep this part and the footer.

audit: type=1400 audit(1515534326.722:7): avc:  denied  { map } for   
pid=3495 comm="syzkaller785641" path="/root/syzkaller785641882" dev="sda1"  
ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023  
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: use-after-free in rb_first_postorder+0x7c/0xa0 lib/rbtree.c:671
Read of size 8 at addr ffff8801d9929c00 by task syzkaller785641/3495

CPU: 0 PID: 3495 Comm: syzkaller785641 Not tainted 4.15.0-rc7+ #181
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  print_address_description+0x73/0x250 mm/kasan/report.c:252
  kasan_report_error mm/kasan/report.c:351 [inline]
  kasan_report+0x25b/0x340 mm/kasan/report.c:409
  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
  rb_first_postorder+0x7c/0xa0 lib/rbtree.c:671
  tipc_group_join+0x120/0x2d0 net/tipc/group.c:210
  tipc_sk_join net/tipc/socket.c:2781 [inline]
  tipc_setsockopt+0x67e/0xcc0 net/tipc/socket.c:2876
  SYSC_setsockopt net/socket.c:1821 [inline]
  SyS_setsockopt+0x189/0x360 net/socket.c:1800
  entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x43fca9
RSP: 002b:00007ffe286872e8 EFLAGS: 00000203 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fca9
RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000010 R09: 0000000000000000
R10: 0000000020540ff0 R11: 0000000000000203 R12: 0000000000401610
R13: 00000000004016a0 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 3495:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
  kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3610
  kmalloc include/linux/slab.h:499 [inline]
  kzalloc include/linux/slab.h:688 [inline]
  tipc_group_create+0x144/0x900 net/tipc/group.c:180
  tipc_sk_join net/tipc/socket.c:2762 [inline]
  tipc_setsockopt+0x274/0xcc0 net/tipc/socket.c:2876
  SYSC_setsockopt net/socket.c:1821 [inline]
  SyS_setsockopt+0x189/0x360 net/socket.c:1800
  entry_SYSCALL_64_fastpath+0x23/0x9a

Freed by task 3495:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
  __cache_free mm/slab.c:3488 [inline]
  kfree+0xd6/0x260 mm/slab.c:3803
  tipc_group_delete+0x2c8/0x3d0 net/tipc/group.c:234
  tipc_sk_join net/tipc/socket.c:2775 [inline]
  tipc_setsockopt+0xba3/0xcc0 net/tipc/socket.c:2876
  SYSC_setsockopt net/socket.c:1821 [inline]
  SyS_setsockopt+0x189/0x360 net/socket.c:1800
  entry_SYSCALL_64_fastpath+0x23/0x9a

The buggy address belongs to the object at ffff8801d9929c00
  which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
  128-byte region [ffff8801d9929c00, ffff8801d9929c80)
The buggy address belongs to the page:
page:ffffea0007664a40 count:1 mapcount:0 mapping:ffff8801d9929000 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801d9929000 0000000000000000 0000000100000015
raw: ffffea0007660ca0 ffffea0007665020 ffff8801dac00640 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801d9929b00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
  ffff8801d9929b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff8801d9929c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff8801d9929c80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
  ffff8801d9929d00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
==================================================================


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.

Re: KASAN: use-after-free Read in rb_first_postorder

From: Cong Wang <hidden>
Date: 2018-01-10 19:34:44 

On Tue, Jan 9, 2018 at 2:58 PM, syzbot
[off-list ref] wrote:
Hello,

syzkaller hit the following crash on
61ad64080e039dce99a7f8d89b729bbea995e2f7
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e3eeae78ea88b8d6d858@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

audit: type=1400 audit(1515534326.722:7): avc:  denied  { map } for
pid=3495 comm="syzkaller785641" path="/root/syzkaller785641882" dev="sda1"
ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: use-after-free in rb_first_postorder+0x7c/0xa0 lib/rbtree.c:671
Read of size 8 at addr ffff8801d9929c00 by task syzkaller785641/3495

CPU: 0 PID: 3495 Comm: syzkaller785641 Not tainted 4.15.0-rc7+ #181
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
 rb_first_postorder+0x7c/0xa0 lib/rbtree.c:671
 tipc_group_join+0x120/0x2d0 net/tipc/group.c:210
 tipc_sk_join net/tipc/socket.c:2781 [inline]
 tipc_setsockopt+0x67e/0xcc0 net/tipc/socket.c:2876
 SYSC_setsockopt net/socket.c:1821 [inline]
 SyS_setsockopt+0x189/0x360 net/socket.c:1800
 entry_SYSCALL_64_fastpath+0x23/0x9a
Blame this:

commit d12d2e12cec2d66eab6cd58f592dad9fd386b97d
Author: Jon Maloy [off-list ref]
Date:   Mon Jan 8 21:03:28 2018 +0100

    tipc: send out join messages as soon as new member is discovered


which assumes a return when tipc_sk_publish() fails but we don't.


RIP: 0033:0x43fca9
RSP: 002b:00007ffe286872e8 EFLAGS: 00000203 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fca9
RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000010 R09: 0000000000000000
R10: 0000000020540ff0 R11: 0000000000000203 R12: 0000000000401610
R13: 00000000004016a0 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 3495:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3610
 kmalloc include/linux/slab.h:499 [inline]
 kzalloc include/linux/slab.h:688 [inline]
 tipc_group_create+0x144/0x900 net/tipc/group.c:180
 tipc_sk_join net/tipc/socket.c:2762 [inline]
 tipc_setsockopt+0x274/0xcc0 net/tipc/socket.c:2876
 SYSC_setsockopt net/socket.c:1821 [inline]
 SyS_setsockopt+0x189/0x360 net/socket.c:1800
 entry_SYSCALL_64_fastpath+0x23/0x9a

Freed by task 3495:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3488 [inline]
 kfree+0xd6/0x260 mm/slab.c:3803
 tipc_group_delete+0x2c8/0x3d0 net/tipc/group.c:234
 tipc_sk_join net/tipc/socket.c:2775 [inline]
 tipc_setsockopt+0xba3/0xcc0 net/tipc/socket.c:2876
 SYSC_setsockopt net/socket.c:1821 [inline]
 SyS_setsockopt+0x189/0x360 net/socket.c:1800
 entry_SYSCALL_64_fastpath+0x23/0x9a

The buggy address belongs to the object at ffff8801d9929c00
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff8801d9929c00, ffff8801d9929c80)
The buggy address belongs to the page:
page:ffffea0007664a40 count:1 mapcount:0 mapping:ffff8801d9929000 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801d9929000 0000000000000000 0000000100000015
raw: ffffea0007660ca0 ffffea0007665020 ffff8801dac00640 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d9929b00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
 ffff8801d9929b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
quoted
ffff8801d9929c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8801d9929c80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
 ffff8801d9929d00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
==================================================================


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help