Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
From:   Palash Oswal <oswalpalash@gmail.com>
Date:   Thu, 13 Apr 2023 19:41:26 -0700
Message-ID: <CAGyP=7djcPOF6JHvVV6Zmpvtb_nHsDM7865C3e4A5F06kF8FsQ@mail.gmail.com>
Subject: KASAN: slab-use-after-free Read in tcf_action_destroy
To:     Jamal Hadi Salim <jhs@mojatatu.com>,
        Cong Wang <xiyou.wangcong@gmail.com>,
        Jiri Pirko <jiri@resnulli.us>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hello,
I found the following issue using syzkaller with enriched corpus on:
HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
git tree: linux

C Reproducer : https://gist.github.com/oswalpalash/278b6fb713f37fa8d4625d6be703550d
Kernel .config :
https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f

syz-repro :
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0,
&(0x7f0000000140)={0x0, 0x140}}, 0x0)
getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1,
0x0, 0x6, @broadcast}, &(0x7f0000000100)=0xab)
sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0,
&(0x7f0000000780)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000024000b0e00"/20,
@ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100687462001c0002001800020003"],
0x48}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0,
&(0x7f0000000180)={&(0x7f00000007c0)=@newtfilter={0x40, 0x2c, 0xd27,
0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff3}},
[@filter_kind_options=@f_flower={{0xb}, {0x10, 0x2,
[@TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @local}]}}]}, 0x40}}, 0x0)
(fail_nth: 19)


Console log :

==================================================================
BUG: KASAN: slab-use-after-free in tcf_action_destroy+0x17f/0x1b0
Read of size 8 at addr ffff88811024d800 by task kworker/u4:1/11

CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted
6.3.0-rc6-pasta-00035-g0bcc40255504 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: tc_filter_workqueue fl_destroy_filter_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xd9/0x150
 print_address_description.constprop.0+0x2c/0x3c0
 kasan_report+0x11c/0x130
 tcf_action_destroy+0x17f/0x1b0
 tcf_exts_destroy+0xc5/0x160
 __fl_destroy_filter+0x1a/0x100
 process_one_work+0x991/0x15c0
 worker_thread+0x669/0x1090
 kthread+0x2e8/0x3a0
 ret_from_fork+0x1f/0x30
 </TASK>

Allocated by task 9570:
 kasan_save_stack+0x22/0x40
 kasan_set_track+0x25/0x30
 __kasan_kmalloc+0xa3/0xb0
 tcf_exts_init_ex+0xe4/0x5a0
 fl_change+0x56f/0x4a20
 tc_new_tfilter+0x995/0x22a0
 rtnetlink_rcv_msg+0x996/0xd50
 netlink_rcv_skb+0x165/0x440
 netlink_unicast+0x547/0x7f0
 netlink_sendmsg+0x926/0xe30
 sock_sendmsg+0xde/0x190
 ____sys_sendmsg+0x71c/0x900
 ___sys_sendmsg+0x110/0x1b0
 __sys_sendmsg+0xf7/0x1c0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 9570:
 kasan_save_stack+0x22/0x40
 kasan_set_track+0x25/0x30
 kasan_save_free_info+0x2b/0x40
 ____kasan_slab_free+0x13b/0x1a0
 __kmem_cache_free+0xcd/0x2c0
 tcf_exts_destroy+0xe5/0x160
 tcf_exts_init_ex+0x484/0x5a0
 fl_change+0x56f/0x4a20
 tc_new_tfilter+0x995/0x22a0
 rtnetlink_rcv_msg+0x996/0xd50
 netlink_rcv_skb+0x165/0x440
 netlink_unicast+0x547/0x7f0
 netlink_sendmsg+0x926/0xe30
 sock_sendmsg+0xde/0x190
 ____sys_sendmsg+0x71c/0x900
 ___sys_sendmsg+0x110/0x1b0
 __sys_sendmsg+0xf7/0x1c0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff88811024d800
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes inside of
 freed 256-byte region [ffff88811024d800, ffff88811024d900)

The buggy address belongs to the physical page:
page:ffffea0004409340 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x11024d
flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000200 ffff888012440500 ffffea000436ea10 ffffea00041aec10
raw: 0000000000000000 ffff88811024d000 0000000100000008 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask
0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE),
pid 8017, tgid 8017 (syz-executor.0), ts 60719725774, free_ts
60718847244
 get_page_from_freelist+0x1190/0x2e20
 __alloc_pages+0x1cb/0x4a0
 cache_grow_begin+0x9b/0x3b0
 cache_alloc_refill+0x27f/0x380
 __kmem_cache_alloc_node+0x360/0x3f0
 __kmalloc+0x4e/0x190
 security_sb_alloc+0x105/0x240
 alloc_super+0x236/0xb60
 sget_fc+0x142/0x7c0
 vfs_get_super+0x2d/0x280
 vfs_get_tree+0x8d/0x350
 path_mount+0x1342/0x1e40
 __x64_sys_mount+0x283/0x300
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 free_pcp_prepare+0x5d5/0xa50
 free_unref_page+0x1d/0x490
 vfree+0x180/0x7e0
 delayed_vfree_work+0x57/0x70
 process_one_work+0x991/0x15c0
 worker_thread+0x669/0x1090
 kthread+0x2e8/0x3a0
 ret_from_fork+0x1f/0x30

Memory state around the buggy address:
 ffff88811024d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88811024d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811024d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88811024d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811024d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================