[BUG] KASAN: slab-use-after-free Read in __snd_ctl_add_replace

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   47.352981][ T9516] BUG: KASAN: slab-use-after-free in
__dev_printk+0x7d/0x190
[   47.353074][ T9516] Read of size 8 at addr ffff88810dd940e0 by task
repro/9516
[   47.353102][ T9516]
[   47.353141][ T9516] CPU: 0 UID: 0 PID: 9516 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   47.353180][ T9516] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   47.353239][ T9516] Call Trace:
[   47.353261][ T9516]  <TASK>
[   47.353287][ T9516]  dump_stack_lvl+0xe8/0x150
[   47.353334][ T9516]  print_address_description+0x55/0x1e0
[   47.353369][ T9516]  ? __dev_printk+0x7d/0x190
[   47.353402][ T9516]  print_report+0x58/0x70
[   47.353431][ T9516]  kasan_report+0x117/0x150
[   47.353478][ T9516]  ? __dev_printk+0x7d/0x190
[   47.353516][ T9516]  __dev_printk+0x7d/0x190
[   47.353552][ T9516]  _dev_err+0x11e/0x180
[   47.353589][ T9516]  ? xa_load+0x1db/0x210
[   47.353635][ T9516]  ? __pfx__dev_err+0x10/0x10
[   47.353681][ T9516]  __snd_ctl_add_replace+0x7e2/0x980
[   47.353733][ T9516]  ? __pfx___snd_ctl_add_replace+0x10/0x10
[   47.353779][ T9516]  ? __kmalloc_noprof+0x390/0x720
[   47.353816][ T9516]  ? __kmalloc_noprof+0x1af/0x720
[   47.353849][ T9516]  ? snd_ctl_elem_add+0x436/0xa60
[   47.353888][ T9516]  ? snd_ctl_elem_add+0x436/0xa60
[   47.353931][ T9516]  ? __pfx_snd_ctl_elem_user_info+0x10/0x10
[   47.353974][ T9516]  snd_ctl_elem_add+0x738/0xa60
[   47.354023][ T9516]  snd_ctl_ioctl+0xece/0x1d50
[   47.354064][ T9516]  ? stack_trace_save+0xa9/0x100
[   47.354103][ T9516]  ? __pfx_snd_ctl_ioctl+0x10/0x10
[   47.354140][ T9516]  ? kasan_save_free_info+0x46/0x50
[   47.354175][ T9516]  ? stack_depot_save_flags+0x33/0x7f0
[   47.354233][ T9516]  ? kasan_save_track+0x4f/0x80
[   47.354271][ T9516]  ? kasan_save_track+0x3e/0x80
[   47.354307][ T9516]  ? kasan_save_free_info+0x46/0x50
[   47.354338][ T9516]  ? __kasan_slab_free+0x5c/0x80
[   47.354376][ T9516]  ? kfree+0x1c5/0x650
[   47.354406][ T9516]  ? tomoyo_path_number_perm+0x501/0x630
[   47.354448][ T9516]  ? security_file_ioctl+0xc3/0x2a0
[   47.354485][ T9516]  ? __se_sys_ioctl+0x47/0x170
[   47.354523][ T9516]  ? do_syscall_64+0x155/0x510
[   47.354566][ T9516]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.354633][ T9516]  ? tomoyo_path_number_perm+0x219/0x630
[   47.354675][ T9516]  ? tomoyo_path_number_perm+0x219/0x630
[   47.354719][ T9516]  ? do_vfs_ioctl+0x1166/0x1530
[   47.354760][ T9516]  ? __pfx_do_vfs_ioctl+0x10/0x10
[   47.354802][ T9516]  ? do_raw_spin_lock+0x12b/0x2f0
[   47.354854][ T9516]  ? __fget_files+0x2a/0x420
[   47.354887][ T9516]  ? __fget_files+0x2a/0x420
[   47.354916][ T9516]  ? __fget_files+0x3a0/0x420
[   47.354944][ T9516]  ? __fget_files+0x2a/0x420
[   47.354976][ T9516]  ? bpf_lsm_file_ioctl+0x9/0x20
[   47.355011][ T9516]  ? __pfx_snd_ctl_ioctl+0x10/0x10
[   47.355050][ T9516]  __se_sys_ioctl+0xfc/0x170
[   47.355090][ T9516]  do_syscall_64+0x155/0x510
[   47.355134][ T9516]  ? trace_irq_disable+0x3b/0x140
[   47.355174][ T9516]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.355205][ T9516]  ? clear_bhb_loop+0x30/0x80
[   47.355253][ T9516]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.355284][ T9516] RIP: 0033:0x42499d
[   47.355329][ T9516] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   47.355364][ T9516] RSP: 002b:00007f52c1730170 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   47.355409][ T9516] RAX: ffffffffffffffda RBX: 00007f52c17306c0
