Hi,
We would like to report the following bug which has been found by our
modified version of syzkaller.
======================================================
description: KASAN: use-after-free Read in post_one_notification
affected file: kernel/watch_queue.c
kernel version: 5.10.131
kernel commit: 8f95261a006489c828f1d909355669875649668b
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
crash reproducer: attached
patch: This bug was previously reported by syzkaller for kernel
version 5.17. The same patch works for kernel version 5.10 as well,
i.e., we tested that the repro can no longer triggers the reported
crash with this patch:
https://syzkaller.appspot.com/text?tag=Patch&x=13b8c83c080000
======================================================
Crash log:
======================================================
BUG: KASAN: use-after-free in __lock_acquire+0x3867/0x5840
kernel/locking/lockdep.c:4824
Read of size 8 at addr ffff8880aa5f8ca8 by task syz-executor.5/1878
CPU: 0 PID: 1878 Comm: syz-executor.5 Tainted: G OE 5.10.131+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x4f7 mm/kasan/report.c:385
__kasan_report mm/kasan/report.c:545 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
__lock_acquire+0x3867/0x5840 kernel/locking/lockdep.c:4824
lock_acquire kernel/locking/lockdep.c:5564 [inline]
lock_acquire+0x1a8/0x4b0 kernel/locking/lockdep.c:5529
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0x32/0x50 kernel/locking/spinlock.c:167
spin_lock_irq include/linux/spinlock.h:379 [inline]
post_one_notification+0x59/0x860 kernel/watch_queue.c:86
__post_watch_notification kernel/watch_queue.c:206 [inline]
__post_watch_notification+0x562/0x840 kernel/watch_queue.c:176
post_watch_notification include/linux/watch_queue.h:109 [inline]
notify_key security/keys/internal.h:199 [inline]
__key_update security/keys/key.c:774 [inline]
key_create_or_update+0xbff/0xd00 security/keys/key.c:977
__do_sys_add_key security/keys/keyctl.c:134 [inline]
__se_sys_add_key security/keys/keyctl.c:74 [inline]
__x64_sys_add_key+0x2ab/0x4b0 security/keys/keyctl.c:74
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fc85a2514ed
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc858201be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
RAX: ffffffffffffffda RBX: 00007fc85a36ff60 RCX: 00007fc85a2514ed
RDX: 0000000020000080 RSI: 0000000020000040 RDI: 0000000020000000
RBP: 00007fc85a2bd2e1 R08: fffffffffffffffc R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffde3e9524f R14: 00007fc85a36ff60 R15: 00007fc858201d80
Allocated by task 1368:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:49
kasan_set_track mm/kasan/common.c:57 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:471
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:664 [inline]
alloc_pipe_info+0x10c/0x500 fs/pipe.c:789
get_pipe_inode fs/pipe.c:880 [inline]
create_pipe_files+0x8f/0x7d0 fs/pipe.c:912
__do_pipe_flags+0x41/0x240 fs/pipe.c:961
do_pipe2+0x77/0x160 fs/pipe.c:1009
__do_sys_pipe2 fs/pipe.c:1027 [inline]
__se_sys_pipe2 fs/pipe.c:1025 [inline]
__x64_sys_pipe2+0x50/0x70 fs/pipe.c:1025
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 1402:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:49
kasan_set_track+0x1c/0x30 mm/kasan/common.c:57
kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:363
__kasan_slab_free+0x111/0x150 mm/kasan/common.c:427
slab_free_hook mm/slub.c:1542 [inline]
slab_free_freelist_hook mm/slub.c:1576 [inline]
slab_free mm/slub.c:3149 [inline]
kfree+0xfa/0x460 mm/slub.c:4125
put_pipe_info+0xb9/0xe0 fs/pipe.c:710
pipe_release+0x1d2/0x260 fs/pipe.c:733
__fput+0x285/0x920 fs/file_table.c:281
task_work_run+0xe0/0x1a0 kernel/task_work.c:151
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
exit_to_user_mode_prepare+0x195/0x1b0 kernel/entry/common.c:191
syscall_exit_to_user_mode+0x38/0x260 kernel/entry/common.c:266
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8880aa5f8c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 168 bytes inside of
512-byte region [ffff8880aa5f8c00, ffff8880aa5f8e00)
The buggy address belongs to the page:
page:000000000cd222be refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0xaa5f8
head:000000000cd222be order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888100041280
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880aa5f8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880aa5f8c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880aa5f8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880aa5f8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880aa5f8d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
--
Thanks and Regards,
Dipanjan
On Wed, Jul 27, 2022 at 02:28:45PM -0700, Dipanjan Das wrote:
> Hi,
>
> We would like to report the following bug which has been found by our
> modified version of syzkaller.
