Re: [syzbot] [net?] KASAN: slab-use-after-free Read in unix_del_edges

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: syzbot <syzbot+f3f3eef1d2100200e593@syzkaller.appspotmail.com>
Date: Fri, 19 Apr 2024 02:39:21 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    7b4f2bc91c15 Add linux-next specific files for 20240418
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=14a54a53180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ae644165a243bf62
> dashboard link: https://syzkaller.appspot.com/bug?extid=f3f3eef1d2100200e593
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=155e53af180000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=128b1d53180000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/524a18e6c5be/disk-7b4f2bc9.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/029f1b84d653/vmlinux-7b4f2bc9.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/c02d1542e886/bzImage-7b4f2bc9.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+f3f3eef1d2100200e593@syzkaller.appspotmail.com
> 
> ==================================================================
> BUG: KASAN: slab-use-after-free in unix_edge_successor net/unix/garbage.c:109 [inline]
> BUG: KASAN: slab-use-after-free in unix_del_edge net/unix/garbage.c:165 [inline]
> BUG: KASAN: slab-use-after-free in unix_del_edges+0x148/0x630 net/unix/garbage.c:237
> Read of size 8 at addr ffff888079c6e640 by task kworker/u8:6/1099
> 
> CPU: 0 PID: 1099 Comm: kworker/u8:6 Not tainted 6.9.0-rc4-next-20240418-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> Workqueue: events_unbound __unix_gc
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
>  print_address_description mm/kasan/report.c:377 [inline]
>  print_report+0x169/0x550 mm/kasan/report.c:488
>  kasan_report+0x143/0x180 mm/kasan/report.c:601
>  unix_edge_successor net/unix/garbage.c:109 [inline]

It seems successor is freed during the same GC iteration ?

Will cook a patch soon.

Thanks!


>  unix_del_edge net/unix/garbage.c:165 [inline]
>  unix_del_edges+0x148/0x630 net/unix/garbage.c:237
>  unix_destroy_fpl+0x59/0x210 net/unix/garbage.c:298
>  unix_detach_fds net/unix/af_unix.c:1811 [inline]
>  unix_destruct_scm+0x13e/0x210 net/unix/af_unix.c:1826
>  skb_release_head_state+0x100/0x250 net/core/skbuff.c:1127
>  skb_release_all net/core/skbuff.c:1138 [inline]
>  __kfree_skb net/core/skbuff.c:1154 [inline]
>  kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1190
>  __skb_queue_purge_reason include/linux/skbuff.h:3251 [inline]
>  __skb_queue_purge include/linux/skbuff.h:3256 [inline]
>  __unix_gc+0x1732/0x1830 net/unix/garbage.c:575
>  process_one_work kernel/workqueue.c:3218 [inline]
>  process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
>  worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
>  kthread+0x2f0/0x390 kernel/kthread.c:389
>  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>  </TASK>
> 
> Allocated by task 14427:
>  kasan_save_stack mm/kasan/common.c:47 [inline]
>  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
>  unpoison_slab_object mm/kasan/common.c:312 [inline]
>  __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
>  kasan_slab_alloc include/linux/kasan.h:201 [inline]
>  slab_post_alloc_hook mm/slub.c:3897 [inline]
>  slab_alloc_node mm/slub.c:3957 [inline]
>  kmem_cache_alloc_noprof+0x135/0x290 mm/slub.c:3964
>  sk_prot_alloc+0x58/0x210 net/core/sock.c:2074
>  sk_alloc+0x38/0x370 net/core/sock.c:2133
>  unix_create1+0xb4/0x770
>  unix_create+0x14e/0x200 net/unix/af_unix.c:1034
>  __sock_create+0x490/0x920 net/socket.c:1571
>  sock_create net/socket.c:1622 [inline]
>  __sys_socketpair+0x33e/0x720 net/socket.c:1773
>  __do_sys_socketpair net/socket.c:1822 [inline]
>  __se_sys_socketpair net/socket.c:1819 [inline]
>  __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1819
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Freed by task 1805:
>  kasan_save_stack mm/kasan/common.c:47 [inline]
>  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
>  kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
>  poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
>  __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
>  kasan_slab_free include/linux/kasan.h:184 [inline]
>  slab_free_hook mm/slub.c:2190 [inline]
>  slab_free mm/slub.c:4393 [inline]
>  kmem_cache_free+0x145/0x340 mm/slub.c:4468
>  sk_prot_free net/core/sock.c:2114 [inline]
>  __sk_destruct+0x467/0x5f0 net/core/sock.c:2208
>  sock_put include/net/sock.h:1948 [inline]
>  unix_release_sock+0xa8b/0xd20 net/unix/af_unix.c:665
>  unix_release+0x91/0xc0 net/unix/af_unix.c:1049
>  __sock_release net/socket.c:659 [inline]
>  sock_close+0xbc/0x240 net/socket.c:1421
>  __fput+0x406/0x8b0 fs/file_table.c:422
>  delayed_fput+0x59/0x80 fs/file_table.c:445
>  process_one_work kernel/workqueue.c:3218 [inline]
>  process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
>  worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
>  kthread+0x2f0/0x390 kernel/kthread.c:389
>  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244