From: syzbot <syzbot+dcfe8e1b5dfc52d34d0d@syzkaller.appspotmail.com>
To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: [syzbot] [vfs?] KASAN: use-after-free Write in pipe_poll
Date: Thu, 12 Jan 2023 02:13:40 -0800 [thread overview]
Message-ID: <000000000000f904fc05f20e5eb9@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=134c4d16480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=dcfe8e1b5dfc52d34d0d
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dcfe8e1b5dfc52d34d0d@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in pipe_poll+0x64d/0x7d0 fs/pipe.c:656
Write of size 1 at addr ffff8880231edd5c by task syz-executor.1/11063
CPU: 0 PID: 11063 Comm: syz-executor.1 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
pipe_poll+0x64d/0x7d0 fs/pipe.c:656
vfs_poll include/linux/poll.h:88 [inline]
io_poll_check_events io_uring/poll.c:279 [inline]
io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327
handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169
tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224
task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc34b68c0c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc34c41c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fc34b7abf88 RCX: 00007fc34b68c0c9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc34b7abf88
RBP: 00007fc34b7abf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc34b7abf8c
R13: 00007ffe7e36d89f R14: 00007fc34c41c300 R15: 0000000000022000
</TASK>
Allocated by task 11063:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
alloc_pipe_info+0x10e/0x590 fs/pipe.c:790
get_pipe_inode fs/pipe.c:881 [inline]
create_pipe_files+0x93/0x8d0 fs/pipe.c:913
__do_pipe_flags fs/pipe.c:962 [inline]
do_pipe2+0x96/0x1b0 fs/pipe.c:1010
__do_sys_pipe fs/pipe.c:1033 [inline]
__se_sys_pipe fs/pipe.c:1031 [inline]
__x64_sys_pipe+0x33/0x40 fs/pipe.c:1031
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 11062:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800
put_pipe_info fs/pipe.c:711 [inline]
pipe_release+0x2ba/0x310 fs/pipe.c:734
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff8880231edc00
which belongs to the cache kmalloc-cg-512 of size 512
The buggy address is located 348 bytes inside of
512-byte region [ffff8880231edc00, ffff8880231ede00)
The buggy address belongs to the physical page:
page:ffffea00008c7b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x231ec
head:ffffea00008c7b00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880285b5901
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffff88801244f140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff ffff8880285b5901
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10953, tgid 10950 (syz-executor.2), ts 766638397032, free_ts 762478646412
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
__kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc_node_track_caller+0x4b/0xc0 mm/slab_common.c:987
kmalloc_reserve net/core/skbuff.c:490 [inline]
__alloc_skb+0xe9/0x310 net/core/skbuff.c:563
alloc_skb include/linux/skbuff.h:1270 [inline]
alloc_skb_with_frags+0x97/0x6c0 net/core/skbuff.c:6193
sock_alloc_send_pskb+0x7a7/0x930 net/core/sock.c:2741
unix_dgram_sendmsg+0x419/0x1c30 net/unix/af_unix.c:1943
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xd3/0x120 net/socket.c:734
____sys_sendmsg+0x334/0x8c0 net/socket.c:2476
___sys_sendmsg+0x110/0x1b0 net/socket.c:2530
__sys_sendmmsg+0x18f/0x460 net/socket.c:2616
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2637
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x17c/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc_node+0x4d/0xd0 mm/slab_common.c:974
kmalloc_array_node include/linux/slab.h:697 [inline]
kcalloc_node include/linux/slab.h:702 [inline]
memcg_alloc_slab_cgroups+0x8f/0x150 mm/memcontrol.c:2899
memcg_slab_post_alloc_hook+0xa9/0x390 mm/slab.h:546
slab_post_alloc_hook mm/slab.h:777 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
kmem_cache_alloc_node+0x1b3/0x350 mm/slub.c:3497
__alloc_skb+0x216/0x310 net/core/skbuff.c:550
alloc_skb include/linux/skbuff.h:1270 [inline]
alloc_skb_with_frags+0x97/0x6c0 net/core/skbuff.c:6193
sock_alloc_send_pskb+0x7a7/0x930 net/core/sock.c:2741
unix_dgram_sendmsg+0x419/0x1c30 net/unix/af_unix.c:1943
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xd3/0x120 net/socket.c:734
Memory state around the buggy address:
ffff8880231edc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880231edc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880231edd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880231edd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880231ede00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
reply other threads:[~2023-01-12 10:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000f904fc05f20e5eb9@google.com \
--to=syzbot+dcfe8e1b5dfc52d34d0d@syzkaller.appspotmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.