Messages in this thread | | | From | Zhang Zhiyu <> | Date | Mon, 7 Aug 2023 23:54:20 +0800 | Subject | KASAN: slab-use-after-free Read in radix_tree_lookup in&after Linux Kernel 6.4-rc6 |
| |
Hi,
I found a KASAN: slab-use-after-free Read in radix_tree_lookup while fuzzing Linux kernel 6.4-rc6 with my modified syzkaller in 24 July.
The report, log, and config can be downloaded from: https://drive.google.com/file/d/1KiZCUHEyp-_Mbq8wdXvjPLs6KU-12JwM/view?usp=sharing
Here is the bug-related key info:
BUG: KASAN: slab-use-after-free in radix_tree_descend lib/radix-tree.c:87 [inline] BUG: KASAN: slab-use-after-free in __radix_tree_lookup lib/radix-tree.c:764 [inline] BUG: KASAN: slab-use-after-free in radix_tree_lookup+0x12d/0x290 lib/radix-tree.c:817 Read of size 8 at addr ffff8880675ab1a8 by task kswapd0/88
I have preliminarily anlyzed the root cause. The suspected UAF Read is located in the __radix_tree_lookup function, which is part of the Radix Tree implementation in the Linux kernel. The condition check radix_tree_is_internal_node(node) in the while loop is used to verify if the node is an internal node. However, this check does not fully guarantee that the passed pointer node is always valid. If an invalid node pointer is passed to this function, it could lead to undefined behavior, potentially including a Use-After-Free Read.
As this is a data race uaf, the syzkaller* cannot easily generate POC. I am still trying to construct a POC. By comparing the code of radix-tree.c, the vulnerability affects versions ranging from 6.4-rc6 to the latest mainline.
I recommend to patch it by adding invalid check of node in __radix_tree_lookup, if it is validated as a bug.
Best. Have a good day! Zhiyu Zhang
| |