>
> ======================================================
> description: KASAN: use-after-free Read in post_one_notification
> affected file: kernel/watch_queue.c
> kernel version: 5.10.131
> kernel commit: 8f95261a006489c828f1d909355669875649668b
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
> crash reproducer: attached
> patch: This bug was previously reported by syzkaller for kernel
> version 5.17. The same patch works for kernel version 5.10 as well,
> i.e., we tested that the repro can no longer triggers the reported
> crash with this patch:
> https://syzkaller.appspot.com/text?tag=Patch&x=13b8c83c080000
I'm sorry, I do not understand. So this is fixed in Linus's tree? But
not in 5.10.y? Or it is not fixed everywhere?
If it is fixed, what is the git commit id of the patch in Linus's tree
that fixes this that should be backported to 5.10.y?
confused,
greg k-h
On Thu, Jul 28, 2022 at 8:52 AM Greg KH <[email protected]> wrote:
>
> On Wed, Jul 27, 2022 at 02:28:45PM -0700, Dipanjan Das wrote:
> > Hi,
> >
> > We would like to report the following bug which has been found by our
> > modified version of syzkaller.
> >
> > ======================================================
> > description: KASAN: use-after-free Read in post_one_notification
> > affected file: kernel/watch_queue.c
> > kernel version: 5.10.131
> > kernel commit: 8f95261a006489c828f1d909355669875649668b
> > git tree: upstream
> > kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
> > crash reproducer: attached
> > patch: This bug was previously reported by syzkaller for kernel
> > version 5.17. The same patch works for kernel version 5.10 as well,
> > i.e., we tested that the repro can no longer triggers the reported
> > crash with this patch:
> > https://syzkaller.appspot.com/text?tag=Patch&x=13b8c83c080000
>
> I'm sorry, I do not understand. So this is fixed in Linus's tree? But
> not in 5.10.y? Or it is not fixed everywhere?
>
> If it is fixed, what is the git commit id of the patch in Linus's tree
> that fixes this that should be backported to 5.10.y?
>
> confused,
>
I will try to help our poor confused kernel maintainers here with some
quick background information I could quickly find (just out of
curiosity on what these reports are all about...). Maybe, next time,
the bug reporters can do that simple and basic investigation before
reporting, and provide that information in a condensed form and at the
right point in time, so Greg or Sasha can really act upon that.
For the syzkaller-found KASAN bug report above, there is a patch in
discussion (https://lore.kernel.org/lkml/[email protected]/)
to resolve the issue in mainline. As of writing, the author still
intends to provide a proper working v3 patch, which then might be
applied by David Howells. So far, this patch has not been in
linux-next, nor even Linus Torvalds' tree (mainline). The reporters in
this email suggest that this patch once it reaches mainline can be
backported to the 5.10 stable branch to resolve an existing
syzkaller-triggered bug in the v5.10 versions.
Dipanjan, are you aware of the preferred options to work with stable
maintainers mentioned in
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html?
Please read that page if you have not done that yet.
Dipanjan, could you please follow and influence the development and
handling of the patch above?
