[BUG] apparmor: slab-use-after-free in aa_get_newest_label

[BUG] apparmor: slab-use-after-free in aa_get_newest_label

[Shuangpeng Bai]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in aa_get_newest_label

on commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d (7.4.0-rc1)

To help trigger the bug more reliably, I applied a minimal diagnostic patch
that only adds delays and print statements.

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/882f46b65965336e669fd5ce0e1ee964

I am happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>


==================================================================
BUG: KASAN: slab-use-after-free in aa_get_newest_label (security/apparmor/include/label.h:413)
Read of size 8 at addr ffff888107b7f138 by task bash/346

CPU: 1 UID: 0 PID: 346 Comm: bash Not tainted 7.4.0-rc1-g05441d697f7f-dirty #1 PREEMPT(full) 
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
 print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
 kasan_report (mm/kasan/report.c:595)
 aa_get_newest_label (security/apparmor/include/label.h:413)
 find_attach (security/apparmor/include/policy.h:328 security/apparmor/domain.c:516)
 profile_transition (security/apparmor/domain.c:711)
 apparmor_bprm_creds_for_exec (security/apparmor/domain.c:1045)
 security_bprm_creds_for_exec (security/security.c:793)
 bprm_execve (fs/exec.c:1861)
 do_execveat_common (fs/exec.c:1963)
 __x64_sys_execve (fs/exec.c:2036 fs/exec.c:2030 fs/exec.c:2030)
 do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
 entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x7f6def8a9c07
Code: ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00 00 f7 d8 64 41 89 00 eb dc 0f 1f 84 00 00 00 00 00 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 59 62 10 00 f7 d8 64 89 01 48
RSP: 002b:00007ffef478f408 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00005610067400c0 RCX: 00007f6def8a9c07
RDX: 0000561006743480 RSI: 00005610067430e0 RDI: 00005610067401b0
RBP: 00005610067401b0 R08: 00005610067430e0 R09: 0000000000000000
R10: fffffffffffffd8e R11: 0000000000000202 R12: 00005610067401b0
R13: 00005610067430e0 R14: 0000561006743480 R15: 0000000000000020
 </TASK>

Allocated by task 335 on cpu 1 at 17.192413s:
 kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
 __kasan_kmalloc (mm/kasan/common.c:409 mm/kasan/common.c:426)
 aa_alloc_profile (include/linux/slab.h:991 include/linux/slab.h:1312 security/apparmor/policy.c:388)
 aa_unpack (security/apparmor/policy_unpack.c:1160 security/apparmor/policy_unpack.c:1766)
 aa_replace_profiles (security/apparmor/policy.c:1204)
 policy_update (security/apparmor/apparmorfs.c:673)
 profile_load (security/apparmor/apparmorfs.c:691)
 vfs_write (fs/read_write.c:685)
 ksys_write (fs/read_write.c:739)
 do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
 entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Freed by task 349 on cpu 1 at 18.415536s:
 kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
 kasan_save_free_info (mm/kasan/generic.c:584)
 __kasan_slab_free (mm/kasan/common.c:264 mm/kasan/common.c:296)
 kfree (include/linux/kasan.h:235 mm/slub.c:2780 mm/slub.c:6630 mm/slub.c:6923)
 rcu_core (kernel/rcu/tree.c:2650 kernel/rcu/tree.c:2919)
 handle_softirqs (kernel/softirq.c:669)
 __irq_exit_rcu (kernel/softirq.c:703 kernel/softirq.c:542 kernel/softirq.c:786)
 sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062)
 asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:674)

Last potentially related work creation:
 kasan_save_stack (mm/kasan/common.c:57)
 kasan_record_aux_stack (mm/kasan/generic.c:556)
 call_rcu (kernel/rcu/tree.c:3287 kernel/rcu/tree.c:3395)
 aa_remove_profiles (include/linux/kref.h:65 security/apparmor/include/policy.h:436 security/apparmor/policy.c:1552)
 profile_remove (security/apparmor/apparmorfs.c:750)
 vfs_write (fs/read_write.c:685)
 ksys_write (fs/read_write.c:739)
 do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
 entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

The buggy address belongs to the object at ffff888107b7f000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 312 bytes inside of
 freed 512-byte region [ffff888107b7f000, ffff888107b7f200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107b7c
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888107b7f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888107b7f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888107b7f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888107b7f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888107b7f200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Best,
Shuangpeng