RCX: 000000000042499d
[   47.355433][ T9516] RDX: 00007f52c1731000 RSI: 00000000c1105517
RDI: 0000000000000004
[   47.355455][ T9516] RBP: 00007f52c17301c0 R08: 0000000000000000
R09: 0000000000000001
[   47.355475][ T9516] R10: 0000000000000008 R11: 0000000000000246
R12: 00007f52c17306c0
[   47.355496][ T9516] R13: 00007ffdd1359920 R14: 00007f52c1730ce4
R15: 00007ffdd1359a17
[   47.355531][ T9516]  </TASK>
[   47.355543][ T9516]
[   47.355557][ T9516] Allocated by task 34:
[   47.355573][ T9516]  kasan_save_track+0x3e/0x80
[   47.355611][ T9516]  __kasan_kmalloc+0x93/0xb0
[   47.355647][ T9516]  __kmalloc_cache_noprof+0x325/0x610
[   47.355681][ T9516]  usb_set_configuration+0x3c9/0x2110
[   47.355718][ T9516]  usb_generic_driver_probe+0x8d/0x150
[   47.355753][ T9516]  usb_probe_device+0x1c4/0x3b0
[   47.355790][ T9516]  really_probe+0x267/0xaf0
[   47.355822][ T9516]  __driver_probe_device+0x1e2/0x350
[   47.355853][ T9516]  driver_probe_device+0x4f/0x240
[   47.355885][ T9516]  __device_attach_driver+0x270/0x410
[   47.355917][ T9516]  bus_for_each_drv+0x258/0x2f0
[   47.355955][ T9516]  __device_attach+0x2c5/0x450
[   47.355983][ T9516]  device_initial_probe+0xa1/0xd0
[   47.356013][ T9516]  bus_probe_device+0x12a/0x220
[   47.356051][ T9516]  device_add+0x7ec/0xb90
[   47.356077][ T9516]  usb_new_device+0xa14/0x1720
[   47.356105][ T9516]  hub_event+0x2a1c/0x4f30
[   47.356139][ T9516]  process_scheduled_works+0xc99/0x1900
[   47.356183][ T9516]  worker_thread+0xa53/0xfc0
[   47.356222][ T9516]  kthread+0x38b/0x480
[   47.356256][ T9516]  ret_from_fork+0x514/0xb70
[   47.356288][ T9516]  ret_from_fork_asm+0x1a/0x30
[   47.356322][ T9516]
[   47.356329][ T9516] Freed by task 34:
[   47.356344][ T9516]  kasan_save_track+0x3e/0x80
[   47.356379][ T9516]  kasan_save_free_info+0x46/0x50
[   47.356407][ T9516]  __kasan_slab_free+0x5c/0x80
[   47.356444][ T9516]  kfree+0x1c5/0x650
[   47.356471][ T9516]  device_release+0xc4/0x1f0
[   47.356505][ T9516]  kobject_put+0x228/0x560
[   47.356534][ T9516]  usb_disable_device+0x611/0x8d0
[   47.356568][ T9516]  usb_disconnect+0x32f/0x990
[   47.356596][ T9516]  hub_event+0x1cc9/0x4f30
[   47.356629][ T9516]  process_scheduled_works+0xc99/0x1900
[   47.356673][ T9516]  worker_thread+0xa53/0xfc0
[   47.356699][ T9516]  kthread+0x38b/0x480
[   47.356731][ T9516]  ret_from_fork+0x514/0xb70
[   47.356763][ T9516]  ret_from_fork_asm+0x1a/0x30
[   47.356796][ T9516]
[   47.356803][ T9516] The buggy address belongs to the object at
ffff88810dd94000
[   47.356803][ T9516]  which belongs to the cache kmalloc-2k of size 2048
[   47.356837][ T9516] The buggy address is located 224 bytes inside of
[   47.356837][ T9516]  freed 2048-byte region [ffff88810dd94000,
ffff88810dd94800)
[   47.356870][ T9516]
[   47.356878][ T9516] The buggy address belongs to the physical page:
[   47.356909][ T9516] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0xffff88810dd97000 pfn:0x10dd90
[   47.356942][ T9516] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[   47.356968][ T9516] flags:
0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff)
[   47.357012][ T9516] page_type: f5(slab)
[   47.357050][ T9516] raw: 057ff00000000240 ffff88801b042000
ffffea0004441010 ffffea0004181010
[   47.357078][ T9516] raw: ffff88810dd97000 0000000000080007
00000000f5000000 0000000000000000
[   47.357106][ T9516] head: 057ff00000000240 ffff88801b042000
ffffea0004441010 ffffea0004181010