Either, you can achieve that the patch is already prepared properly,
so that it is picked up to stable due to the meta-information in the
patch commit message (Option 1 in the stable-kernel-rules, preferred).
Or, after the patch has been merged to Linus’ tree, send an email to
[email protected] containing the subject of the patch, the commit
ID, why you think it should be applied, and what kernel version you
wish it to be applied to (Option 2 in stable-kernel-rules, if Option 1
is not successful).
I believe that this above is a good way (maybe even the best way) to
interact with the kernel community and its stable maintainers and get
the issues resolved that you are reporting.
I hope this helps,
Lukas
On Thu, Jul 28, 2022 at 04:10:25PM +0200, Lukas Bulwahn wrote:
> On Thu, Jul 28, 2022 at 8:52 AM Greg KH <[email protected]> wrote:
> >
> > On Wed, Jul 27, 2022 at 02:28:45PM -0700, Dipanjan Das wrote:
> > > Hi,
> > >
> > > We would like to report the following bug which has been found by our
> > > modified version of syzkaller.
> > >
> > > ======================================================
> > > description: KASAN: use-after-free Read in post_one_notification
> > > affected file: kernel/watch_queue.c
> > > kernel version: 5.10.131
> > > kernel commit: 8f95261a006489c828f1d909355669875649668b
> > > git tree: upstream
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
> > > crash reproducer: attached
> > > patch: This bug was previously reported by syzkaller for kernel
> > > version 5.17. The same patch works for kernel version 5.10 as well,
> > > i.e., we tested that the repro can no longer triggers the reported
> > > crash with this patch:
> > > https://syzkaller.appspot.com/text?tag=Patch&x=13b8c83c080000
> >
> > I'm sorry, I do not understand. So this is fixed in Linus's tree? But
> > not in 5.10.y? Or it is not fixed everywhere?
> >
> > If it is fixed, what is the git commit id of the patch in Linus's tree
> > that fixes this that should be backported to 5.10.y?
> >
> > confused,
> >
>
> I will try to help our poor confused kernel maintainers here with some
> quick background information I could quickly find (just out of
> curiosity on what these reports are all about...). Maybe, next time,
> the bug reporters can do that simple and basic investigation before
> reporting, and provide that information in a condensed form and at the
> right point in time, so Greg or Sasha can really act upon that.
>
> For the syzkaller-found KASAN bug report above, there is a patch in
> discussion (https://lore.kernel.org/lkml/[email protected]/)
> to resolve the issue in mainline. As of writing, the author still
> intends to provide a proper working v3 patch, which then might be
> applied by David Howells. So far, this patch has not been in
> linux-next, nor even Linus Torvalds' tree (mainline). The reporters in
> this email suggest that this patch once it reaches mainline can be
> backported to the 5.10 stable branch to resolve an existing
> syzkaller-triggered bug in the v5.10 versions.
>
> Dipanjan, are you aware of the preferred options to work with stable
> maintainers mentioned in
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html?
> Please read that page if you have not done that yet.
>
> Dipanjan, could you please follow and influence the development and
> handling of the patch above?
>
> Either, you can achieve that the patch is already prepared properly,
> so that it is picked up to stable due to the meta-information in the
> patch commit message (Option 1 in the stable-kernel-rules, preferred).
> Or, after the patch has been merged to Linus’ tree, send an email to
> [email protected] containing the subject of the patch, the commit
> ID, why you think it should be applied, and what kernel version you
> wish it to be applied to (Option 2 in stable-kernel-rules, if Option 1
> is not successful).
>
> I believe that this above is a good way (maybe even the best way) to
> interact with the kernel community and its stable maintainers and get
> the issues resolved that you are reporting.
>
>
> I hope this helps,
Wonderful, that was a great write up, thank you for doing that!
It helped me, now to just wait for the commits to land in Linus's
tree...
thanks,
greg k-h