lkml.org 
[lkml]   [2022]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectKASAN: use-after-free Read in cfusbl_device_notify
Hello,

We observed a crash "KASAN: use-after-free Read in cfusbl_device_notify" during fuzzing.

Unfortunately, we have not found a reproducer for the crash yet. We
will inform you if we have any update on this crash.

Detailed crash information is attached at the end of this email.


Best regards,
Dae R. Jeong.
------

- Kernel commit:
b13baccc3850ca

- Crash report:
==================================================================
BUG: KASAN: use-after-free in cfusbl_device_notify+0x155/0xf40 net/caif/caif_usb.c:138
Read of size 8 at addr ffff88804bc4c6f0 by task kworker/u8:0/18109

CPU: 1 PID: 18109 Comm: kworker/u8:0 Not tainted 5.19.0-rc2-31838-gef9c98f9637f #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: netns cleanup_net
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x240/0x35a lib/dump_stack.c:106
print_address_description+0x65/0x4f0 mm/kasan/report.c:313
print_report+0xf4/0x1e0 mm/kasan/report.c:429
kasan_report+0xe5/0x110 mm/kasan/report.c:491
cfusbl_device_notify+0x155/0xf40 net/caif/caif_usb.c:138
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0xd4/0x170 kernel/notifier.c:455
call_netdevice_notifiers_info net/core/dev.c:1943 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1981 [inline]
call_netdevice_notifiers net/core/dev.c:1995 [inline]
netdev_wait_allrefs_any net/core/dev.c:10225 [inline]
netdev_run_todo+0x14e6/0x23c0 net/core/dev.c:10337
default_device_exit_batch+0x99a/0xa10 net/core/dev.c:11329
ops_exit_list net/core/net_namespace.c:167 [inline]
cleanup_net+0xd23/0x15a0 net/core/net_namespace.c:594
process_one_work+0x909/0x12b0 kernel/workqueue.c:2289
worker_thread+0xab1/0x1320 kernel/workqueue.c:2436
kthread+0x294/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30
</TASK>

Allocated by task 6688:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
__kasan_kmalloc+0xac/0xe0 mm/kasan/common.c:524
kasan_kmalloc include/linux/kasan.h:234 [inline]
__kmalloc_node+0xed/0x780 mm/slub.c:4465
kmalloc_node include/linux/slab.h:623 [inline]
kvmalloc_node+0x6e/0x1a0 mm/util.c:613
kvmalloc include/linux/slab.h:750 [inline]
kvzalloc include/linux/slab.h:758 [inline]
alloc_netdev_mqs+0x94/0x1da0 net/core/dev.c:10576
rtnl_create_link+0x4ec/0x1360 net/core/rtnetlink.c:3241
veth_newlink+0x4a9/0x1810 drivers/net/veth.c:1749
rtnl_newlink_create net/core/rtnetlink.c:3363 [inline]
__rtnl_newlink net/core/rtnetlink.c:3580 [inline]
rtnl_newlink+0x251d/0x2fc0 net/core/rtnetlink.c:3593
rtnetlink_rcv_msg+0x1103/0x1a60 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x2b6/0x670 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0xc68/0xff0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x11a0/0x1680 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:693 [inline]
sock_sendmsg net/socket.c:713 [inline]
__sys_sendto+0x544/0x770 net/socket.c:2098
__do_sys_sendto net/socket.c:2110 [inline]
__se_sys_sendto net/socket.c:2106 [inline]
__x64_sys_sendto+0x1bb/0x250 net/socket.c:2106
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 18109:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:45
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0xb2/0xf0 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1727 [inline]
slab_free_freelist_hook+0x20c/0x540 mm/slub.c:1753
slab_free mm/slub.c:3507 [inline]
kfree+0x117/0x7e0 mm/slub.c:4555
device_release+0xf5/0x390
kobject_cleanup+0x340/0x4e0 lib/kobject.c:673
netdev_run_todo+0x211c/0x23c0 net/core/dev.c:10358
default_device_exit_batch+0x99a/0xa10 net/core/dev.c:11329
ops_exit_list net/core/net_namespace.c:167 [inline]
cleanup_net+0xd23/0x15a0 net/core/net_namespace.c:594
process_one_work+0x909/0x12b0 kernel/workqueue.c:2289
worker_thread+0xab1/0x1320 kernel/workqueue.c:2436
kthread+0x294/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30

The buggy address belongs to the object at ffff88804bc4c000
which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 1776 bytes inside of
4096-byte region [ffff88804bc4c000, ffff88804bc4d000)

The buggy address belongs to the physical page:
page:ffffea00012f1200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4bc48
head:ffffea00012f1200 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88801844c140
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6688, tgid 6688 (syz-executor.0), ts 297836664488, free_ts 31867390869
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0xa7c/0xf50 mm/page_alloc.c:4198
__alloc_pages+0x30e/0x710 mm/page_alloc.c:5426
alloc_slab_page+0x66/0x250 mm/slub.c:1797
allocate_slab+0xc0/0xe40 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x629/0x17a0 mm/slub.c:3002
__slab_alloc mm/slub.c:3089 [inline]
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
__kmalloc_track_caller+0x53a/0x600 mm/slub.c:4919
kmemdup+0x21/0x50 mm/util.c:129
_Z7kmemdupPKvU17pass_object_size0mj include/linux/fortify-string.h:456 [inline]
__addrconf_sysctl_register+0x97/0x680 net/ipv6/addrconf.c:7061
addrconf_sysctl_register+0x1c3/0x2a0 net/ipv6/addrconf.c:7126
ipv6_add_dev+0x170e/0x1f80 net/ipv6/addrconf.c:450
addrconf_notify+0xa36/0x3730 net/ipv6/addrconf.c:3532
notifier_call_chain kernel/notifier.c:87 [inline]
raw_notifier_call_chain+0xd4/0x170 kernel/notifier.c:455
call_netdevice_notifiers_info net/core/dev.c:1943 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1981 [inline]
call_netdevice_notifiers net/core/dev.c:1995 [inline]
register_netdevice+0x23b1/0x32c0 net/core/dev.c:10078
hsr_dev_finalize+0x803/0xd50 net/hsr/hsr_device.c:539
hsr_newlink+0xba5/0xcf0 net/hsr/hsr_netlink.c:102
rtnl_newlink_create net/core/rtnetlink.c:3363 [inline]
__rtnl_newlink net/core/rtnetlink.c:3580 [inline]
rtnl_newlink+0x251d/0x2fc0 net/core/rtnetlink.c:3593
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0xa65/0xc90 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page+0x7e/0x740 mm/page_alloc.c:3438
free_contig_range+0xd9/0x240 mm/page_alloc.c:9314
destroy_args+0x153/0xee4 mm/debug_vm_pgtable.c:1031
debug_vm_pgtable+0x4bd/0x553 mm/debug_vm_pgtable.c:1354
do_one_initcall+0x1a8/0x410 init/main.c:1295
do_initcall_level+0x168/0x21d init/main.c:1368
do_initcalls+0x50/0x91 init/main.c:1384
kernel_init_freeable+0x40d/0x59a init/main.c:1610
kernel_init+0x19/0x2c0 init/main.c:1499
ret_from_fork+0x1f/0x30

Memory state around the buggy address:
ffff88804bc4c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804bc4c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804bc4c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88804bc4c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804bc4c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

\
 
 \ /
  Last update: 2022-06-24 08:08    [W:0.066 / U:0.952 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site