[   47.357132][ T9516] head: ffff88810dd97000 0000000000080007
00000000f5000000 0000000000000000
[   47.357159][ T9516] head: 057ff00000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[   47.357185][ T9516] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000008
[   47.357200][ T9516] page dumped because: kasan: bad access detected
[   47.357233][ T9516] page_owner tracks the page as allocated
[   47.357245][ T9516] page last allocated via order 3, migratetype
Unmovable, gfp_mask
0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 5035, tgid 5035 ((journald)), ts 9444750764
[   47.357297][ T9516]  post_alloc_hook+0x1f9/0x250
[   47.357328][ T9516]  get_page_from_freelist+0x235a/0x23e0
[   47.357366][ T9516]  __alloc_frozen_pages_noprof+0x217/0x5a0
[   47.357403][ T9516]  allocate_slab+0x7d/0x610
[   47.357427][ T9516]  refill_objects+0x2d6/0x350
[   47.357453][ T9516]  __pcs_replace_empty_main+0x2c9/0x6c0
[   47.357495][ T9516]  __kmalloc_cache_noprof+0x3a5/0x610
[   47.357528][ T9516]  wb_get_create+0x2a8/0xd30
[   47.357564][ T9516]  __inode_attach_wb+0x482/0x5a0
[   47.357598][ T9516]  __mark_inode_dirty+0x636/0x13b0
[   47.357635][ T9516]  touch_atime+0x579/0x680
[   47.357667][ T9516]  filemap_read+0x1053/0x1230
[   47.357692][ T9516]  ext4_file_read_iter+0x3de/0xbc0
[   47.357734][ T9516]  __kernel_read+0x504/0x9b0
[   47.357763][ T9516]  bprm_execve+0x882/0x15c0
[   47.357795][ T9516]  do_execveat_common+0x510/0x690
[   47.357829][ T9516] page last free pid 5046 tgid 5046 ts 9435589623
stack trace:
[   47.357850][ T9516]  __free_frozen_pages+0xc9f/0xd90
[   47.357881][ T9516]  __slab_free+0x274/0x2c0
[   47.357914][ T9516]  qlist_free_all+0x99/0x100
[   47.357947][ T9516]  kasan_quarantine_reduce+0x148/0x160
[   47.357981][ T9516]  __kasan_slab_alloc+0x22/0x80
[   47.358018][ T9516]  kmem_cache_alloc_noprof+0x2bd/0x610
[   47.358049][ T9516]  do_getname+0x2e/0x250
[   47.358088][ T9516]  do_sys_openat2+0xcc/0x200
[   47.358128][ T9516]  __x64_sys_openat+0x138/0x170
[   47.358169][ T9516]  do_syscall_64+0x155/0x510
[   47.358226][ T9516]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.358257][ T9516]
[   47.358264][ T9516] Memory state around the buggy address:
[   47.358280][ T9516]  ffff88810dd93f80: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[   47.358300][ T9516]  ffff88810dd94000: fa fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.358320][ T9516] >ffff88810dd94080: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.358336][ T9516]                                                        ^
[   47.358353][ T9516]  ffff88810dd94100: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.358372][ T9516]  ffff88810dd94180: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.358387][ T9516]
==================================================================
[   47.358465][ T9516] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   47.455692][ T9516] CPU: 0 UID: 0 PID: 9516 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   47.456712][ T9516] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   47.457670][ T9516] Call Trace:
[   47.457978][ T9516]  <TASK>
[   47.458261][ T9516]  vpanic+0x56d/0xa60
[   47.458652][ T9516]  ? __pfx_vpanic+0x10/0x10
[   47.459070][ T9516]  ? irqentry_exit+0x218/0x760
[   47.459554][ T9516]  panic+0xc5/0xd0
[   47.459920][ T9516]  ? __pfx_panic+0x10/0x10
[   47.460355][ T9516]  ? __dev_printk+0x7d/0x190
[   47.460801][ T9516]  ? __dev_printk+0x7d/0x190
[   47.461229][ T9516]  check_panic_on_warn+0x89/0xb0
