Re: KASAN: use-after-free Read in alloc_workqueue

[Bart Van Assche]

On 3/3/19 10:22 AM, syzbot wrote:
> syzbot found the following crash on:
>
> HEAD commit:ÂÂÂ c63e9e91a254 Add linux-next specific files for 20190301
> git tree:ÂÂÂÂÂÂ linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=16ac728d200000
> kernel config:Â https://syzkaller.appspot.com/x/.config?x=f5875f9dc6e009b2
> dashboard link: 
> https://syzkaller.appspot.com/bug?extid=17335689e239ce135d8b
> compiler:ÂÂÂÂÂÂ gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:ÂÂÂÂÂ https://syzkaller.appspot.com/x/repro.syz?x=134808fb200000
> C reproducer:ÂÂ https://syzkaller.appspot.com/x/repro.c?x=1541889d200000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+17335689e239ce135d8b@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> ==================================================================
> BUG: KASAN: use-after-free in __read_once_size 
> include/linux/compiler.h:197 [inline]
> BUG: KASAN: use-after-free in lockdep_register_key+0x3b9/0x490 
> kernel/locking/lockdep.c:1023
> Read of size 8 at addr ffff888090fc2698 by task syz-executor134/7858
>
> CPU: 1 PID: 7858 Comm: syz-executor134 Not tainted 
> 5.0.0-rc8-next-20190301 #1
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS 
> Google 01/01/2011
> Call Trace:
>  Â__dump_stack lib/dump_stack.c:77 [inline]
>  Âdump_stack+0x172/0x1f0 lib/dump_stack.c:113
>  Âprint_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
>  Âkasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
>  Â__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
>  Â__read_once_size include/linux/compiler.h:197 [inline]
>  Âlockdep_register_key+0x3b9/0x490 kernel/locking/lockdep.c:1023
>  Âwq_init_lockdep kernel/workqueue.c:3444 [inline]
>  Âalloc_workqueue+0x427/0xe70 kernel/workqueue.c:4263
>  Âucma_open+0x76/0x290 drivers/infiniband/core/ucma.c:1732
>  Âmisc_open+0x398/0x4c0 drivers/char/misc.c:141
>  Âchrdev_open+0x247/0x6b0 fs/char_dev.c:417
>  Âdo_dentry_open+0x488/0x1160 fs/open.c:771
>  Âvfs_open+0xa0/0xd0 fs/open.c:880
>  Âdo_last fs/namei.c:3416 [inline]
>  Âpath_openat+0x10e9/0x46e0 fs/namei.c:3533
>  Âdo_filp_open+0x1a1/0x280 fs/namei.c:3563
>  Âdo_sys_open+0x3fe/0x5d0 fs/open.c:1063
>  Â__do_sys_openat fs/open.c:1090 [inline]
>  Â__se_sys_openat fs/open.c:1084 [inline]
>  Â__x64_sys_openat+0x9d/0x100 fs/open.c:1084
>  Âdo_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
>  Âentry_SYSCALL_64_after_hwframe+0x49/0xbe

I think this is caused by a change I made in the workqueue 
implementation. I will submit a fix.

Bart.