Re: KASAN: slab-use-after-free Read in tcf_action_destroy

[Jamal Hadi Salim]

Will look at this unless someone already has figured it out...

cheers,
jama

On Thu, Apr 13, 2023 at 10:41 PM Palash Oswal <oswalpalash@xxxxxxxxx> wrote:
>
> Hello,
> I found the following issue using syzkaller with enriched corpus on:
> HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
> git tree: linux
>
> C Reproducer : https://gist.github.com/oswalpalash/278b6fb713f37fa8d4625d6be703550d
> Kernel .config :
> https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f
>
> syz-repro :
> r0 = socket$nl_route(0x10, 0x3, 0x0)
> r1 = socket(0x10, 0x3, 0x0)
> r2 = socket(0x10, 0x3, 0x0)
> sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0,
> &(0x7f0000000140)={0x0, 0x140}}, 0x0)
> getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1,
> 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0xab)
> sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0,
> &(0x7f0000000780)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000024000b0e00"/20,
> @ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100687462001c0002001800020003"],
> 0x48}}, 0x0)
> sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0,
> &(0x7f0000000180)={&(0x7f00000007c0)=@newtfilter={0x40, 0x2c, 0xd27,
> 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff3}},
> [@filter_kind_options=@f_flower={{0xb}, {0x10, 0x2,
> [@TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @local}]}}]}, 0x40}}, 0x0)
> (fail_nth: 19)
>
>
> Console log :
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in tcf_action_destroy+0x17f/0x1b0
> Read of size 8 at addr ffff88811024d800 by task kworker/u4:1/11
>
> CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted
> 6.3.0-rc6-pasta-00035-g0bcc40255504 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Workqueue: tc_filter_workqueue fl_destroy_filter_work
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0xd9/0x150
>  print_address_description.constprop.0+0x2c/0x3c0
>  kasan_report+0x11c/0x130
>  tcf_action_destroy+0x17f/0x1b0
>  tcf_exts_destroy+0xc5/0x160
>  __fl_destroy_filter+0x1a/0x100
>  process_one_work+0x991/0x15c0
>  worker_thread+0x669/0x1090
>  kthread+0x2e8/0x3a0
>  ret_from_fork+0x1f/0x30
>  </TASK>
>
> Allocated by task 9570:
>  kasan_save_stack+0x22/0x40
>  kasan_set_track+0x25/0x30
>  __kasan_kmalloc+0xa3/0xb0
>  tcf_exts_init_ex+0xe4/0x5a0
>  fl_change+0x56f/0x4a20
>  tc_new_tfilter+0x995/0x22a0
>  rtnetlink_rcv_msg+0x996/0xd50
>  netlink_rcv_skb+0x165/0x440
>  netlink_unicast+0x547/0x7f0
>  netlink_sendmsg+0x926/0xe30
>  sock_sendmsg+0xde/0x190
>  ____sys_sendmsg+0x71c/0x900
>  ___sys_sendmsg+0x110/0x1b0
>  __sys_sendmsg+0xf7/0x1c0
>  do_syscall_64+0x39/0xb0
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Freed by task 9570:
>  kasan_save_stack+0x22/0x40
>  kasan_set_track+0x25/0x30
>  kasan_save_free_info+0x2b/0x40
>  ____kasan_slab_free+0x13b/0x1a0
>  __kmem_cache_free+0xcd/0x2c0
>  tcf_exts_destroy+0xe5/0x160
>  tcf_exts_init_ex+0x484/0x5a0
>  fl_change+0x56f/0x4a20
>  tc_new_tfilter+0x995/0x22a0
>  rtnetlink_rcv_msg+0x996/0xd50
>  netlink_rcv_skb+0x165/0x440
>  netlink_unicast+0x547/0x7f0
>  netlink_sendmsg+0x926/0xe30
>  sock_sendmsg+0xde/0x190
>  ____sys_sendmsg+0x71c/0x900
>  ___sys_sendmsg+0x110/0x1b0
>  __sys_sendmsg+0xf7/0x1c0
>  do_syscall_64+0x39/0xb0
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> The buggy address belongs to the object at ffff88811024d800
>  which belongs to the cache kmalloc-256 of size 256
> The buggy address is located 0 bytes inside of
>  freed 256-byte region [ffff88811024d800, ffff88811024d900)
>
> The buggy address belongs to the physical page:
> page:ffffea0004409340 refcount:1 mapcount:0 mapping:0000000000000000
> index:0x0 pfn:0x11024d
> flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff)
> raw: 057ff00000000200 ffff888012440500 ffffea000436ea10 ffffea00041aec10
> raw: 0000000000000000 ffff88811024d000 0000000100000008 0000000000000000
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask
> 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE),
> pid 8017, tgid 8017 (syz-executor.0), ts 60719725774, free_ts
> 60718847244
>  get_page_from_freelist+0x1190/0x2e20
>  __alloc_pages+0x1cb/0x4a0
>  cache_grow_begin+0x9b/0x3b0
>  cache_alloc_refill+0x27f/0x380
>  __kmem_cache_alloc_node+0x360/0x3f0
>  __kmalloc+0x4e/0x190
>  security_sb_alloc+0x105/0x240
>  alloc_super+0x236/0xb60
>  sget_fc+0x142/0x7c0
>  vfs_get_super+0x2d/0x280
>  vfs_get_tree+0x8d/0x350
>  path_mount+0x1342/0x1e40
>  __x64_sys_mount+0x283/0x300
>  do_syscall_64+0x39/0xb0
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> page last free stack trace:
>  free_pcp_prepare+0x5d5/0xa50
>  free_unref_page+0x1d/0x490
>  vfree+0x180/0x7e0
>  delayed_vfree_work+0x57/0x70
>  process_one_work+0x991/0x15c0
>  worker_thread+0x669/0x1090
>  kthread+0x2e8/0x3a0
>  ret_from_fork+0x1f/0x30
>
> Memory state around the buggy address:
>  ffff88811024d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  ffff88811024d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ffff88811024d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>                    ^
>  ffff88811024d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ffff88811024d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================