[   47.461687][ T9516]  ? __dev_printk+0x7d/0x190
[   47.462112][ T9516]  end_report+0x73/0x170
[   47.462509][ T9516]  ? __dev_printk+0x7d/0x190
[   47.462934][ T9516]  kasan_report+0x128/0x150
[   47.463357][ T9516]  ? __dev_printk+0x7d/0x190
[   47.463782][ T9516]  __dev_printk+0x7d/0x190
[   47.464193][ T9516]  _dev_err+0x11e/0x180
[   47.464581][ T9516]  ? xa_load+0x1db/0x210
[   47.464974][ T9516]  ? __pfx__dev_err+0x10/0x10
[   47.465413][ T9516]  __snd_ctl_add_replace+0x7e2/0x980
[   47.465900][ T9516]  ? __pfx___snd_ctl_add_replace+0x10/0x10
[   47.466494][ T9516]  ? __kmalloc_noprof+0x390/0x720
[   47.466957][ T9516]  ? __kmalloc_noprof+0x1af/0x720
[   47.467422][ T9516]  ? snd_ctl_elem_add+0x436/0xa60
[   47.467884][ T9516]  ? snd_ctl_elem_add+0x436/0xa60
[   47.468350][ T9516]  ? __pfx_snd_ctl_elem_user_info+0x10/0x10
[   47.468905][ T9516]  snd_ctl_elem_add+0x738/0xa60
[   47.469360][ T9516]  snd_ctl_ioctl+0xece/0x1d50
[   47.469794][ T9516]  ? stack_trace_save+0xa9/0x100
[   47.470253][ T9516]  ? __pfx_snd_ctl_ioctl+0x10/0x10
[   47.470725][ T9516]  ? kasan_save_free_info+0x46/0x50
[   47.471201][ T9516]  ? stack_depot_save_flags+0x33/0x7f0
[   47.471705][ T9516]  ? kasan_save_track+0x4f/0x80
[   47.472153][ T9516]  ? kasan_save_track+0x3e/0x80
[   47.472604][ T9516]  ? kasan_save_free_info+0x46/0x50
[   47.473081][ T9516]  ? __kasan_slab_free+0x5c/0x80
[   47.473538][ T9516]  ? kfree+0x1c5/0x650
[   47.473915][ T9516]  ? tomoyo_path_number_perm+0x501/0x630
[   47.474432][ T9516]  ? security_file_ioctl+0xc3/0x2a0
[   47.474912][ T9516]  ? __se_sys_ioctl+0x47/0x170
[   47.475354][ T9516]  ? do_syscall_64+0x155/0x510
[   47.475795][ T9516]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.476427][ T9516]  ? tomoyo_path_number_perm+0x219/0x630
[   47.476943][ T9516]  ? tomoyo_path_number_perm+0x219/0x630
[   47.477459][ T9516]  ? do_vfs_ioctl+0x1166/0x1530
[   47.477908][ T9516]  ? __pfx_do_vfs_ioctl+0x10/0x10
[   47.478374][ T9516]  ? do_raw_spin_lock+0x12b/0x2f0
[   47.478856][ T9516]  ? __fget_files+0x2a/0x420
[   47.479283][ T9516]  ? __fget_files+0x2a/0x420
[   47.479707][ T9516]  ? __fget_files+0x3a0/0x420
[   47.480138][ T9516]  ? __fget_files+0x2a/0x420
[   47.480567][ T9516]  ? bpf_lsm_file_ioctl+0x9/0x20
[   47.481023][ T9516]  ? __pfx_snd_ctl_ioctl+0x10/0x10
[   47.481534][ T9516]  __se_sys_ioctl+0xfc/0x170
[   47.481974][ T9516]  do_syscall_64+0x155/0x510
[   47.482439][ T9516]  ? trace_irq_disable+0x3b/0x140
[   47.482902][ T9516]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.483456][ T9516]  ? clear_bhb_loop+0x30/0x80
[   47.483888][ T9516]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.484429][ T9516] RIP: 0033:0x42499d
[   47.484790][ T9516] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   47.486566][ T9516] RSP: 002b:00007f52c1730170 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   47.487350][ T9516] RAX: ffffffffffffffda RBX: 00007f52c17306c0
RCX: 000000000042499d
[   47.488104][ T9516] RDX: 00007f52c1731000 RSI: 00000000c1105517
RDI: 0000000000000004
[   47.488857][ T9516] RBP: 00007f52c17301c0 R08: 0000000000000000
R09: 0000000000000001
[   47.489572][ T9516] R10: 0000000000000008 R11: 0000000000000246
R12: 00007f52c17306c0
[   47.490286][ T9516] R13: 00007ffdd1359920 R14: 00007f52c1730ce4
R15: 00007ffdd1359a17
[   47.491001][ T9516]  </TASK>
[   47.491864][ T9516] Kernel Offset: disabled
[   47.492416][ T9516] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data